Play interactive tour

Edit tour

Analysis Report https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true

Overview

General Information

Sample URL:	https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true
Analysis ID:	344759
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Found iframes

HTML body contains low number of good links

Invalid 'forgot password' link found

Classification

Startup

System is w10x64

iexplore.exe (PID: 6900 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6960 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6900 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing:

Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=yd6uq5b84hz2
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=6b031tpjr1if
Source: https://www.efax.ca/how-it-works	HTTP Parser: Iframe src: https://www.youtube.com/embed/NcnKTqv8xUs
Source: https://www.efax.ca/how-it-works	HTTP Parser: Iframe src: //4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=4479762388673;gtm=2wg1d0;auiddc=2011994229.1611715386;~oref=https%3A%2F%2Fwww.efax.ca%2Fhow-it-works?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=td36auv93dpf
Source: https://en2.efax.com/myaccount/	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=uf67a8fclijg
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=yd6uq5b84hz2
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=6b031tpjr1if
Source: https://www.efax.ca/how-it-works	HTTP Parser: Iframe src: https://www.youtube.com/embed/NcnKTqv8xUs
Source: https://www.efax.ca/how-it-works	HTTP Parser: Iframe src: //4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=4479762388673;gtm=2wg1d0;auiddc=2011994229.1611715386;~oref=https%3A%2F%2Fwww.efax.ca%2Fhow-it-works?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=td36auv93dpf
Source: https://en2.efax.com/myaccount/	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=uf67a8fclijg
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0cHM6Ly9lbjIuZWZheC5jb206NDQz&hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK&size=invisible&cb=gbygdcjc5ks1

Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/	HTTP Parser: Number of links: 1
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Number of links: 1

Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/	HTTP Parser: Invalid link: FORGOT Password?
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: Invalid link: FORGOT Password?

Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="author".. found
Source: https://www.efax.ca/how-it-works	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="author".. found
Source: https://www.efax.ca/how-it-works	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/	HTTP Parser: No <meta name="author".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: No <meta name="author".. found

Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.efax.ca/how-it-works	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login	HTTP Parser: No <meta name="copyright".. found
Source: https://www.efax.ca/how-it-works	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/	HTTP Parser: No <meta name="copyright".. found
Source: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 108.128.28.146:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.128.28.146:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.1.166:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.1.166:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.20.226:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.20.226:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.162:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.162:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.147.111.106:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.147.111.106:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.241.47.148:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.241.47.148:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.155:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.155:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.129:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.129:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.22:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.22:443 -> 192.168.2.4:49816 version: TLS 1.2

Networking:

Source: global traffic

HTTP traffic detected: HTTP/1.1 200 OKDate: Wed, 27 Jan 2021 02:43:04 GMTContent-Type: text/html; charset=utf-8Content-Length: 2587Connection: keep-aliveCache-Control: privateContent-Encoding: gzipVary: Accept-EncodingServer: X-AspNet-Version: X-Frame-Options: SAMEORIGINData Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e e3 e4 37 4e 1e ff ae b3 6a da 5e af f2 74 de 2e ca 23 fe 08 bf a5 ef 16 e5 b2 f9 ec a3 79 db ae 1e dd bd 7b 75 75 35 be ba 37 ae ea 8b bb bb 0f 1f 3e bc fb 0e 6d 3e a2 e6 8f e7 79 36 3b 7a dc 16 6d 99 d3 9f 3f 96 3f cb de fd 23 7f 43 fa 9f fc 41 7f 6a 4a bf e5 cb b4 9a 2f 73 fc 7a 91 d7 ff e8 5f d6 8e f1 6b 9e 56 cb b2 a0 8f 9b 7c 39 a3 26 eb e5 2c cd 17 ab f3 6c 79 41 7f 6d a7 bf 57 5e 2c d1 4e 5e 49 27 f9 f2 1f fd 3b da e2 a2 1d 53 77 77 a5 a7 c7 8b bc cd d2 65 b6 c8 3f fb e8 b2 c8 af 56 55 dd 7e 94 4e ab 65 9b 2f db cf 3e ba 2a 66 ed fc b3 59 7e 59 4c f3 6d fe 63 94 16 cb a2 2d b2 72 bb 99 66 65 fe d9 ee 28 5d 64 ef 8a c5 7a e1 3e 58 37 79 cd 7f 65 13 fa 60 59 7d 94 de 0d 3a aa ab 49 d5 36 5e 37 cb aa a0 01 bc 1b 2d ab f3 aa 2c ab 2b fa 25 ab a7 f3 e2 32 a7 df aa d9 8a fe bd 9e 15 35 fd 68 96 c5 6a 95 13 8a 04 91 86 fe 36 9d d7 f9 f9 67 1f 1d af 56 bf ff 9b 79 be c8 9b bb 5f 64 c5 f2 ee 22 6b da bc 1e 4f 1b ea a5 ce cb cf 3e 6a da eb 32 6f e6 39 5e c5 2c 7d f6 51 9b bf 6b ef 72 83 10 94 4e 54 7e 9e bd 1b 4f ab f1 fa ed dd e6 6e 7d b7 58 64 17 04 fc 3c 23 4a 54 cb bb bb 9f be db fd 74 4c bf 1a f0 73 a2 db 74 dd a6 f4 d1 12 10 7f e3 24 a5 e7 71 33 ad 8b 55 9b 36 f5 f4 b3 8f ee de 9d 56 b3 7c fc d3 bf 68 9d d7 d7 04 7a 71 57 7e dd de 1d ef ee 8d ef 8d 17 c5 72 fc d3 84 4e 41 44 b9 a8 8b f6 1a 60 b3 bd fb 9f 6e 67 d9 97 4f bf 7d 7c 71 79 f5 13 df dd 9d 3c fb f2 f3 df fb 8b fc f7 fe 64 75 b2 ff f2 a7 ce 5e 36 97 cb bd f9 6e 73 5c ff 3e 5f ce 2f 7e ef 9f f8 8c a8 5a 57 4d 53 d5 c5 45 b1 fc ec a3 6c 59 2d af 17 d5 ba f9 e8 e8 f1 5d c1 86 71 33 98 79 b4 f8 e9 ec 32 93 4f 3f b2 08 cf 80 d2 2c 2f 8b cb 7a bc cc a9 0d 63 3c ce 7e 9a 88 b3 5e 56 93 b6 5e 37 34 4b 77 ef 8d f7 c6 fb e6 5b ef 8b 6d 6e a9 23 eb 60 c0 34 17 ea 6d 98 1c 99 14 46 e5 a7 9b f1 b4 ac d6 b3 f3 32 ab 73 26 20 a0 df 2d 8b 49 43 a4 ad de 16 39 11 9f 44 a1 dd 23 7c 76 c6 f7 c2 0f 19 0b 06 69 66 27 4d e5 e7 66 5a d8 c6 69 7a 99 d5 c4 b3 80 f9 b2 2a 8b e9 f5 97 ab b6 20 e0 e9 67 e9 f7 be 7f e8 9a e9 e3 3e 38 5f 2f a7 68 19 bc bc 75 27 fd c5 ae 09 1e ff 5b 07 ba d3 a8 fb ac aa d5 7a f5 24 9b be bd a8 2b 92 ff 93 aa ac ea 47 e9 c7 3f 9e cf f2 f3 f3 fb 1f 8f 6e f1 f6 1b 1a b1 7d ef e0 de c1 bd 87 bb 37 bd 37 59 b7 6d b5 b4 2f ed 4f 0e 76 f3 83 9b 5e ca df ad 8a 3a bf 7e 9a 5d 3f 4a ef ed dc d0 98 44 b9 21 91 7b 94 7e f4 74 4d aa 20 9d 15 79 7a 4e 42 46 52 98 b7 3f 68 f3 f4 c5 ba fd c1 7a 79 81

Source: global traffic	HTTP traffic detected: GET /s/r/js/jquery.cycle2.js HTTP/1.1Accept: application/javascript, /;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: go.efax.comConnection: Keep-AliveCookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Source: global traffic	HTTP traffic detected: GET /s/r/js/bootstrap.min.js HTTP/1.1Accept: application/javascript, /;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: go.efax.comConnection: Keep-AliveCookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Source: global traffic	HTTP traffic detected: GET /s/r/js/jquery.cycle2.center.js HTTP/1.1Accept: application/javascript, /;q=0.8Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: go.efax.comConnection: Keep-AliveCookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Source: global traffic	HTTP traffic detected: GET /s/r/images/favicon/16x16.ico HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoHost: efax.co.ukConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET / HTTP/1.1Accept: /Accept-Encoding: gzip, deflateUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoConnection: Keep-AliveHost: www.efax.ch

Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\n\u003Cscript type=\"text\/gtmscript\"\u003E(function(){var b=window._fbq\|\|(window._fbq=[]);if(!b.loaded){var a=document.createElement(\"script\");a.async=!0;a.src=\"\/\/connect.facebook.net\/en_US\/fbds.js\";var c=document.getElementsByTagName(\"script\")[0];c.parentNode.insertBefore(a,c);b.loaded=!0}})();window._fbq=window._fbq\|\|[];window._fbq.push([\"track\",\"6021213714541\",{value:\"0.00\",currency:\"USD\"}]);\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" alt=\"\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?ev=6021213714541\u0026amp;cd[value]=0.00\u0026amp;cd[currency]=USD\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E", equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Chead\u003E\n\n\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"829832763721911\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=829832763721911\u0026amp;ev=PageView\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E\n\n\n\u003C\/head\u003E\n\u003Cscript type=\"text\/gtmscript\"\u003Efbq(\"track\",\"CompleteRegistration\");\u003C\/script\u003E\n", equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E(function(){var b={\"@context\":\"https:\/\/schema.org\",\"@type\":\"Organization\",name:\"eFax\",url:\"https:\/\/www.efax.com\",logo:\"https:\/\/www.efax.com\/sf-images\/default-source\/pagespeedimage\/logo-efax.png\",description:\"eFax is the world\\u2019s #1 online fax service, and we have been for nearly 20 years. More than 10 million customers use eFax every day to send and receive business faxes online, including small businesses around the world and nearly half of the Fortune 500.With eFax, you can quickly and easily fax from your computer, tablet, smart phone or any other Internet-enabled device. No need for a fax machine, paper, ink, or extra fax phones lines. No more waiting in line at the fax machine, dealing with paper jams or redialing busy fax numbers. eFax lets you receive, review, edit, add a digitized signature, and securely send faxes from your email \\u2014 and store and retrieve all of your faxes online forever.\",\ncontactPoint:{\"@type\":\"ContactPoint\",telephone:\"1-800-878-7151\",contactType:\"customer service\",contactOption:\"TollFree\"},sameAs:[\"https:\/\/www.facebook.com\/efaxonline\",\"https:\/\/twitter.com\/efax\",\"https:\/\/www.instagram.com\/efaxonline\/\",\"https:\/\/www.youtube.com\/user\/efax\"]},a=document.createElement(\"script\");a.type=\"application\/ld+json\";a.innerHTML=JSON.stringify(b);document.getElementsByTagName(\"head\")[0].appendChild(a)})(document);\u003C\/script\u003E ", equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E(function(){var b={\"@context\":\"https:\/\/schema.org\",\"@type\":\"Organization\",name:\"eFax\",url:\"https:\/\/www.efax.com\",logo:\"https:\/\/www.efax.com\/sf-images\/default-source\/pagespeedimage\/logo-efax.png\",description:\"eFax is the world\\u2019s #1 online fax service, and we have been for nearly 20 years. More than 10 million customers use eFax every day to send and receive business faxes online, including small businesses around the world and nearly half of the Fortune 500.With eFax, you can quickly and easily fax from your computer, tablet, smart phone or any other Internet-enabled device. No need for a fax machine, paper, ink, or extra fax phones lines. No more waiting in line at the fax machine, dealing with paper jams or redialing busy fax numbers. eFax lets you receive, review, edit, add a digitized signature, and securely send faxes from your email \\u2014 and store and retrieve all of your faxes online forever.\",\ncontactPoint:{\"@type\":\"ContactPoint\",telephone:\"1-800-878-7151\",contactType:\"customer service\",contactOption:\"TollFree\"},sameAs:[\"https:\/\/www.facebook.com\/efaxonline\",\"https:\/\/twitter.com\/efax\",\"https:\/\/www.instagram.com\/efaxonline\/\",\"https:\/\/www.youtube.com\/user\/efax\"]},a=document.createElement(\"script\");a.type=\"application\/ld+json\";a.innerHTML=JSON.stringify(b);document.getElementsByTagName(\"head\")[0].appendChild(a)})(document);\u003C\/script\u003E ", equals www.twitter.com (Twitter)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E(function(){var b={\"@context\":\"https:\/\/schema.org\",\"@type\":\"Organization\",name:\"eFax\",url:\"https:\/\/www.efax.com\",logo:\"https:\/\/www.efax.com\/sf-images\/default-source\/pagespeedimage\/logo-efax.png\",description:\"eFax is the world\\u2019s #1 online fax service, and we have been for nearly 20 years. More than 10 million customers use eFax every day to send and receive business faxes online, including small businesses around the world and nearly half of the Fortune 500.With eFax, you can quickly and easily fax from your computer, tablet, smart phone or any other Internet-enabled device. No need for a fax machine, paper, ink, or extra fax phones lines. No more waiting in line at the fax machine, dealing with paper jams or redialing busy fax numbers. eFax lets you receive, review, edit, add a digitized signature, and securely send faxes from your email \\u2014 and store and retrieve all of your faxes online forever.\",\ncontactPoint:{\"@type\":\"ContactPoint\",telephone:\"1-800-878-7151\",contactType:\"customer service\",contactOption:\"TollFree\"},sameAs:[\"https:\/\/www.facebook.com\/efaxonline\",\"https:\/\/twitter.com\/efax\",\"https:\/\/www.instagram.com\/efaxonline\/\",\"https:\/\/www.youtube.com\/user\/efax\"]},a=document.createElement(\"script\");a.type=\"application\/ld+json\";a.innerHTML=JSON.stringify(b);document.getElementsByTagName(\"head\")[0].appendChild(a)})(document);\u003C\/script\u003E ", equals www.youtube.com (Youtube)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <li><a href="https://www.facebook.com/efaxonline" target="_blank"><span class="fa fa-facebook fa-lg" aria-hidden="true"></span></a> </li> equals www.facebook.com (Facebook)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <li><a href="https://www.facebook.com/efaxonline"><span class="fa fa-facebook fa-lg" aria-hidden="true"></span></a> </li> equals www.facebook.com (Facebook)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <li><a href="https://www.youtube.com/user/efax" target="_blank"><span class="fa fa-youtube-play fa-lg" aria-hidden="true"></span></a> </li> equals www.youtube.com (Youtube)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <li><a href="https://www.youtube.com/user/efax"><span class="fa fa-youtube-play fa-lg" aria-hidden="true"></span></a> </li> equals www.youtube.com (Youtube)
Source: NcnKTqv8xUs[1].htm.2.dr	String found in binary or memory: <link rel="canonical" href="https://www.youtube.com/watch?v=NcnKTqv8xUs"> equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: (g.Wm(b,"www.youtube.com"),c=b.toString()):c=Lw(c);b=new Nw(c);b.set("cmo=pf","1");d&&b.set("cmo=td","a1.googlevideo.com");return b}; equals www.youtube.com (Youtube)
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: )https://www.youtube.com/embed/NcnKTqv8xUs equals www.youtube.com (Youtube)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <a href="http://www.linkedin.com/company/efax" target="_blank"><em class="fa fa-linkedin-square fa-lg"></em></a> equals www.linkedin.com (Linkedin)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <a href="https://www.facebook.com/efaxonline" target="_blank"><em class="fa fa-facebook-square fa-lg"></em></a> equals www.facebook.com (Facebook)
Source: NcnKTqv8xUs[1].htm.2.dr	String found in binary or memory: <div id="player"></div><script >yt.setConfig({"INNERTUBE_CONTEXT_GL":"GB","INNERTUBE_CONTEXT_HL":"en","POST_MESSAGE_ORIGIN":"*","GAPI_LOCALE":"en_US","INNERTUBE_CONTEXT_CLIENT_VERSION":"20210126","PLAYER_VARS":{"allow_autonav":"1","adformat":null,"enablecastapi":"1","rel":"1","video_id":"NcnKTqv8xUs","is_embed":"1","playsinline":false,"embedded_player_response":"{\"responseContext\":{\"serviceTrackingParams\":[{\"service\":\"CSI\",\"params\":[{\"key\":\"c\",\"value\":\"WEB_EMBEDDED_PLAYER\"},{\"key\":\"cver\",\"value\":\"20210126\"},{\"key\":\"yt_li\",\"value\":\"0\"},{\"key\":\"GetEmbeddedPlayer_rid\",\"value\":\"0xbc5d10e04f6fa10f\"}]},{\"service\":\"GFEEDBACK\",\"params\":[{\"key\":\"logged_in\",\"value\":\"0\"},{\"key\":\"e\",\"value\":\"23911055,23975726,23990879,23987676,23971937,23946420,23804281,23969486,23891344,23979420,23857949,23981908,23944779,23839597,1714240,23744176,23990334,23983732,23974595,23992390,23951620,23918597,23882503,23988822,23984822,23990293,23950598,23986713,23968386,23996375,23884386,23891346,23969934,23976578,23934970,23885566,23973488\"}]},{\"service\":\"GUIDED_HELP\",\"params\":[{\"key\":\"logged_in\",\"value\":\"0\"}]},{\"service\":\"ECATCHER\",\"params\":[{\"key\":\"client.version\",\"value\":\"20210126\"},{\"key\":\"client.name\",\"value\":\"WEB_EMBEDDED_PLAYER\"}]}]},\"embedPreview\":{\"thumbnailPreviewRenderer\":{\"title\":{\"runs\":[{\"text\":\"How Online Faxing Works - eFax\"}]},\"defaultThumbnail\":{\"thumbnails\":[{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/default.jpg\",\"width\":120,\"height\":90},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/hqdefault.jpg?sqp=-oaymwEWCKgBEF5IWvKriqkDCQgBFQAAiEIYAQ==\\u0026rs=AOn4CLCIy7vYawl2E6rnEfeohRDR0e0H-Q\",\"width\":168,\"height\":94},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/hqdefault.jpg?sqp=-oaymwEWCMQBEG5IWvKriqkDCQgBFQAAiEIYAQ==\\u0026rs=AOn4CLD13Jp6IULJtiHgiqDCsU6vfs_6pw\",\"width\":196,\"height\":110},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/hqdefault.jpg?sqp=-oaymwEXCPYBEIoBSFryq4qpAwkIARUAAIhCGAE=\\u0026rs=AOn4CLDNzAXRZDBNY0qHySDAa88TGWPoMA\",\"width\":246,\"height\":138},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/mqdefault.jpg\",\"width\":320,\"height\":180},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/hqdefault.jpg?sqp=-oaymwEXCNACELwBSFryq4qpAwkIARUAAIhCGAE=\\u0026rs=AOn4CLBjYK6dyiX9Prt9cqKWJjDqhfmmng\",\"width\":336,\"height\":188},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/hqdefault.jpg\",\"width\":480,\"height\":360},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/sddefault.jpg\",\"width\":640,\"height\":480},{\"url\":\"https:\/\/i.ytimg.com\/vi\/NcnKTqv8xUs\/maxresdefault.jpg\",\"width\":1920,\"height\":1080}]},\"playButton\":{\"buttonRenderer\":{\"style\":\"STYLE_DEFAULT\",\"size\":\"SIZE_DEFAULT\",\"isDisabled\":false,\"navigationEndpoint\":{\"clickTrackingParams\":\"CAcQ8FsiEwiauZnci7vuAhUDo1UKHTUHBTY=\",\"watchEndpoint\":{\"videoId\":\"NcnKTqv8xUs\"}},\"accessibility\":{\"label\":\"Play H
Source: how-it-works[1].htm.2.dr	String found in binary or memory: <iframe allow="autoplay; encrypted-media" src="https://www.youtube.com/embed/NcnKTqv8xUs" width="560" height="315" frameborder="0"></iframe></div> equals www.youtube.com (Youtube)
Source: NcnKTqv8xUs[1].htm.2.dr	String found in binary or memory: <noscript><div class="player-unavailable"><h1 class="message">An error occurred.</h1><div class="submessage"><a href="https://www.youtube.com/watch?v=NcnKTqv8xUs" target="_blank">Try watching this video on www.youtube.com</a>, or enable JavaScript if it is disabled in your browser.</div></div></noscript></body></html> equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: Qha=function(a,b){if(!a.u["0"]){var c=new jB("0","fakesb",void 0,new eB(0,0,0,void 0,void 0,"auto"),null,null,1);a.u["0"]=b?new bA(new Nw("http://www.youtube.com/videoplayback"),c,"fake"):new px(new Nw("http://www.youtube.com/videoplayback"),c,new Mv(0,0),new Mv(0,0),0,NaN)}}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: b),this.U=!1,this.videoData.Y("html5_playready_enable_non_persist_license")&&(this.F.pst="0"));b=xH(this.B)?Nta(c.initData).replace("skd://","https://"):this.B.C;this.videoData.Y("enable_shadow_yttv_channels")&&(b=new g.Um(b),document.location.origin&&document.location.origin.includes("green")?g.Wm(b,"web-green-qa.youtube.com"):g.Wm(b,"www.youtube.com"),b=b.toString());this.baseUrl=b;this.fairplayKeyId=Qd(this.baseUrl,"ek")\|\|"";if(b=Qd(this.baseUrl,"cpi")\|\|"")this.cryptoPeriodIndex=Number(b);this.ga= equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.ID=function(a){a=xD(a.U);return"www.youtube-nocookie.com"===a?"www.youtube.com":a}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.XO.prototype.B=function(a){var b=this;eqa(this);var c=a.Nx,d=this.api.S();"GENERIC_WITHOUT_LINK"!==c\|\|d.I?"TOO_MANY_REQUESTS"===c?(d=this.api.getVideoData(),this.Gc($O(this,"TOO_MANY_REQUESTS_WITH_LINK",d.Dl(),void 0,void 0,void 0,!1))):"HTML5_NO_AVAILABLE_FORMATS_FALLBACK"!==c\|\|d.I?this.Gc(g.YO(a.errorMessage)):this.Gc($O(this,"HTML5_NO_AVAILABLE_FORMATS_FALLBACK_WITH_LINK_SHORT","//www.youtube.com/supported_browsers")):(a=d.hostLanguage,c="//support.google.com/youtube/?p=player_error1",a&&(c= equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: g.ZD=function(a){var b=g.JD(a);!a.Y("yt_embeds_disable_new_error_lozenge_url")&&lia.includes(b)&&(b="www.youtube.com");return a.protocol+"://"+b}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: k.clone=function(){var a=new $m;a.C=this.C;this.u&&(a.u=this.u.clone(),a.B=this.B);return a};var gn="://secure-...imrworldwide.com/ ://cdn.imrworldwide.com/ ://aksecure.imrworldwide.com/ ://[^.]*.moatads.com ://youtube[0-9]+.moatpixel.com ://pm.adsafeprotected.com/youtube ://pm.test-adsafeprotected.com/youtube ://e[0-9]+.yt.srs.doubleverify.com www.google.com/pagead/xsul www.youtube.com/pagead/slav".split(" "),pea=/\bocr\b/;var qea=/(?:\[\|%5B)([a-zA-Z0-9_]+)(?:\]\|%5D)/g;var ED={iY:"LIVING_ROOM_APP_MODE_UNSPECIFIED",fY:"LIVING_ROOM_APP_MODE_MAIN",eY:"LIVING_ROOM_APP_MODE_KIDS",gY:"LIVING_ROOM_APP_MODE_MUSIC",hY:"LIVING_ROOM_APP_MODE_UNPLUGGED",dY:"LIVING_ROOM_APP_MODE_GAMING"},wya={D0:"PLAYBACK_TYPE_UNKNOWN",x0:"PLAYBACK_TYPE_APPLICATION",w0:"PLAYBACK_TYPE_ADS",B0:"PLAYBACK_TYPE_REMOTE",C0:"PLAYBACK_TYPE_SECONDARY_CAMERA",A0:"PLAYBACK_TYPE_PREROLL_INTERSTITIAL",z0:"PLAYBACK_TYPE_POSTROLL_INTERSTITIAL",y0:"PLAYBACK_TYPE_MIDROLL_INTERSTITIAL"};kn.prototype.set=function(a,b){b=void 0===b?!0:b;0<=a&&52>a&&0===a%1&&this.B[a]!=b&&(this.B[a]=b,this.u=-1)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: k.getVideoUrl=function(a,b,c,d,e){b={list:b};c&&(e?b.time_continue=c:b.t=c);c=g.JD(this);d&&"www.youtube.com"===c?d="https://youtu.be/"+a:g.CD(this)?(d="https://"+c+"/fire",b.v=a):(d=this.protocol+"://"+c+"/watch",b.v=a,fr&&(a=Yp())&&(b.ebc=a));return g.Id(d,b)}; equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: l,"Trusted Ad Domain URL");this.ka=Q(!1,a.privembed);this.protocol=0===this.Zb.indexOf("http:")?"http":"https";this.U=Gw((b?b.customBaseYoutubeUrl:a.BASE_YT_URL)\|\|"")\|\|Gw(this.Zb)\|\|this.protocol+"://www.youtube.com/";l=b?b.eventLabel:a.el;h="detailpage";"adunit"===l?h=this.B?"embedded":"detailpage":"embedded"===l\|\|this.C?h=bD(h,l,jia):l&&(h="embedded");this.da=h;Ep();l=null;h=b?b.playerStyle:a.ps;var m=g.fb(hD,h);!h\|\|m&&!this.C\|\|(l=h);this.playerStyle=l;this.K=(this.I=g.fb(hD,this.playerStyle))&& equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: new Set;this.deviceHasDisplay=b?!b.deviceIsAudioOnly:Q(!0,a.deviceHasDisplay);this.Ee=cD(this.Ee,a.ismb);t=a;g.aB(this.experiments,"html5_qoe_intercept")?t=g.aB(this.experiments,"html5_qoe_intercept"):this.hj?(t=t.vss_host\|\|"s.youtube.com",this.Y("www_for_videostats")&&"s.youtube.com"===t&&(t=xD(this.U)\|\|"www.youtube.com")):t="video.google.com";this.Th=t;yD(this,a,!0);this.N=new PC;g.C(this,this.N);t=b?b.innertubeApiKey:dD("",a.innertube_api_key);r=b?b.innertubeApiVersion:dD("",a.innertube_api_version); equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: this.V("highrepfallback");else if(a.u){var d=this.B?this.B.B.F:null;if(Kua(a)&&d&&d.isLocked())var e="FORMAT_UNAVAILABLE";else if(!this.u.I&&"auth"===a.errorCode&&"429"===a.details.rc){e="TOO_MANY_REQUESTS";var f="6"}this.V("playererror",a.errorCode,e,g.yB(a.details),f)}else d=/^pp/.test(this.videoData.clientPlaybackNonce),BU(this,a.errorCode,a.details),d&&"manifest.net.connect"===a.errorCode&&(d="https://www.youtube.com/generate_204?cpn="+this.videoData.clientPlaybackNonce+"&t="+(0,g.M)(),(new OT(d, equals www.youtube.com (Youtube)
Source: base[1].js.2.dr	String found in binary or memory: vL.prototype.replace=function(a,b){for(var c=g.q(a),d=c.next();!d.done;d=c.next())delete this.u[d.value.encryptedTokenJarContents];ama(this,b)};wL.prototype.pn=function(a){var b,c,d=null===(b=a.responseContext)\|\|void 0===b?void 0:b.locationPlayabilityToken;void 0!==d&&(this.locationPlayabilityToken=d,this.u=void 0,"TVHTML5"===(null===(c=a.responseContext)\|\|void 0===c?void 0:c.clientName)?(this.localStorage=bma(this))&&this.localStorage.set("yt-location-playability-token",d,15552E3):g.Cq("YT_CL",JSON.stringify({x4:d}),15552E3,void 0,!0))};var ema={bluetooth:"CONN_DISCO",cellular:"CONN_CELLULAR_UNKNOWN",ethernet:"CONN_WIFI",none:"CONN_NONE",wifi:"CONN_WIFI",wimax:"CONN_CELLULAR_4G",other:"CONN_UNKNOWN",unknown:"CONN_UNKNOWN","slow-2g":"CONN_CELLULAR_2G","2g":"CONN_CELLULAR_2G","3g":"CONN_CELLULAR_3G","4g":"CONN_CELLULAR_4G"};var zL;g.u(yL,Pq);yL.prototype.Pt=function(a,b){return Object.assign(Object.assign({},Pq.prototype.Pt.call(this,a,b)),this.u)};var tma=/[&\?]action_proxy=1/,sma=/[&\?]token=([\w-])/,uma=/[&\?]video_id=([\w-])/,vma=/[&\?]index=([\d-])/,wma=/[&\?]m_pos_ms=([\d-])/,zma=/[&\?]vvt=([\w-])/,Ama=/[&\?]mt=([\d-])/,nma="ca_type dt el flash u_tz u_his u_h u_w u_ah u_aw u_cd u_nplug u_nmime frm u_java bc bih biw brdim vis wgl".split(" "),xma="www.youtube-nocookie.com youtube-nocookie.com www.youtube-nocookie.com:443 youtube.googleapis.com www.youtubeedu.com www.youtubeeducation.com video.google.com redirector.gvt1.com".split(" "), equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.efax.com

Source: va-3f0c180483cb4e78e02f988160e89ee1[1].js.2.dr	String found in binary or memory: http://benalman.com/projects/jquery-hashchange-plugin/
Source: commonJqueryScripts[2].js.2.dr	String found in binary or memory: http://blog.firetree.net/2005/07/04/javascript-find-position/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://dk.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://dk.efax.com/
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Accordion
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Autocomplete
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Button
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Datepicker
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Dialog
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Draggables
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Droppables
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Blind
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Bounce
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Clip
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Drop
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Explode
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Fade
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Fold
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Highlight
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Pulsate
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Scale
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Shake
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Slide
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Effects/Transfer
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Mouse
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Position
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Progressbar
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Resizables
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Selectables
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Slider
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Sortables
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Tabs
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Widget
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://efax.co.uk/s/r/images/favicon/16x16.ico
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://en.efax.com
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: http://en.efax.com/online_fax_FAQ
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://en.efax.com/online_fax_basics
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://fi.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://fi.efax.com/
Source: font-awesome.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].css.2.dr, bootstrap[1].css.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-bold-webfont.eot
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-bold-webfont.eot?#iefix
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-bold-webfont.svg#titillium_webbold
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-bold-webfont.ttf
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-bold-webfont.woff
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-regular-webfont.eot
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-regular-webfont.eot?#iefix
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-regular-webfont.svg#titillium_webregular
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-regular-webfont.ttf
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-regular-webfont.woff
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-semibold-webfont.eot
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-semibold-webfont.eot?#iefix
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-semibold-webfont.svg#titillium_websemibold
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-semibold-webfont.ttf
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.co.uk/fonts/titillium-semibold-webfont.woff
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/badge-app-store.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/badge-app-store.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/badge-google-play.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/badge-google-play.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-cta-lines.png);
Source: responsive-layouts[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-language-selection-gradient-xs.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-language-selection-gradient.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-language-selection-strip.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-main-content.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/bg-testimonials-primary.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/cross-sell.png);
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/cross-sell.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-caret-up.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-caret-up.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-chevron-left.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-chevron-left.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-chevron-right.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-chevron-right.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-cloud-imac.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-cloud-imac.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-coins.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-coins.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-efax-app.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-efax-app.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-email.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-email.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-filing-cabinet.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-filing-cabinet.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-hand-shake.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-hand-shake.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-quick-stopwatch.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-quick-stopwatch.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-shield.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-shield.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-signature.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/icons/icon-signature.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax-no-tagline.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax-no-tagline.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax-small.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax-small.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax.png)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/logos/logo-efax.svg)
Source: efax-style[1].css.2.dr	String found in binary or memory: http://go.efax.com/s/r/images/talk-bubble-tail-lg.png)
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://go.efax.com/s/r/js/bootstrap.min.js
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://go.efax.com/s/r/js/jquery.cycle2.center.js
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://go.efax.com/s/r/js/jquery.cycle2.js
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://hi.efax.co.in
Source: login[2].htm.2.dr	String found in binary or memory: http://hi.efax.co.in/
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: http://home.efax.com/efax-resources/efax_user_guide.pdf
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://hu.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://hu.efax.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://investor.j2global.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://it.efax.com
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://it.efax.com/
Source: va-3f0c180483cb4e78e02f988160e89ee1[1].js.2.dr	String found in binary or memory: http://jquery.com/
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://jquery.org/license
Source: jquery-ui-1.8.16.custom.min[1].js0.2.dr	String found in binary or memory: http://jqueryui.com/about)
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://no.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://no.efax.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://schema.org/Webpage
Source: titilliumwebregular[1].eot.2.dr	String found in binary or memory: http://scripts.sil.org/OFL
Source: titilliumwebregular[1].eot.2.dr, titilliumwebbold[1].eot.2.dr	String found in binary or memory: http://scripts.sil.org/OFLThis
Source: titilliumwebbold[1].eot.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLhttp://scripts.sil.org/OFL
Source: titilliumwebregular[1].eot.2.dr	String found in binary or memory: http://scripts.sil.org/OFLhttp://scripts.sil.org/OFLhttp://scripts.sil.org/OFLTitillium
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://se.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://se.efax.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://tw.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://tw.efax.com/
Source: KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr, KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.br.efax.com
Source: login[2].htm.2.dr	String found in binary or memory: http://www.br.efax.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.eFax.pl
Source: favicon[1].htm.2.dr	String found in binary or memory: http://www.efax.ch/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.co.jp
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.co.jp/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.co.kr
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.co.kr/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.com.au/how-internet-fax-works
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: http://www.efax.com.au/web-fax-faq
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.com.ro
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.com.ro/
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: http://www.efax.com/help-center/faqs
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.com/how-it-works
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://www.efax.de/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.de/homePage
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.es/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.es/homePage
Source: 495HIR2B.htm.2.dr	String found in binary or memory: http://www.efax.fr/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.fr/homePage
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.nl/homePage
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.pl/
Source: login[2].htm.2.dr	String found in binary or memory: http://www.efax.pt/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.efax.pt/pt/intl/product/page/homePage
Source: login[2].htm.2.dr	String found in binary or memory: http://www.j2global.com
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://www.linkedin.com/company/efax
Source: Telerik.Web.UI.WebResource[1].js0.2.dr	String found in binary or memory: http://www.telerik.com/kendo-ui)
Source: Telerik.Web.UI.WebResource[1].js0.2.dr	String found in binary or memory: http://www.telerik.com/purchase/license-agreement/kendo-ui-complete
Source: base[1].js.2.dr	String found in binary or memory: http://www.youtube.com/videoplayback
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/drm/2012/10/10
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/metadata/segment/102015
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/streaming/otf/durations/112015
Source: how-it-works[1].htm.2.dr	String found in binary or memory: http://youtube.com/user/efax
Source: base[1].js.2.dr	String found in binary or memory: http://youtube.com/yt/2012/10/10
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=25244456791
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=44797623886
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=98638514805
Source: gtm[1].js.2.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: base[1].js.2.dr	String found in binary or memory: https://admin.youtube.com
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://app.vwo.com/visitor-behavior-analysis/dist/codechecker/cc.min.js?r=
Source: f[1].txt.2.dr	String found in binary or memory: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Source: chat_loader[1].js.2.dr	String found in binary or memory: https://c.la4-c1-dfw.salesforceliveagent.com/content
Source: chat_loader[1].js.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://c.la4-c1-phx.salesforceliveagent.com/content
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: how-it-works[1].htm.2.dr, pricing[1].htm.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.5.1.min.js
Source: chat_loader[1].js.2.dr	String found in binary or memory: https://d.la4-c1-dfw.salesforceliveagent.com/chat
Source: chat_loader[1].js.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://d.la4-c1-phx.salesforceliveagent.com/chat
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/7.0/track-3f0c180483cb4e78e02f988160e89ee1.js
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-b7dcb10662af8baedec6b74a4afbd17d.js
Source: j[1].js0.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/e.gif?a=232379&s=j.php&e=
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/e.gif?s=mode_det&e=
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/j.php?mode=
Source: j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	String found in binary or memory: https://dev.visualwebsiteoptimizer.com/v.gif?cd=
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: base[1].js.2.dr	String found in binary or memory: https://docs.google.com/get_video_info
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://en2.efax.com/m
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://en2.efax.com/myaccount/
Source: imagestore.dat.2.dr	String found in binary or memory: https://en2.efax.com/myaccount/images/favicon.ico~
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://en2.efax.com/myaccount/login
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_conten
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://en2.efax.com/myaccount/logintm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://en2.efax.com/myaccount/nter#ViewContentPlaceHolder_C017_Col00
Source: login[2].htm.2.dr	String found in binary or memory: https://en3.efax.com/signup/number
Source: pricing[1].htm.2.dr	String found in binary or memory: https://enterprise.efax.com/request-custom-quote?campaign=70999
Source: how-it-works[1].htm.2.dr, pricing[1].htm.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhv.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhv.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhv.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff)
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://getbootstrap.com/)
Source: gtm[1].js.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: login[2].htm.2.dr	String found in binary or memory: https://it.efax.com/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://itunes.apple.com/us/app/efax/id399922064?mt=8
Source: how-it-works[1].htm.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://j2global.secure.force.com/chat
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://j2global.secure.force.com/chat/resource/chat_loader
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://modernizr.com/download/?-flexbox-flexboxlegacy-flexboxtweener-flexwrap-setclasses
Source: how-it-works[1].htm.2.dr, efax-help-center[1].htm.2.dr	String found in binary or memory: https://na62.salesforce.com
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://oss.maxcdn.com/libs/html5shiv/3.7.0/html5shiv.js
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://oss.maxcdn.com/libs/respond.js/1.3.0/respond.min.js
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: base[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/pagead/osd.js
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=com.j2.efax
Source: login[2].htm.2.dr	String found in binary or memory: https://sassets.j2global.com/home.efax.com/CBD/5/5/5-en-web-logo.gif
Source: chat_loader[1].js.2.dr	String found in binary or memory: https://service.force.com
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://service.force.com/embeddedservice/5.0/esw.min.js
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=missing_quality
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=noaudio
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/?p=report_playback
Source: base[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/6276924
Source: remote[1].js.2.dr	String found in binary or memory: https://support.google.com/youtube/answer/7640706
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://twitter.com/efax
Source: base[1].js.2.dr	String found in binary or memory: https://viacon.corp.google.com
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/ef
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/efax-help-center
Source: login[2].htm.2.dr, {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/efax-help-center#ViewContentPlaceHolder_C017_Col00
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/efax-help-centerR
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.efax.ca/favicon.ico
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/ho
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr, ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/how-it-works
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/how-it-worksb
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/how-it-worksin?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/how-it-workspHow
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/pr
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/pricing
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ca/pricingXInternet
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/pricingorks
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ca/pricingorks/www.efax.ca/favicon.ico
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.efax.ch/
Source: ~DF33E658DB61EBF325.TMP.1.dr	String found in binary or memory: https://www.efax.ch/yaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=
Source: login[2].htm.2.dr	String found in binary or memory: https://www.efax.co.uk/
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.efax.co.uk/how-it-works
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.efax.com/Sitefinity/Dialog/PropertyEditor?Id=fe31ff38-dd47-6859-a4ab-ff000097cdd4&Me
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: https://www.efax.com/efax-help-center
Source: efax-help-center[1].htm.2.dr	String found in binary or memory: https://www.efax.com/efax-help-center/how-to-cancel
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.efax.com/how-it-works
Source: pricing[1].htm.2.dr	String found in binary or memory: https://www.efax.com/pricing
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.efax.com/sf-images/default-source/how-it-works/receive-online-step-2.png?sfvrsn=2
Source: login[2].htm.2.dr	String found in binary or memory: https://www.efax.de/
Source: 495HIR2B.htm.2.dr	String found in binary or memory: https://www.efax.de/privacy#Cookie-Richtlinie
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.efax.es/conceptos-basicos-fax-virtual
Source: login[2].htm.2.dr	String found in binary or memory: https://www.efax.fr/
Source: login[2].htm.2.dr	String found in binary or memory: https://www.efax.nl/
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com/pagead/conversion_async.js
Source: login[2].htm.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?hl=en
Source: login[2].htm.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH
Source: anchor[1].htm.2.dr, api[1].js.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH&co=aHR0
Source: base[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/certificateprovisioning/v1/devicecertificates/create?key=AIzaSyB-5OLKTx2i
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: how-it-works[1].htm.2.dr, login[2].htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: login[2].htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-5FGQ2JB
Source: remote[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/cv/js/sender/v1/cast_sender.js
Source: anchor[1].htm.2.dr, api[1].js.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js
Source: anchor[1].htm.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/styles__ltr.css
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.instagram.com/efaxonline
Source: how-it-works[1].htm.2.dr, {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.youtube.com/embed/NcnKTqv8xUs
Source: base[1].js.2.dr	String found in binary or memory: https://www.youtube.com/generate_204?cpn=
Source: how-it-works[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/user/efax
Source: NcnKTqv8xUs[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=NcnKTqv8xUs
Source: base[1].js.2.dr	String found in binary or memory: https://youtu.be/
Source: base[1].js.2.dr	String found in binary or memory: https://youtube.com/api/drm/fps?ek=uninitialized
Source: base[1].js.2.dr	String found in binary or memory: https://youtubei.googleapis.com/youtubei/
Source: base[1].js.2.dr	String found in binary or memory: https://yurt.corp.google.com

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49797 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789

Source: unknown	HTTPS traffic detected: 108.128.28.146:443 -> 192.168.2.4:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.128.28.146:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.96.102.137:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.1.166:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 161.71.1.166:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.20.226:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.20.226:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.162:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.162:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.147.111.106:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 136.147.111.106:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.22.227:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.241.47.148:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 34.241.47.148:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.155:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.155:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.129:443 -> 192.168.2.4:49814 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 216.58.207.129:443 -> 192.168.2.4:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.22:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.22:443 -> 192.168.2.4:49816 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: clean1.win@3/181@28/14

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51267499-6049-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFC70EEBD402160F5D.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6900 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6900 CREDAT:17410 /prefetch:2	Jump to behavior

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Windows\SysWOW64\Macromed\Flash\ss.cfg

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol3	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol4	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer2	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://go.efax.co.uk/fonts/titillium-bold-webfont.ttf	0%	Avira URL Cloud	safe
http://www.efax.co.jp	0%	Avira URL Cloud	safe
http://www.efax.ch/	0%	Avira URL Cloud	safe
https://www.efax.fr/	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://www.efax.es/conceptos-basicos-fax-virtual	0%	Avira URL Cloud	safe
http://www.eFax.pl	0%	Avira URL Cloud	safe
http://www.efax.pt/pt/intl/product/page/homePage	0%	Avira URL Cloud	safe
http://www.efax.pt/	0%	Avira URL Cloud	safe
http://www.efax.fr/homePage	0%	Avira URL Cloud	safe
http://www.efax.com.ro/	0%	Avira URL Cloud	safe
https://www.efax.co.uk/	0%	Avira URL Cloud	safe
http://go.efax.co.uk/fonts/titillium-semibold-webfont.svg#titillium_websemibold	0%	Avira URL Cloud	safe
http://www.efax.de/	0%	Avira URL Cloud	safe
http://www.efax.nl/homePage	0%	Avira URL Cloud	safe
http://www.efax.com.ro	0%	Avira URL Cloud	safe
http://www.efax.co.kr	0%	Avira URL Cloud	safe
http://www.efax.de/homePage	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
go.efax.com	204.11.168.2	true	false	high
pagead46.l.doubleclick.net	216.58.207.162	true	false	high
efax.co.uk	204.11.168.165	true	false	unknown
stats.l.doubleclick.net	108.177.15.155	true	false	high
i.ytimg.com	172.217.23.22	true	false	high
dev.visualwebsiteoptimizer.com	34.96.102.137	true	false	high
awseb-e-g-awsebloa-nt5wfb9wmmft-1397624435.eu-west-1.elb.amazonaws.com	34.241.47.148	true	false	high
j2-cloud-eu-sf-alb-1688558620.eu-west-1.elb.amazonaws.com	108.128.28.146	true	false	high
pagead.l.doubleclick.net	172.217.20.226	true	false	high
cdnjs.cloudflare.com	104.16.19.94	true	false	high
www.google.co.uk	172.217.22.227	true	false	unknown
photos-ugc.l.googleusercontent.com	216.58.207.129	true	false	high
location.l.force.com	161.71.1.166	true	false	high
na62-dfw.dfw.r.force.com	136.147.111.106	true	false	high
sassets.j2global.com	unknown	unknown	false	unknown
yt3.ggpht.com	unknown	unknown	false	high
cdn.jsdelivr.net	unknown	unknown	false	high
en.efax.com	unknown	unknown	false	high
www.efax.ch	unknown	unknown	false	unknown
stats.g.doubleclick.net	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high
en2.efax.com	unknown	unknown	false	high
www.youtube.com	unknown	unknown	false	high
stackpath.bootstrapcdn.com	unknown	unknown	false	high
r.turn.com	unknown	unknown	false	high
resources.xg4ken.com	unknown	unknown	false	high
static.doubleclick.net	unknown	unknown	false	high
service.force.com	unknown	unknown	false	high
www.efax.co.uk	unknown	unknown	false	unknown
googleads.g.doubleclick.net	unknown	unknown	false	high
www.efax.ca	unknown	unknown	false	high
j2global.secure.force.com	unknown	unknown	false	high
en3.efax.com	unknown	unknown	false	high
www.efax.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://www.efax.ch/	false	Avira URL Cloud: safe	unknown
https://www.efax.ch/	false		unknown
https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin	false		high
https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login	false		high
https://www.efax.ca/efax-help-center#ViewContentPlaceHolder_C017_Col00	false		high
https://www.efax.ca/how-it-works	false		high
http://go.efax.com/s/r/js/jquery.cycle2.js	false		high
https://en2.efax.com/myaccount/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://docs.jquery.com/UI/Dialog	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://go.efax.co.uk/fonts/titillium-bold-webfont.ttf	efax-style[1].css.2.dr	false	Avira URL Cloud: safe	unknown
https://enterprise.efax.com/request-custom-quote?campaign=70999	pricing[1].htm.2.dr	false		high
https://dev.visualwebsiteoptimizer.com/v.gif?cd=	j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	false		high
http://www.br.efax.com/	login[2].htm.2.dr	false		high
https://www.efax.ca/ho	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://go.efax.com/s/r/images/bg-cta-lines.png);	efax-style[1].css.2.dr	false		high
http://docs.jquery.com/UI/Tabs	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-shield.png)	efax-style[1].css.2.dr	false		high
https://en2.efax.com/myaccount/nter#ViewContentPlaceHolder_C017_Col00	~DF33E658DB61EBF325.TMP.1.dr	false		high
http://www.efax.co.jp	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://admin.youtube.com	base[1].js.2.dr	false		high
https://www.efax.fr/	login[2].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://getbootstrap.com)	bootstrap.min[1].css.2.dr, bootstrap[1].css.2.dr	false	Avira URL Cloud: safe	low
http://no.efax.com/	login[2].htm.2.dr	false		high
https://it.efax.com/	login[2].htm.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
http://go.efax.com/s/r/images/logos/logo-efax.svg)	efax-style[1].css.2.dr	false		high
https://www.efax.com/sf-images/default-source/how-it-works/receive-online-step-2.png?sfvrsn=2	how-it-works[1].htm.2.dr	false		high
https://www.efax.es/conceptos-basicos-fax-virtual	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.eFax.pl	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.efax.com/how-it-works	how-it-works[1].htm.2.dr	false		high
https://www.efax.com/pricing	pricing[1].htm.2.dr	false		high
https://www.youtube.com/generate_204?cpn=	base[1].js.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-efax-app.png)	efax-style[1].css.2.dr	false		high
http://go.efax.com/s/r/images/logos/logo-efax-no-tagline.svg)	efax-style[1].css.2.dr	false		high
http://docs.jquery.com/UI	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-filing-cabinet.png)	efax-style[1].css.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-quick-stopwatch.svg)	efax-style[1].css.2.dr	false		high
http://benalman.com/projects/jquery-hashchange-plugin/	va-3f0c180483cb4e78e02f988160e89ee1[1].js.2.dr	false		high
https://c.la4-c1-phx.salesforceliveagent.com/content	chat_loader[1].js.2.dr, efax-help-center[1].htm.2.dr	false		high
http://it.efax.com	how-it-works[1].htm.2.dr	false		high
http://en.efax.com/online_fax_FAQ	efax-help-center[1].htm.2.dr	false		high
http://www.efax.pt/pt/intl/product/page/homePage	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.jquery.com/UI/Effects/Fold	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-cloud-imac.svg)	efax-style[1].css.2.dr	false		high
https://en2.efax.com/myaccount/login	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://go.efax.com/s/r/images/badge-google-play.png)	efax-style[1].css.2.dr	false		high
http://docs.jquery.com/UI/Mouse	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
https://4382037.fls.doubleclick.net/activityi;src=4382037;type=visit789;cat=unive123;ord=44797623886	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://go.efax.com/s/r/images/bg-language-selection-strip.png)	efax-style[1].css.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-caret-up.png)	efax-style[1].css.2.dr	false		high
http://www.efax.pt/	login[2].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://na62.salesforce.com	how-it-works[1].htm.2.dr, efax-help-center[1].htm.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-signature.png)	efax-style[1].css.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[1].css.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-chevron-right.png)	efax-style[1].css.2.dr	false		high
http://www.efax.fr/homePage	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.jquery.com/UI/Effects/Slide	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://www.telerik.com/kendo-ui)	Telerik.Web.UI.WebResource[1].js0.2.dr	false		high
https://d.la4-c1-phx.salesforceliveagent.com/chat	chat_loader[1].js.2.dr, efax-help-center[1].htm.2.dr	false		high
https://www.efax.ca/pricingorks/www.efax.ca/favicon.ico	~DF33E658DB61EBF325.TMP.1.dr	false		high
https://www.youtube.com/embed/NcnKTqv8xUs	how-it-works[1].htm.2.dr, {5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.efax.com/Sitefinity/Dialog/PropertyEditor?Id=fe31ff38-dd47-6859-a4ab-ff000097cdd4&Me	how-it-works[1].htm.2.dr	false		high
https://www.efax.ca/how-it-worksin?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=	~DF33E658DB61EBF325.TMP.1.dr	false		high
http://youtube.com/streaming/metadata/segment/102015	base[1].js.2.dr	false		high
https://youtu.be/	base[1].js.2.dr	false		high
http://docs.jquery.com/UI/Resizables	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://docs.jquery.com/UI/Effects/Shake	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://www.efax.com.ro/	login[2].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://docs.jquery.com/UI/Droppables	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_conten	~DF33E658DB61EBF325.TMP.1.dr	false		high
https://www.efax.co.uk/	login[2].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.efax.ca/how-it-worksb	~DF33E658DB61EBF325.TMP.1.dr	false		high
https://en2.efax.com/m	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://docs.jquery.com/UI/Widget	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://go.efax.co.uk/fonts/titillium-semibold-webfont.svg#titillium_websemibold	efax-style[1].css.2.dr	false	Avira URL Cloud: safe	unknown
http://go.efax.com/s/r/images/badge-app-store.png)	efax-style[1].css.2.dr	false		high
http://go.efax.com/s/r/images/badge-google-play.svg)	efax-style[1].css.2.dr	false		high
http://go.efax.com/s/r/images/talk-bubble-tail-lg.png)	efax-style[1].css.2.dr	false		high
http://www.efax.de/	495HIR2B.htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.efax.nl/homePage	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://app.vwo.com/visitor-behavior-analysis/dist/codechecker/cc.min.js?r=	j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	false		high
https://www.efax.ca/ef	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://www.efax.com.ro	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://tw.efax.com/	login[2].htm.2.dr	false		high
https://www.efax.ca/pricing	{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
http://www.efax.co.kr	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://youtube.com/api/drm/fps?ek=uninitialized	base[1].js.2.dr	false		high
http://go.efax.com/s/r/images/icons/icon-hand-shake.png)	efax-style[1].css.2.dr	false		high
http://docs.jquery.com/UI/Effects/Fade	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
https://d.la4-c1-dfw.salesforceliveagent.com/chat	chat_loader[1].js.2.dr	false		high
https://www.instagram.com/efaxonline	how-it-works[1].htm.2.dr	false		high
http://www.efax.de/homePage	how-it-works[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://getbootstrap.com/)	bootstrap.min[1].js.2.dr	false		high
http://docs.jquery.com/UI/Slider	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://docs.jquery.com/UI/Effects/Pulsate	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
https://c.la4-c1-dfw.salesforceliveagent.com/content	chat_loader[1].js.2.dr	false		high
http://fi.efax.com/	login[2].htm.2.dr	false		high
https://dev.visualwebsiteoptimizer.com/7.0/track-3f0c180483cb4e78e02f988160e89ee1.js	j[1].js0.2.dr, j[1].js.2.dr, j[2].js.2.dr	false		high
http://docs.jquery.com/UI/Effects/	jquery-ui-1.8.16.custom.min[1].js0.2.dr	false		high
http://fontawesome.io/license	font-awesome.min[1].css.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
34.241.47.148	unknown	United States	16509	AMAZON-02US	false
108.177.15.155	unknown	United States	15169	GOOGLEUS	false
136.147.111.106	unknown	United States	14340	SALESFORCEUS	false
204.11.168.165	unknown	United States	11166	JCOM-3US	false
172.217.20.226	unknown	United States	15169	GOOGLEUS	false
204.11.168.2	unknown	United States	11166	JCOM-3US	false
34.96.102.137	unknown	United States	15169	GOOGLEUS	false
161.71.1.166	unknown	United States	14340	SALESFORCEUS	false
216.58.207.162	unknown	United States	15169	GOOGLEUS	false
108.128.28.146	unknown	United States	16509	AMAZON-02US	false
172.217.23.22	unknown	United States	15169	GOOGLEUS	false
216.58.207.129	unknown	United States	15169	GOOGLEUS	false
172.217.22.227	unknown	United States	15169	GOOGLEUS	false
104.16.19.94	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344759
Start date:	27.01.2021
Start time:	03:41:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	13
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@3/181@28/14
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://en.efax.com/ Browsing link: https://en3.efax.com/signup/number Browsing link: https://www.efax.ca/how-it-works Browsing link: https://www.efax.ca/pricing Browsing link: https://www.efax.ca/efax-help-center#ViewContentPlaceHolder_C017_Col00 Browsing link: https://en2.efax.com/myaccount/ Browsing link: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#login Browsing link: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotNumber Browsing link: https://en2.efax.com/myaccount/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true#forgotPin Browsing link: https://en2.efax.com/myaccount/internet_fax_login?tab=forgotLogin Browsing link: https://en2.efax.com/myaccount/internet_fax_login?tab=forgotPin
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, svchost.exe, wuapihost.exe Excluded IPs from analysis (whitelisted): 52.255.188.83, 168.61.161.212, 40.88.32.150, 104.42.151.234, 104.83.120.32, 92.122.37.7, 13.64.90.137, 172.217.23.36, 88.221.230.204, 172.217.23.67, 216.58.207.136, 216.58.206.3, 151.101.2.109, 151.101.66.109, 151.101.130.109, 151.101.194.109, 209.197.3.24, 51.104.139.180, 172.217.23.74, 209.197.3.15, 204.79.197.200, 13.107.21.200, 46.228.164.11, 152.199.19.161, 95.101.22.216, 95.101.22.224, 216.58.207.142, 216.58.207.174, 172.217.20.238, 172.217.23.14, 172.217.23.46, 172.217.23.78, 172.217.22.206, 216.58.212.174, 172.217.23.38, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, cds.s5x3j6q5.hwcdn.net, arc.msn.com.nsatc.net, en3.efax.com.edgekey.net, e11290.dspg.akamaiedge.net, skypedataprdcoleus15.cloudapp.net, www.google.com, watson.telemetry.microsoft.com, www.gstatic.com, www.google-analytics.com, fonts.googleapis.com, dual-a-0001.a-msedge.net, en.efax.com.edgekey.net, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, skypedataprdcolcus17.cloudapp.net, en2.efax.com.edgekey.net, ris.api.iris.microsoft.com, youtube-ui.l.google.com, e8668.i.akamaiedge.net, blobcollector.events.data.trafficmanager.net, www.efax.ca.edgekey.net, cs9.wpc.v0cdn.net, www.efax.co.uk.edgekey.net, www.googleadservices.com, a1449.dscg2.akamai.net, arc.msn.com, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, r.turn.com.akadns.net, go.microsoft.com, www.googletagmanager.com, bat.bing.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, sassets.j2global.com.edgekey.net, e5584.p.akamaiedge.net, dualstack.f3.shared.global.fastly.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, static-doubleclick-net.l.google.com, skypedataprdcoleus17.cloudapp.net, e5584.i.akamaiedge.net, bat-bing-com.a-0001.a-msedge.net, go.microsoft.com.edgekey.net, cds.j3z9t3p6.hwcdn.net, www.efax.com.edgekey.net, skypedataprdcolwus16.cloudapp.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found. VT rate limit hit for: https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BC6XF3KU\www.google[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	11875
Entropy (8bit):	5.456355076765755
Encrypted:	false
SSDEEP:	192:5KG8yMM5KG8yMMzpKG8yMM5KG8yMMJRKG8yMM5KG8yMMCKG8yMMYJuKG8yMM5KGQ:5KG8yMM5KG8yMMtKG8yMM5KG8yMMjKGX
MD5:	552453D0D47218AC4F3A8C3E4664D0C4
SHA1:	8BB071254E2A707120D69A1FB056E4C5452B1616
SHA-256:	FFE979A048CE07D2CCABFC1B3904362E056F6EF82CC98BEC42ACAF76C98E8F61
SHA-512:	AA1AEC3F09584F869B753DA4C49E534D34C0E76046EDC1359467B02F7A8A68737BC1134017E3CAF85606F074E48BCDDEC5F59DB33D3B65DDDA4953E79E8610A2
Malicious:	false
Reputation:	low
Preview:	<root><item name="sb_wiz.qc" value="1" ltime="2811281280" htime="30840570" /><item name="sb_wiz.zpc." value="[[["news UK",0,[362,308,154,357],{"zl":40009}],["dinner recipes",0,[362,308,154,357],{"zl":40009}],["24hr supermarket near me",0,[362,308,154,357],{"zl":40009}],["last minute holidays",0,[362,308,154,357],{"zl":40009}],["weather tomorrow",0,[362,308,154,357],{"zl":40009}],["cities in UK",0,[362,308,154,357],{"zl":40009}]],{"ag":{"a":{"40009":"Try searching for"}},"q":"m-8sCxwNVqraaMzd_0n2ExiMRbc"}]" ltime="2829291280" htime="30840570" /><item name="rc::a" value="MzNmYjN4Y3lqaHY=" ltime="379856880" htime="30864470" /></root><root><item name="sb_wiz.qc" value="1" ltime="2811281280" htime="30840570" /><item name="sb_wiz.zpc." value="[[["news UK",0,[362,308,154,357],{"zl":40009}],[&quot

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\www.efax[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	6478
Entropy (8bit):	5.226986318709242
Encrypted:	false
SSDEEP:	96:AZ2E5nsZ2E5nG23sZ2E5nG23wR8sZ2E5n32MwR8sZ2E5n32MwR8sZ2E5n32MwRv+:H+uWrWHWH6g6g6a6aqa4
MD5:	F7221A0287AB03C7A9CD9EA5AE90A570
SHA1:	A66D9E4DA9C923CCE91647CF06937B07E562E81C
SHA-256:	EAEC550D15C7B902E0B73316EFAC02495C482483ACA9BA7CFF69AA7D192914AD
SHA-512:	830257F3C2A25CFAF4E0198D4284FE0F84B15E71DDBA1FD743F4486BA16FA06FA92735CA9238EF004D5A1102B3C2174A251D0A59F258F4BF7DE069543B6AEB84
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="vwoSn" value="{"v":"0.1.0","lt":"1611715386","r":"","cu":"https%3A%2F%2Fwww.efax.ca%2Fhow-it-works"}" ltime="605146880" htime="30864470" /></root><root><item name="vwoSn" value="{"v":"0.1.0","lt":"1611715386","r":"","cu":"https%3A%2F%2Fwww.efax.ca%2Fhow-it-works"}" ltime="605146880" htime="30864470" /><item name="_uetsid" value="66613910604911eb8756b51a9d72eb48" ltime="673136880" htime="30864470" /><item name="_uetsid_exp" value="Thu, 28 Jan 2021 02:43:13 GMT" ltime="673136880" htime="30864470" /></root><root><item name="vwoSn" value="{"v":"0.1.0","lt":"1611715386","r":"","cu":"https%3A%2F%2Fwww.efax.ca%2Fhow-it-works"}" ltime="605146880" htime="30864470" /><item name="_uetsid" value="66613910604911eb8756b51a9d72eb48" l

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\www.youtube[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	890
Entropy (8bit):	5.063205986637037
Encrypted:	false
SSDEEP:	24:W000UJzS0UJ5S0Ub+IloSUb+Iloftr+l6Y:+lofoifPifkQY
MD5:	EA294E1439732DA5F2FCB9AD6D0C9A94
SHA1:	393B07FEB57442002BCAF9F40DE7ED4D07C0E5BC
SHA-256:	12E68855A40D9B09E5FCD641A330A7AA1457BFE62341EB56B09C86380C6033FA
SHA-512:	DF4CAE8D1A8ADB78620836DD4F1E4B8B312723ED25A6D6EED5F7C18BDD92ECE1C92EAE3AB428C33B1D61335C2515354704705216DE04482838917921018821F9
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root></root><root></root><root><item name="__sak" value="1" ltime="721096880" htime="30864470" /></root><root></root><root><item name="__sak" value="1" ltime="759736880" htime="30864470" /></root><root></root><root><item name="yt-remote-device-id" value="{"data":"78f7e07b-a275-45d2-966c-60e25ba81e65","expiration":1643251401863,"creation":1611715401877}" ltime="760896880" htime="30864470" /></root><root><item name="yt-remote-device-id" value="{"data":"78f7e07b-a275-45d2-966c-60e25ba81e65","expiration":1643251401863,"creation":1611715401877}" ltime="760896880" htime="30864470" /><item name="yt-remote-connected-devices" value="{"data":"[]","expiration":1611801802011,"creation":1611715402011}" ltime="761736880" htime="30864470" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{51267499-6049-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8494642153800707
Encrypted:	false
SSDEEP:	192:rqZdZw2o9W0tJif2S4zM0AByGDWsfKSFjX:rWTnoUgmLJfl3
MD5:	2E27C0FAE2CE868780991ABC4F9689C1
SHA1:	61DCD94AB032D0BA5E6B5DE2C19FDE8BDD6DD527
SHA-256:	18E5F2F46DFBF917BFB48CEBA956E718E0C62DAD5E47596E52DB31D2324EC2D9
SHA-512:	C6923CD6BE5103E7841B8010CD1E528B703680997FCF0EE8BCA3E3D9273C8C6B4F13CDB370D6777C9C3AA303FDB7941D76A8501BCCF04AA66E72E71610495BA9
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{5126749B-6049-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	252468
Entropy (8bit):	3.1865308358005295
Encrypted:	false
SSDEEP:	1536:b/9CZ9CwDm9b4p8D7tg0xbyYdisotc9a+pP:b/s290Szis4c9tpP
MD5:	A17A5D53E9E1EBF2366534BF37B6D894
SHA1:	F1A92D82F40D7C7BA251598D0540035152E4A7D8
SHA-256:	5AAC91E2DEEC03ADFFBB8CF9E748A47D97BEC776D02EA1ACE06AA008D977DD2F
SHA-512:	8ABED4E6519849DCFAA3F3A382487A21A3FA94A60A1D03D2AB3BB8BEF15704A3EA05DAB655B5DA67C830673FCAD342110ABE44037315460799C8482106D42D21
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{578E8B26-6049-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.566648857782931
Encrypted:	false
SSDEEP:	48:IwBGcprYGwpaJG4pQFGrapbSBrGQpKYG7HpResTGIpG:r3ZAQL61BSBFAjTe4A
MD5:	57ABC992F3B21F186DBF716449EA6E73
SHA1:	F636505FA587CBB47165FF3B87BB5B8738B2B3B1
SHA-256:	B6B31CDCA75D0C5411ED98C8D6C0A3FE4A39150C82C9EA884BFB48E9869C33DC
SHA-512:	C5F0D9B45285FB3B1DFD680B477A99C9A2AA4D7ADB4FB504724BF56DD865933F4EEEDCA2F932C493DE5D847FFA29420321899EDA308F4457572322FB34AF32A6
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	1736
Entropy (8bit):	5.1046272507830395
Encrypted:	false
SSDEEP:	24:amVewQOIz0Wk2Yh/xaMsNxHN18ltlf6/IwWeCvRHxw/QplMt:am0/OItkWDE6/QJHI
MD5:	8DB99511B96F34927791414F71899CF8
SHA1:	9D0DD42EF47D215FFA402D1BDC018CFEE175C210
SHA-256:	1845F617C80FA8A858AFCF4CF5CD0CAA2FAB08460CBAB02ED58AABA444C58B7C
SHA-512:	FECBEDF5281251AE2A8148F22AFBFD926460D6D9315132BB7B51F415EA6C6E16A74A5E10121C8A950945A68F6684CD8D29B35EDCC366EDCC41C6592C9FCB00C9
Malicious:	false
Reputation:	low
Preview:	1.h.t.t.p.s.:././.e.n.2...e.f.a.x...c.o.m./.m.y.a.c.c.o.u.n.t./.i.m.a.g.e.s./.f.a.v.i.c.o.n...i.c.o.~............... .h.......(....... ..... ...................................."...<...<...(...............................................h...................._................................rf.M8%..............0...WH.............M........................1 .....?...y.......wl..6$..ZK.........y.......................0.......H8..0...3 ..SC......ma..8'.........o................&...5#......-...6$..PD.bX..6'..RC......4"...................... ..D+.......-....t..{.]N......h^..>-......3!..O?.R............#...%...[M..oe..H8..}t..-...0...[M..of..D4......1...0..A...............%(...}..@2..h[..dZ...5%..v..H:..pc..`T.........................M+.......@2..UF......B1..7%............../......{............ ......V+...~s..of../......3#...}-....w..H8.............................<%...K;............bT......bT..RC./...}q.9........................ ...&...+...-.......,...uk.tH7......\|.h..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\5-en-web-logo[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 221 x 39
Category:	downloaded
Size (bytes):	3067
Entropy (8bit):	7.532310133015216
Encrypted:	false
SSDEEP:	48:2xKZ6KKS2Nn2DGJ3wgL8ENz/QAT2MMDkcag+h++y+2Y6yr:2pSK2C7N5TY5R+h+S2Y6yr
MD5:	37DCBEDE05C7F4ABC12BFEB1B49BED60
SHA1:	BCE91B048A4709046B26210644F56C8CB344B038
SHA-256:	E8F9B44EF226B15289D4B2E10974A9A6C76159677B7207F541E43D78963C18A6
SHA-512:	8E50D6ACD4F2E15BAC70A21EAED4A1F28943B741287F8114E16830086F55B5D5A14D2B827BE017E8B6C23F4A9651987252EAF8210F9DE98D78C88BABD810A5C0
Malicious:	false
Reputation:	low
IE Cache URL:	https://sassets.j2global.com/home.efax.com/CBD/5/5/5-en-web-logo.gif
Preview:	GIF89a..'..T.............@@@.......<:....KI..................ig.......................-.xw............```...... ...ppp....ZX......000...PPP......?.....TTTjjj<<<;;;......DDDBBB.ts.../..GGG888............xxx.........333......fff===.....................**..........................................................................................................................................!..XMP DataXMP<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.5-c014 79.151481, 2013/03/13-12:09:15 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC (Windows)" xmpMM:InstanceID="xmp.iid:955A5CC64ACC11E399B1B229364ED50D" xmpMM:DocumentID="xmp.did:955A5CC74ACC11E399B1B229364ED50D"> <xmpMM:Derive

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\IFPPFSFJ.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	6911
Entropy (8bit):	5.100664215298125
Encrypted:	false
SSDEEP:	96:s7Z7QZAIGH3bpOHNR2Zfr/edevOinf1hpvOin+oMztxJFOtwtKSr5NiCXBB:s2GH90kZz/i4f7doJwsBXj
MD5:	27B9C8A2E53EF3644FBCCF76ABA688DE
SHA1:	A3B5C9E42C8BA070ECE48E32117D3513D9EC54AC
SHA-256:	C86BE8FA67CDBD0DD425132F2D47BF4CC43692FBB4F249CFACF2C8D979280E1F
SHA-512:	CB227A37D6567F01401AB82E635738F785CC45B158B4F63B917A66739B659B68F70CF383E670DAA854A044FB6D261D67D8FA021C255C385250E3031F05D0FF28
Malicious:	false
Reputation:	low
Preview:	....<!doctype html>....<html xmlns="http://www.w3.org/1999/xhtml">..<head><title>...eFax. . Faxen ohne Faxger.t. Faxe online senden und empfangen - Kein Faxger.t ben.tigt...</title><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /><meta name="robots" content="noindex,nofollow,noarchive,noodp,noydir,nosnippet" /><link href="App_Themes/Main/master.css" rel="stylesheet" type="text/css" /><link href="http://efax.co.uk/s/r/images/favicon/16x16.ico" rel="shortcut icon" />.. <script src="//code.jquery.com/jquery-1.12.3.min.js" integrity="sha256-aaODHAgvwQW1bFOGXMeX+pC4PZIPsvn2h1sArYOhgXQ=" crossorigin="anonymous"></script>.. <script type="text/javascript" src="//cdn.jsdelivr.net/jquery.ajax.unobtrusive/3.2.4/jquery.unobtrusive-ajax.min.js"></script>.. <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css" />.. .. <script type="text/javascript">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmEU9fBBc-[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20012, version 1.1
Category:	downloaded
Size (bytes):	20012
Entropy (8bit):	7.966842359681559
Encrypted:	false
SSDEEP:	384:Yc6bX9TagDCXKqs4+W5XVgaflKHjsGdZtlh3K/qzWz/scZpuB:YcCVaeCaF4ea9KHYQZtlh3Kgy4B
MD5:	DE8B7431B74642E830AF4D4F4B513EC9
SHA1:	F549F1FE8A0B86EF3FBDCB8D508440AFF84C385C
SHA-256:	3BFE46BB1CA35B205306C5EC664E99E4A816F48A417B6B42E77A1F43F0BC4E7A
SHA-512:	57D3D4DE3816307ED954B796C13BFA34AF22A46A2FEA310DF90E966301350AE8ADAC62BCD2ABF7D7768E6BDCBB3DFC5069378A728436173D07ABFA483C1025AC
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff
Preview:	wOFF......N,................................GDEF.......G...d....GPOS................GSUB............7b..OS/2.......R...`t.#.cmap...4.......L....cvt .......\...\1..Kfpgm...@...2......$.gasp...t............glyf......:...j.'..hdmx..G,...f........head..G....6...6...rhhea..G........$....hmtx..G....a......MOloca..JP........\v@zmaxp..L,... ... ....name..LL..........:.post..M(....... .m.dprep..M<.......S...)x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x...pfK.G...1.c>..`9..m<+;..m.x...bg.M.T...O............l...XU.../{.[_..W....c.._..72.. ." z.+..F.......&.&...`e..T].....K=..K2S....q..d...xf.$~i..$?.d..dU.....@R-/LMO-J6...[]..Z..O.C_."If..d....fS....$d.G>eL`....Tf1.......9.c>..`1.TR..x./d-........q.........7....{...v.....!.....1.QG=.4.D3-..F;=..1'.'q.rw...9..e!.....Q....f......qV.n.h.V.Z]..B..C.[B...V.......v...o.w.{...w..zRO.i=..._.....-.m....].=...[...(1.(.#.....O0/.0?..04rL.G.9.....i6..l..\|.(o.....\|$,..{\|&\|....YJ...x.e8B.#..t;R8.{+....\=.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Me
Category:	downloaded
Size (bytes):	35588
Entropy (8bit):	6.410135551455154
Encrypted:	false
SSDEEP:	768:6yVJgIpAqZsXgDNHOBBPXNOKdhT1N+06XAxGrzmoqpxk0SnuUR:enq805OBBdhT1NP6XAxGryoqp2
MD5:	4D88404F733741EAACFDA2E318840A98
SHA1:	49E0F3D32666AC36205F84AC7457030CA0A9D95F
SHA-256:	B464107219AF95400AF44C949574D9617DE760E100712D4DEC8F51A76C50DDA1
SHA-512:	2E5D3280D5F7E70CA3EA29E7C01F47FEB57FE93FC55FD0EA63641E99E5D699BB4B1F1F686DA25C91BA4F64833F9946070F7546558CBD68249B0D853949FF85C5
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Preview:	........... GDEF......{....dGPOS......\|<....GSUB7b.....8....OS/2t.#...r....`cmap......st...Lcvt 1..K..y....\fpgm..$...v.....gasp......{.....glyf.'.....,..j.hdmx......r\|....head...r..n....6hhea......q....$hmtx..MO..n@....loca\v@z..l(....maxp......l.... name..:...z,....post.m.d..{.... prep...)..x\|...S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOmCnqEu92Fr1Mu4mxM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19824, version 1.1
Category:	downloaded
Size (bytes):	19824
Entropy (8bit):	7.970306766642997
Encrypted:	false
SSDEEP:	384:ozNCb8EbW9Wg166uwroOp/taiap3K6MC4fsPPuzt+7NCXzS65XZELt:K4zbWcDVwt230hfs+x+Bb65X2
MD5:	BAFB105BAEB22D965C70FE52BA6B49D9
SHA1:	934014CC9BBE5883542BE756B3146C05844B254F
SHA-256:	1570F866BF6EAE82041E407280894A86AD2B8B275E01908AE156914DC693A4ED
SHA-512:	85A91773B0283E3B2400C773527542228478CC1B9E8AD8EA62435D705E98702A40BEDF26CB5B0900DD8FECC79F802B8C1839184E787D9416886DBC73DFF22A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff
Preview:	wOFF......Mp.......P........................GDEF.......G...d....GPOS...............hGSUB............7b..OS/2.......R...`tq#.cmap...........L....cvt .......T...T+...fpgm.......5....w.`.gasp...@............glyf...L..:+..j.....hdmx..Fx...g........head..F....6...6.j.zhhea..G........$....hmtx..G8...]......Vlloca..I.........?.#.maxp..Kt... ... ....name..K........t.U9.post..Ld....... .m.dprep..Lx.......I.f..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x.....[....#N..m.m.m.mfm....SP..NuM..9]..=.U..!...[........w...\|......^p....H......;...)..........;..EoDo....E.E.D...`.0.GG.aA.H.V.Mx\xA....../..d3.Eb_.J...R.^v........\^ob.}.z..k.x).v$f$..O)+.2..*....y}6`C6b.6cs...l...........!.........<..\|.\|..\|..\|..\|.\|....o....I%.4.L.SI.&C.6..!`...{...c..\.J.(.2.C....V.A..?.M<nG......v..m.;..R.C..aj.H...=..{.>.:.....}i_Y......:....o.&k..KY.2..6k....i]..{,.p}../.....VO3.o].fJ....R-TZ..;...RN..&V...C...3.?.......&..z.s&.D....r,.I...t.R..a$k..Mm..Y.U...+b.%kQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Telerik.Web.UI.WebResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	3581835
Entropy (8bit):	5.263387161919535
Encrypted:	false
SSDEEP:	49152:RxuBYMaSqwWSgLusidIaswFH6VW6KiCAFWxICQuFPg0Tvrf99KdvOqzXzOiFQJGP:jlCA66
MD5:	7636EDDC058BDD63E59EC04FCD207B42
SHA1:	90D1630B61C71459EF90F243DEFAD090D2C6C186
SHA-256:	2C4171762B0F994919E7164A471A34F34E8899A630E4FA1A3188A4C8743603E9
SHA-512:	0E0D6A10247A873348E88CF99AC89519C31DD3B374B3A0054BEA1CE20E697327FD7FD1DD11CFA575167E9A8FD7179DA0C98BE802C1DD33220061C75741784073
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Telerik.Web.UI.WebResource.axd?_TSM_HiddenField_=ctl09_TSM&compress=0&_TSM_CombinedScripts_=%3b%3bTelerik.Sitefinity.Resources%3aen%3a48ca75c3-ec91-47e4-a971-46fcf09e2ac5%3ab162b7a1%3ad4b35ef7%3bTelerik.Sitefinity%2c+Version%3d12.2.7230.0%2c+Culture%3dneutral%2c+PublicKeyToken%3db28c218413bdf563%3aen%3a5837cf03-8491-4573-aced-68a56b474f2b%3a3b9a1b05%3bTelerik.Sitefinity.Search.Impl%2c+Version%3d12.2.7230.0%2c+Culture%3dneutral%2c+PublicKeyToken%3db28c218413bdf563%3aen%3a25bf626f-a0a8-4ca0-854c-f5d060415c26%3a7561727d
Preview:	/* START Telerik.Sitefinity.Resources.Scripts.jquery-migrate-1.2.1.min.js /../! jQuery Migrate v1.2.1 \| (c) 2005, 2013 jQuery Foundation, Inc. and other contributors \| jquery.org/license */.jQuery.migrateMute === void 0 && (jQuery.migrateMute = !0), function (e, t, n) { function r(n) { var r = t.console; i[n] \|\| (i[n] = !0, e.migrateWarnings.push(n), r && r.warn && !e.migrateMute && (r.warn("JQMIGRATE: " + n), e.migrateTrace && r.trace && r.trace())) } function a(t, a, i, o) { if (Object.defineProperty) try { return Object.defineProperty(t, a, { configurable: !0, enumerable: !0, get: function () { return r(o), i }, set: function (e) { r(o), i = e } }), n } catch (s) { } e._definePropertyBroken = !0, t[a] = i } var i = {}; e.migrateWarnings = [], !e.migrateMute && t.console && t.console.log && t.console.log("JQMIGRATE: Logging is active"), e.migrateTrace === n && (e.migrateTrace = !0), e.migrateReset = function () { i = {}, e.migrateWarnings.length = 0 }, "BackCompat" === document.com

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\anchor[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	13939
Entropy (8bit):	5.954282845548592
Encrypted:	false
SSDEEP:	384:3/SZkp8moRos7cuzXbH1oj+/ilTwXxHk59b:3/SZkp7op1bVc+6twBM9b
MD5:	BB44860294F7A9266F5903E67A45117D
SHA1:	79FCA8FADEE3BD1A30947DF3899EA34F39C2E406
SHA-256:	EFE7AB1D2B2C62DFF008420A34C307BC7933DF242746DD1C8BD20EE2FCD14D8D
SHA-512:	4F2E887571B8ABB0CD8EB5D8A6D8B868173DB71308CF40E45DC884E5446FB569783114246E7D86933F50463860561153F214E3B3BBD4168AB7A5BE3F93E207BC
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<style type="text/css">.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 500;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 900;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf) format('truetype');.}..</style>.<link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/styles__ltr.css" nonce="cd8Qtcj25IjHRoQkmuA2YQ">.<script nonce="cd8Qtcj25IjHRoQkmuA2YQ" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\bootstrap[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	121220
Entropy (8bit):	5.015226811342442
Encrypted:	false
SSDEEP:	1536:YilqUBSyPaAdGlvJuWI8LrN8AL6A9B/okj+SAjZF65Y5iuE:YHUBSunsH7LROA9B/okj+SAjZF65T
MD5:	03CBC5DC0B5B117264AE74515CD3FB76
SHA1:	F9AEE2A38A135A2D63D30F9BCB1247DC4F927D4B
SHA-256:	0E430441E9833F9E3B9219B4837068670AFBB50171678365B95F45DE9291B632
SHA-512:	20C03F433C155E8319348963E78D8CE1A388A049E9A3AF3325E190595D3D5AE386A579E5B3E0BE618B4F18FFA349A4E3A32C193BA583EB846A01D11F6C9D6E89
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/bootstrap.css
Preview:	/!. Bootstrap v3.1.1 (http://getbootstrap.com). * Copyright 2011-2014 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /../! normalize.css v3.0.0 \| MIT License \| git.io/normalize */.html {. font-family: sans-serif;. -webkit-text-size-adjust: 100%;. -ms-text-size-adjust: 100%;.}.body {. margin: 0;.}.article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.nav,.section,.summary {. display: block;.}.audio,.canvas,.progress,.video {. display: inline-block;. vertical-align: baseline;.}.audio:not([controls]) {. display: none;. height: 0;.}.[hidden],.template {. display: none;.}.a {. background: transparent;.}.a:active,.a:hover {. outline: 0;.}.abbr[title] {. border-bottom: 1px dotted;.}.b,.strong {. font-weight: bold;.}.dfn {. font-style: italic;.}.h1 {. margin: .67em 0;. font-size: 2em;.}.mark {. color: #000;. background: #ff0;.}.small {. font-size: 80%;.}.sub,.sup {. position: relative;. font-size:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\btn_login[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 85 x 40, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	6283
Entropy (8bit):	7.922274073358119
Encrypted:	false
SSDEEP:	192:ASBWiNw6jYa+FR1xUQczkCFKGTcgpQR3uBDU:n99rkDxtcIyKbrR3cDU
MD5:	4E9B19598A266A5846C07ED14B43BF87
SHA1:	9DC5677BDDD7AB39DAE4BB236A50BAD9BB860A95
SHA-256:	B82168C28DE10B3006C0489F179A93619F898C7A7A6A9BD3F88CBB545BBD01F9
SHA-512:	FFAB87A30C7433295218A13F3FA9C060DB045B20367858F90D718B69F64A2C4C24ED27D811AF6AEEF4CFD7FD6723AB0C61C7A0BD792934286924A0534BDB340D
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/efaxi/en/buttons/btn_login.png
Preview:	.PNG........IHDR...U...(......+!.....pHYs.................gAMA....\|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx.t....0..g."..g.mM.P......}..;."...D.c.2B...c.l..:..u.U..E.z_.?.\...u.....F....SA..TL:U.%[t...rI...a(...g..E].J...u..L.......w...6..q.A.......X.z...G....Ax...+)......7..]5.^.u.....y..mv.w...L...`1.'\t.@'.. ...IfPJ].....x.+....B.B.d\|. .&......3Fu.Q5.U.u..].Y..`'...ej..S9X....V.+.B.&.^:.............P.I~+L....H..g>.I_o..yG^.m..N.._..&...a...N.........op..%q..T..[.,{gm...U`:..<]./....a=..;..2.....C3"T.B6.5.J.....Y.O.B.....mHQaA......T./(S.wAQ..5'....8.......(..>.7.x(w..c.....T...,....H..@!....R..qt....b..........."..u.........TQ...?.N.Y...(...&.-.9F`..S+.WA%x6E...X...H.u.....]....Z.{s1x.I(.C..v~2...\..r.6g....X....U.Sx.fx.......P.9.. ..8.O........T71...X..0.<...[9.x...9.....\..M.T6..2v..-j...D...X.je.0........z}D.c\..m...9 -....h.t..#>.m.T.....0..HP.U%..W..>..h...)(.V<..n.}..l.V;...._.X*...A..&.P.v..M.nQi+!0;...ZA.....?...@..S..Z..D=....)JQk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\btn_submit[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 97 x 41, 8-bit/color RGB, non-interlaced
Category:	dropped
Size (bytes):	6296
Entropy (8bit):	7.911402859709664
Encrypted:	false
SSDEEP:	192:lSgc1hb6UYqHWDHRwAZOZel8Pbz/sEWdTt:En1l69NpUI8MvdTt
MD5:	029486EF299D23C45ABEE3868547CC47
SHA1:	DC7F311D1E7D7B015CFD2DFDB6CDCB3029F4E889
SHA-256:	0B10532D8E64178F5424142460C37700026761C143593CF208537BF5724D6DCD
SHA-512:	98B805C73C60A40ECFB5F7AA8494B4BB159CB1CD3249F1F1F9FC5712C0C5FB33B03AD9B7042CC02A2EA33DFD498AC97B18B72E6FCDA08B6D497433C9DE253159
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...a...)......o......pHYs.................gAMA....\|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx.b...;..................Hg.t'..............@p9..9T....z....A..> ..@,.Q..0.6.a..5...... ...>...RA..A.K;3..g.#>...... (.^.....C.i...yGf...Z(V.{}.r.nw`.9..:...T.@...$#.Lbl....s.A.}."/T!..../....J.;vf......4.I.....l............W[#..$...@9.. ..P4i..../..v5..... L.I....sa.M(?.}.;....&..6....,...K..I..%{l..)x........y[...lw../...e.....vRa.j.O.".."~.Jm.K..Q[..-..3&.$.:\..<..U...>!.U...N.8..@.@..$J.......).h.R.A...&.....4..y.'\.R.X.7Y.}...3%..l&.F...dP...n...e....q%.H..W.M"....G...&.....Cs.G.Uj0..cG.7..5Z.)g:_.z.....<....2.A(.ah.Z}N.............i.v...FUU.;.9.dTk......%....rDs...T.............YW..4..?g..bl.?..._ad....s....Ac.......w.}.zy..".nx......,...#.)e..@...Iz....o.^.Gx.".I&k.L@.B.!..T...<.P...........UVY.Zwsj.../.G.}.p..y.S..F.\|/..].....M....4.'...%.....6r...q.<-....On%[..Y.#.SV.k..G.V. .B...mE.Y...7.38.0# ..x.w$,H........R....*BM..c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\chat_loader[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	14347
Entropy (8bit):	5.2621498296635485
Encrypted:	false
SSDEEP:	192:Klpzl8yEH3KxDQBHLMNxIpkLnRXImYFyEH3K1DQBHLQ/w7:8GZUDQQLR92Z8DQq/w7
MD5:	E5DE6FC48B81160118FEA3D311421FEC
SHA1:	EB29CD7AE75BB27B5E8D05FCD4086C64D099F6E0
SHA-256:	0CFC27A40ADA2E02F763BF218332F8C406B70B2E6125EF45BE27694C597F86D8
SHA-512:	8D9DA376C264823363542CBEE057D9B675A86C5C6B392A0B3ECBD132DCCE8D1F8E41DA75594959DD5905DFDF520515E98925A489D1D4E559A21654292DF35A1F
Malicious:	false
Reputation:	low
IE Cache URL:	https://j2global.secure.force.com/chat/resource/chat_loader
Preview:	function loadjscssfile(filename, filetype){. if (filetype=="js"){ //if filename is a external JavaScript file. var fileref=document.createElement('script'). fileref.setAttribute("type","text/javascript"). fileref.setAttribute("src", filename). }. else if (filetype=="css"){ //if filename is an external CSS file. var fileref=document.createElement("link"). fileref.setAttribute("rel", "stylesheet"). fileref.setAttribute("type", "text/css"). fileref.setAttribute("href", filename). }. if (typeof fileref!="undefined"). document.getElementsByTagName("head")[0].appendChild(fileref).}.....function loadChat(orgURL, siteURL, orgID, eswLabel, contentURL, deploymentID, buttonID, liveAgentURL, eswID){....loadjscssfile(siteURL + '/resource/chat_resources/css/chat_styles.css?t='+Date.now(), "css");...// PROD Chat endpoint switcher..if (contentURL == 'https://c.la4-c1-phx.salesforceliveagent.com/content'){.. contentURL = "https:/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\commonJqueryScripts[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40401
Entropy (8bit):	5.069496480991601
Encrypted:	false
SSDEEP:	384:Gvitc28tP2C4ZZ8eQnAo7pxBnm/vZw5mTUpZBDKDhDQCRAZ57+OzpF/VrgW14kTY:nctUGDntDgif9zqRNl4k
MD5:	CFB5932B01779AA7972F0D1D962B8C89
SHA1:	7A0AFAFC40122C2741952E02D9EDC77315E31B62
SHA-256:	87F8F15FD3D6ABFCF7A2E5A5D37431E1188A14AA837B67DE1C7EAB4EACC8E668
SHA-512:	DBA353A5EC070F8A03CE455CE2CF7BBCAEE5AD28E30A224AB3FB89585FBDCBB9D474683F962CE4F731E2FC60E2A43933BE15269146EB6CB54C58045BB9F1B06C
Malicious:	false
Reputation:	low
Preview:	var timer, countdown, idle = 0, finalCount = 120;..../*****************************************************************************.. DOM Ready .. ******************************************************************************/..$(document).ready(function(){.....//Default formfield text...$("input.defaultText").focus(function(){....if($(this).val() == $(this)[0].title){.....$(this).removeClass("defaultTextActive");........$(this).val("");....}...});...... var $selectDefaultText = $("select.defaultText");......$.each($selectDefaultText, function(){....if ($(this).val() == ""){.. .$(this).addClass("defaultTextActive");.. }...});.... $selectDefaultText.change(function(){....if($(this).val() == ""){.....$(this).addClass("defaultTextActive");....} else.....$(this).removeClass("defaultTextActive");...});..... .. $(".defaultText").blur();.. $("#suggestionsForm input, button, #content-sendReports input, button ,#content-recieveReports input, button").blur(function(){..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\cost_saving_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	24352
Entropy (8bit):	7.370366389630155
Encrypted:	false
SSDEEP:	384:lZ4c5AXpkQBhaA3Ky11T2C8qmKilSpFKIsfbbJSXJ3pH7Ek6AVy22CONdFTRoWH8:lv5geI5FYbKilSDCJkEkly2xadFt8
MD5:	9C5D254F2529DA69CF08329B05360DAE
SHA1:	06F04DC0FB8AC43C02B7F64A159D30429B9EF072
SHA-256:	1669B4DD19FDECF0749A212FACE20B6B13331FB9B70B4060A3DBFC02CF66E1EC
SHA-512:	217831D20F476CFD48970F8DEBE57A56112618D8063A1ABCBC884704B59F9ADC5920E2C30F4894DFE3A0AC3A0B160E5F09B232357B9D47619B3EBEF5FF607937
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/cost_saving_1024.png?sfvrsn=9d890b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:B00C3718F9D811E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:B00C3719F9D811E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B00C3716F9D811E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:B00C3717F9D811E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..S...[.IDATx.....$U.8..f.....C.AD...H.#..*..UA.F...Vw]Q.qA.....p..+JF.$...8.y.s.z.s..B.......w{f..>U.....[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\externalJS[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	51982
Entropy (8bit):	5.409987328400261
Encrypted:	false
SSDEEP:	768:aLaCHetODy9Jn/C/0Rox4RoMqGZXOISvC2UxHS/iCEm3TWJt6:aL1eEDy3/ACrq47S2xHSKPm3T9
MD5:	A97B39DC084F579458A444F221407924
SHA1:	D1161AE40755BB1B73B93DE8C4474F5AF86E97F9
SHA-256:	82859377DE82ECFD4A141586F9DC3E9E101C0A5E816C973EFB9FE5211B4FDDFE
SHA-512:	4FDED73DBE305BBC2D6025997EA314F1A5CBC0884B4F830059A5502B7C9E67DF28EEFA476C15A34E085B8C68164214CAB545D5BEE5910DEB7A36F617EE556047
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/externalJS?v=ABB7W2qnP0Yk4Jv7Awq9abZ7dh9apXGEMZNTYR3ExrM1
Preview:	var RightNow=function(){if(typeof RightNow!="undefined"&&(n=RightNow),typeof n=="undefined"\|\|!n)var n={};return n.namespace=function(){for(var f=arguments,i=null,t,r,u=0;u<f.length;u=u+1)for(r=(""+f[u]).split("."),i=n,t=r[0]=="YAHOO"?1:0;t<r.length;t=t+1)i[r[t]]=i[r[t]]\|\|{},i=i[r[t]];return i},n.log=function(t,i,r){var u=n.widget.Logger;return u&&u.log?u.log(t,i,r):!1},n.register=function(t,i,r){var s=n.env.modules,u,e,o,h,f;for(s[t]\|\|(s[t]={versions:[],builds:[]}),u=s[t],e=r.version,o=r.build,h=n.env.listeners,u.name=t,u.version=e,u.build=o,u.versions.push(e),u.builds.push(o),u.mainClass=i,f=0;f<h.length;f=f+1)h[f](u);i?(i.VERSION=e,i.BUILD=o):n.log("mainClass is undefined for module "+t,"warn")},n.env=n.env\|\|{modules:[],listeners:[]},n.env.getVersion=function(t){return n.env.modules[t]\|\|null},n.env.ua=function(){var t={ie:0,opera:0,gecko:0,webkit:0,mobile:null,air:0,caja:0},i=navigator.userAgent,n;return/KHTML/.test(i)&&(t.webkit=1),n=i.match(/AppleWebKit\/([^\s]*)/),n&&n[1]&&(t.webk

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	31122
Entropy (8bit):	5.5103224341210275
Encrypted:	false
SSDEEP:	384:hyxoC2aCBbqG2Y2vaMPaoEU3xc1kbtOftdBTjBtw7ag/P3TsyF/3e5NmKp3X:hqonnMLR3xc1kpOfivpOj
MD5:	FAFCD0AAAE21CA46E7EBFABEAED350E5
SHA1:	664B79F4DC8E7AFD4880DC0F3A0C9148B076CFF2
SHA-256:	34FCAE3CF94E02D46C230A5B7DD3827D612587164E048DCFE146518DA1CB4AB0
SHA-512:	156BFB27EB7EE42F63300918DE4E5BF89D105E6B312AC6C4C2FD6E7A97AE4E851FB85460018F64E707E229769B14A420912851238887F6C448C60E5192839EE9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googleadservices.com/pagead/conversion_async.js
Preview:	(function(){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this),da="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),p={},t={};function u(a,b){var c=t[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]} .function w(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in p?f=p:f=ca;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=da&&"es6"===c?f[d]:null;b=b(c);nu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	142
Entropy (8bit):	4.806337346840785
Encrypted:	false
SSDEEP:	3:8ROFKGQIeNi1Xbvx9M84JxeCAIuREg7F6nmqDmJS4vSWFq:AYSI0MXLxu2CAIuh7FUKc4qR
MD5:	B612BD64DC0A3124758B6D3E37AB3CB8
SHA1:	C18D6B75940A83D338584415B5E5316D3AC1D8D7
SHA-256:	ADC9DDB4801676CE159D8A84206CDABAE478920307D38F7D08D4C7F0CAC44980
SHA-512:	0227D89E49DCFA6111C2818999DE347BB44CBF5E001A31C73F42E52910E56E0B0E013AE04177C5BB960CF3B93D57CE118A86787DEAABBCD9033DEC83E18AF455
Malicious:	false
Reputation:	low
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="http://www.efax.ch/">here</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors
Category:	downloaded
Size (bytes):	350
Entropy (8bit):	3.0521330216728093
Encrypted:	false
SSDEEP:	3:PFErXllvlNl/AXll15QwauRe9Nu/P24Ttap4h/lleOL8lOzF476Ga2oko/yfllrt:kEXY9Yn2etam/WOIAm760oGNf
MD5:	AF67478FF3A7A193BA046C341D9429FD
SHA1:	34B0691754B0BFBACB9E0EF79E00713393C384A5
SHA-256:	97B0CB14619F4A00C0EADFD1F665D4D08F53FF723BAEF4B4427ED2092ED0E580
SHA-512:	6D1E13D018425706E857A79551D14FF336A26978FF9F70570FA1CABC8CE5813F8B91442EB713C7FF324006ACE9395E0B95DE26E8ECAEF125DB4DD29570F00F90
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/favicon.ico
Preview:	..............(.......(....... ...........................................................{{..cc..RR..99..))..........................\...............Dfe....=..f....M.U.m..}]..l..........`..mb]]m..]...l.....V.<....,.em.....\|.........C-................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fax-by-mail-three[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 298 x 183, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11067
Entropy (8bit):	7.948608398892242
Encrypted:	false
SSDEEP:	192:gYShILho/8Be/liEIORvqQlrzAXOcWauRtnw6QjGtNtBVslOZt04E:g/I1o/ke/IEvRvjYKaEw6QKHtAlOM
MD5:	6CFE1393DA08EFB107E31B8292421009
SHA1:	0740245E0D0553E11F22265A634E2B98DF9A6815
SHA-256:	7C7B21DCE7D166CCEE4018B0659299C555E3CF3C0BA367D96AB06FA4D81B189E
SHA-512:	6644AA646B6A1C3376441A348E9EB8B948B03676F362D20FAD9ED70C909D6C2D193AA794431D1A790F05FB53F63686F909493E81E6FB4224A8DCBD4B7BBE6913
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/fax-by-mail-three.png?sfvrsn=e1e380b5_2
Preview:	.PNG........IHDR...*.................tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:4614C85F066C11E4B7D5D0957E4ACFB9" xmpMM:DocumentID="xmp.did:4614C860066C11E4B7D5D0957E4ACFB9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4614C85D066C11E4B7D5D0957E4ACFB9" stRef:documentID="xmp.did:4614C85E066C11E4B7D5D0957E4ACFB9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>WR...'.IDATx..{..g..K...=.;.8K.......O8.h....T....511...Dc.....@...a"kb...hRl./l.MJ.... ....V..ki...3..;.9;sf....&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fax_by_email_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	36533
Entropy (8bit):	7.705207100843213
Encrypted:	false
SSDEEP:	768:vHwZbXh3y26jr61xJCJtcMPYK+dAgkZv3HxUNOPPJ:fw1x38mnCHVYKhg23HCNO3J
MD5:	D896B6866E7325F697FFE9E536C2F4E8
SHA1:	BA42BCB6E82C43602A0DC2F1C77F1C8DF28F35F8
SHA-256:	FEBC588A04B80C39A0DA3DCC075667C5D037AC3AAE2D7FB93DD068E128AA32AB
SHA-512:	A7E0C41DBCB0F2B5872209622CEB7EE5AD03BA6A2FA40385FD27953CBAE7A6F489D687A59354B0F8DB0F939A7F0464181D85403E39351C25BAB871C4AE76307C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/fax_by_email_1024.png?sfvrsn=f4d990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:1EAAB14CF9D911E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:1EAAB14DF9D911E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:1EAAB14AF9D911E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:1EAAB14BF9D911E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.8.....#IDATx......U.0...B..4E..\...CD@.AD]...*h,(....(.C.&(..E.."... ..0....Z.....i......+o.9s...\...b.w.9..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\font-awesome.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	17783
Entropy (8bit):	4.820670463881477
Encrypted:	false
SSDEEP:	192:A1kM2vI+abLedrK/TUKIErArK82ZJVrt3ee+cR6waWf:O++yW/TUK1+K86J5he2UWf
MD5:	9C3373F8530AD9831DBC2FEC65933314
SHA1:	C1127272E7905EB68956C5F85423B7C077B3CAEE
SHA-256:	F96C8AA5EADBF98B155A0627034B14B6FDCED2431DCD5E383EB957E42B7B9D9E
SHA-512:	333EF9BEDDB9CE95D1CFA612F75C0E4105DA2CB3BB2B0DA8587F28AAFF661E6DEA53776D4820CD9648E9A2AFB105BF095A9BA8995C454C77827B3E990E6E6141
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Async/libs/font-awesome/css/font-awesome.min.css
Preview:	/!.. Font Awesome 4.0.3 by @davegandy - http://fontawesome.io - @fontawesome.. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License).. */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.0.3');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.0.3') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff?v=4.0.3') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.0.3') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.0.3#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font-family:FontAwesome;font-style:normal;font-weight:normal;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.3333333333333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.2857142857142858em;text-align:center}.fa-ul{padding-left:0;marg

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\formValidateUtil[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	66292
Entropy (8bit):	4.647274014935184
Encrypted:	false
SSDEEP:	768:2FKkS1LNyMLWVSVpbpqRpAaUbAvHFKkS1LNyMLWVSVpbpqRpAaUbAv+:zkSdRhVpbpqRpT4kSdRhVpbpqRpT+
MD5:	F05DC63812A6FEB262AAD779531C7254
SHA1:	283C293F5C298268B01B089A0D996F8F7425B515
SHA-256:	292D289B5281DF6E5302ED1878F0CE582808107BA6C2ABAF79A39E344375D819
SHA-512:	B72D64C906AA93A1709B6648325EFC6F9946BE6D51C71770B0FACE4CEF5B87875B5743221DBAC7CCF3A4FBC76B57E857E79C22356761F6CDFD1855D972981049
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/js/formValidateUtil.js
Preview:	//console.log("formValidateUtil.js");..var ERROR_MESSAGE_ATTRIBUTE = "errMsg";.var ERROR_DIV_ID = "myErrorDivShimId";.var TOOL_TIP_TEXT_ID = "tool-tip-text";.var TOOL_TIP_ERROR_ID = "tool-tip-error";.var INVALID_CLASS = "invalid";.var ERROR_ICON_SUFFIX = "_errIcon";.var ERROR_MESSAGES_SUFFIX = "_errorMessages";.var RequiredErrorMessage = "This Field is Required";.var RequiredFieldMessage = "Field is required";.var EmailErrorMessage = "Invalid Email Format";.var COUNTRIES_WITH_ZIPS = [ 'AU', 'FR', 'DE', 'IT', 'ES', 'NL', 'BE', 'CH',. 'AT', 'BR', 'FI', 'DK', 'SE', 'NO', 'PT', 'KR', 'JP', 'LU', 'MX', 'CA',. 'US', 'UK' ];.var FLAG = 0;.var CORPORATE_BRANDNAME = "CORPORATE";.var profileEmailFormId = "form_profileEmail";..$.ajaxSetup({. error : function(jqXHR) {. handleAjaxError(jqXHR). }.});.if (typeof Ext != 'undefined' && typeof Ext.Ajax != 'undefined') {. Ext.Ajax.on('requestexception', function(conn, response, options) {. handleAjaxError(response).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	165418
Entropy (8bit):	5.55431746118323
Encrypted:	false
SSDEEP:	1536:yAk08bniYEgpP3r6FytG39j6oM2TUSafZYQiRnhXaXrTXOOVX+HYEG0oI6vDGZ7z:yG39zSrTXtVOHO0qo7htdcuTps0mjwM+
MD5:	537B7E24B4507C41A037866563BF0521
SHA1:	160AE2CCDB832C5F9180FEFF6CAB4F7D857E59A0
SHA-256:	E91E98EFF62D1CD0BF9C3A76E99CCC6DF7E624451EDA4C7661ED7B333F1F8B77
SHA-512:	9E01285278F6ECEED4BD88FE522A1F392ADB7FD4A3ED977AFB196AFC36C3D37B6648896607F0BEBD4E4D681702631DE8B7B33F9FFC7F8D8AFC74D6A4F354F1AA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-TDZK
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"420",. . "macros":[{. "function":"__u",. "vtp_component":"HOST",. "vtp_stripWww":false,. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__u",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__u",. "vtp_component":"PATH",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__e". },{. "function":"__v",. "vtp_name":"transactionTotal",. "vtp_dataLayerVersion":1. },{. "function":"__u",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__jsm",. "vtp_javascript":["template","(function(){var a=\/O

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\how-it-works[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67049
Entropy (8bit):	5.410452292371589
Encrypted:	false
SSDEEP:	1536:WEL28VNs46bsu/eusrQZzymWrjxNtY38tJ:xVNs46bHJsk+Z4stJ
MD5:	6DF426649AF0FACFB5EEC762AB38AF34
SHA1:	3C86556D4477E38A37C6C91C8238C3812AD22087
SHA-256:	3C31546B8733F7CBD317BB1E78798FC4588DE2EDF8FB312D01FDDB22452851F0
SHA-512:	360ADC18BA68F7549D2779CACBC20CBC0F71FC405E9960863B99CC64D44C9AE3B5A959C2C4FD1ACD7DBD16025A65C6DEB6A7F623F3B2CA8F4254FD04215520EF
Malicious:	false
Reputation:	low
Preview:	....<!DOCTYPE HTML>..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<html>.. [if IE 6]> <html class="ie6"> <![endif]-->.. [if IE 7]> <html class="ie7"> <![endif]-->.. [if IE 8]> <html class="ie8"> <![endif]-->.. [if IE 9]> <html class="ie9"> <![endif]-->..<head id="head1">.. <script>.... //Start Visual Website Optimizer Asynchronous Code .. var _vwo_code = (function () {.. var account_id = 232379,.. settings_tolerance = 2000,.. library_tolerance = 2500,.. use_existing_jquery = false,.. /* DO NOT EDIT BELOW THIS LINE */.. f = false, d = document; return { use_existing_jquery: function () { return use_existing_jquery; }, library_tolerance: function () { return library_tolerance; }, finish: function () { if (!f) { f = true; var a = d.getElementById('_vis_opt_path_hides'); if (a) a.parentNode.removeChild(a); } }, finished: function () { return f; }, load: function (a) { var b = d.createEl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Reputation:	low
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-no-hardware[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	750
Entropy (8bit):	7.57562897787622
Encrypted:	false
SSDEEP:	12:6v/7ElW8YE2nmC6nkiJ3JSA8lXKSBzj5t0u4RED7SeSqV7uHjrOqj3W4vNk+VmuC:FYjhsfl1WoukED7tVV7uHjrOn4vNk+nC
MD5:	C02F271A8C2886D5F71F38220A9CB8B3
SHA1:	01BF7391DC44F5B145F3E89E7DFC347AA69ED6DD
SHA-256:	D2EF700D2585DC2EFE3A6F776FDE5F50C4CDC942561A30F0DD0D2E7408063893
SHA-512:	4E4AFCF75C74BE598070BD43EDDF655375024915DB28243A69BDF69F1571E2573D61990CFC8BBE12B216725EC90A596FE7FAB5373144967F830DB0443650B723
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/rebuild/icons/icon-no-hardware.png?sfvrsn=0
Preview:	.PNG........IHDR...................iPLTE...ggg.....zzz......kkkZZZ...................iii....>>>...hhh===...333HHH......fff```ccc......___666......@IDATx...Mw.0........v..i...d7.H.7.uf...X...G8..,.,.,.j...>.....XD].:]u..z5...]7.9M._..F.5...E...A...t%......NWr:]A...t%......NWr:]...6.v.......<cG..b.qK..J.'dq........\i.l..jB>._1!.+...Y].yB^.o...c...4!..7L(...N(.pB......r......P..O8._...G?.\|t.].\|~_{{.a.s....k....PO.FZ.....pE.rQ..W.D...s%.J....&p. ...d...%+....6.r..+......$\.%..,..f..0...PR..........kyE.0..\|..,...;..r......\..0"......Xl.u,...Q.5 ..+f..q..X... ..K.Y......~}.,..f..0K..Y....&R...kv.z.....@..W......s.........Rt....c..\.w..C.x/.%.~...e.s......T...J.SW}z..s.eY.eY...x....L......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-no-maintenance[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 150 x 150, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	903
Entropy (8bit):	7.546777485894472
Encrypted:	false
SSDEEP:	24:jBnGRg3B4idWgLJkZcgh1DLLmDcybkxFds45NC:2yBQRhRLkYFGD
MD5:	AD9EFFE38D6F5E09A412F79BEF4D0ED8
SHA1:	73284ED9B0FB27CAF920A03D82814A5D7E65EF8D
SHA-256:	82E472CFA8F3920D726BB3B49F8089BEC984571A7ADFA8A6669F6B80B22F514E
SHA-512:	2855EE9205241DAD08B91359458D009A99ACDC36485CDF4111EE17A708A15788C4CB544BEF383EECC66EDF2F8A4FF5A689FF37A3BAE325B14F2041E747590877
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/rebuild/icons/icon-no-maintenance.png?sfvrsn=0
Preview:	.PNG........IHDR...................iPLTE......zzz...kkk333...HHH...........ZZZ.......fff.........ccc...iiiggg___hhh===>>>......```.......666_......IDATx^....0...a/.^..!.....R.R..U.~.`.....$.y..h4..F.....r.f9.i.)..J....f.:...[.$.......~.=KWf...HS.C..A:.......\.W.[6..>WI......U:.{........Bs..\|8..e....u]&.....,/...........E......p.}XUD.U..........\.U.f..k...2\..L'..>..\.p...\.O.p\...$.....`6.\..........f'<W.wea..N...f.......... X.....9].;.+.9]........xR..+.....9]Ux....".]U@..e..%..i...B.k...u..........T.ms.]..7W......e.(.:]s..U.+.QQ..........V.^..P...@:.........8.........8.........8.".B..\.U......H..].C..4.........8..........e.t..1fJH..2.w...T.......J.....y.mW...@...u.ZrM.J.U.6......\.Z.J..\.2...+n..v.mW..Y#".CU..y..f...w-.GgMW....Y.E..2........e.........mo....q=..u.@...x.I.)...."..\|E....O/.-.....gF..h4..~.._}U..A=....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-no-paper-jams[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 150 x 150, 8-bit grayscale, non-interlaced
Category:	downloaded
Size (bytes):	1459
Entropy (8bit):	7.672334624749295
Encrypted:	false
SSDEEP:	24:z3LozZ4C2zN0RvX6+Isde1cxKfj6bbOtKb9Hyb6WG+Cptqz8Ro+J8b1VnZp/ITPW:zkozNKvX8OKfMbOtUpw9WtqzA2b3X/IC
MD5:	1BB51B5EADDB95881E0EBDE6F5472165
SHA1:	41F222F74B1C04B26DCBD48A7379546411E9F062
SHA-256:	188B5BCC8CC16CD8CFFC56555B56152BB6520AEFA0E8AAC42D2E969A132CEDA4
SHA-512:	0A0A13E7EF7128944A2983F14ECC397F94C84626FF80B0B04EBD4BCE1D1781EC568C07851B643E9064EA4040ED5698058F62BC4F0EFC391794F406261BA65BC2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/rebuild/icons/icon-no-paper-jams.png?sfvrsn=0
Preview:	.PNG........IHDR..............j.>...zIDATx....w$.......t.v.m.m.m..L....{.y.x..g.>..R..~]...'..\|...Y>.g.,...a..=K.Z...K...&.h.}.....]K]VX.k....E..ZF.I..k....r`5.P..t9..e..x..K].f....cV\|9...R.)Kbi...p).p.,u.,..e..e......e..,.,K.eq.eYr).s).KY.KY.\..\..R..R...Y..Y..e..eq.....e.R..R...Y.bY..e..e......e.Z'........2w]......X.1...i...+X.. X...g.......&.R[.....e...x.]....]vY....w.e.q...Y....x.}....]vY....w.e...,.e...x.]....].X.\4.)l.hVk.t.F..bY...bY..`....T...bY....-.\|y...]....!)G._x...5.Z.b..s..O....ze...f...$...(.+..u.dI.8..sw....vm..<...eY.......].-F.$aY2..j..c..`D\#..T...,...Q.D.41a.(d.S.X2.6\=....\.....k..."..fk....o.J."..(".....Y{.1..s...... ..U%....#Vm..}.....D..k....`..\|.f..k<.j.{.G4+........\|....u.g-....".\.guB>..u..0....n....N......5`....M........,....}.....~.a.j.1.\|6}.. .. Y.#OS...?.b..g.Tu}.......=H..<K.....u,...D.xVV..R.."".B.<4S......;zw.... r...2ge}.A..;....>........2g.j\|....d.a.....-.r..2..C.r....+..[...........~......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/info_48.png
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\j2GlobalLogo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 32, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	1488
Entropy (8bit):	7.46543800538508
Encrypted:	false
SSDEEP:	24:d/6OG4cm19RsJNTuy/7qTL2CxHP6nLYZ2SedtxSfAnfRglw2D7Jnt8LQz:d/6e9RsJduaQL2CRCnLYwldtQonG7Jtn
MD5:	F25E92E5754BD97394D2C278A469B099
SHA1:	9A9CB419211BCC769A1A15B42A404F89146A5E33
SHA-256:	A48397968CA9521EF5BFFDFB4BDC07F65B0D3B62276F3B82B250BFA5788708A1
SHA-512:	D2B7B2E6722B2B39BF71A7105B5C48A1D599A8BEF313758EA379D7CD4FE22653980BC43DA0AC7F6E29112C49A9D92074E254E825BF0593F7B79C15C58944D9D8
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR....... .............pHYs.................gAMA....\|.Q.... cHRM..z%..............u0...`..:....o._.F...FIDATx.b...?Cvv...(............0.._.t)#@.........X.d..F.B.^ ......gw.....H....N....@..lfbbb`cc....Ar...M..?..;.....0....AEE.AGG.l.H.o.........0........0....1.[.n1.}...S.!!!`.YXX......r....R..A...tpp`8r....'..Y.........V..@(^..0q.D...J..W3l..,....p.B...O3\.t.AKK.,..@L..$%%.......3.m..mnmm..d...&&&.....E%@.1!..'O.v.........~...R..;w.-....kPPP...,.......~..G..k@..:u.....v.W.....^....D.!...>}b.....A^.x."8.............bAN, .........R............Ar....b.\.....q===.###..`....(m..........H#L......r..pXb..$L..7o.b........\|..W.c#..-g.h..b.e.....0....git1..F5#@....S@...?.@.._...4...7#"..Cdb..bH.#X........I...........~......f.%.......F.b.+.#.'+3.#P.....~.._.O.......L..>0..?....!....30..0...g.............~......@L...fg.....'&2....>..00.S"Gj....1....8X...X....]..@..).(..{....@.A.......\|....._.jAn..KW... ..Q.. .X.".`.....N..N..d.<...E.......k.Mg0.:.....c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-1.7.2.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	94840
Entropy (8bit):	5.372946098601679
Encrypted:	false
SSDEEP:	1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW
MD5:	B8D64D0BC142B3F670CC0611B0AEBCAE
SHA1:	ABCD2BA13348F178B17141B445BC99F1917D47AF
SHA-256:	47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
SHA-512:	A684ABBE37E8047C55C394366B012CC9AE5D682D29D340BC48A37BE1A549AECED72DE6408BEDFED776A14611E6F3374015B236FBF49422B2982EF18125FF47DC
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.7.2 jquery.com \| jquery.org/license /.(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView\|\|a.parentWindow:!1}function cu(a){if(!cj[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"\|\|e===""){ck\|\|(ck=c.createElement("iframe"),ck.frameBorder=ck.width=ck.height=0),b.appendChild(ck);if(!cl\|\|!ck.createElement)cl=(ck.contentWindow\|\|ck.contentDocument).document,cl.write((f.support.boxModel?"<!doctype html>":"")+"<html><body>"),cl.close();d=cl.createElement(a),cl.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ck)}cj[a]=e}return cj[a]}function ct(a,b){var c={};f.each(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}function cs(){cq=b}function cr(){setTimeout(cs,0);return cq=f.now()}function ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function cb(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTyp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-3.5.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.5.1.min.js
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery-ui-1.8.16.custom.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	421202
Entropy (8bit):	5.2702270046406685
Encrypted:	false
SSDEEP:	3072:y7Cj/TXYrhZHFdW8uIdkz6AUAsaS02U7Cj/TXYrhZHFdW8uIdkz6AUAsaS02Z:eCj/zYr/xGCj/zYr/xP
MD5:	82950B4FBB1D2AF833154AFBC84C1B75
SHA1:	3BEE25EE49D452B6D909DCCAD729AF87C86720EA
SHA-256:	5678F49733C0CB02DD31AFD520C6018215A53ECACC5DA0AD04A343FE3CE6C998
SHA-512:	87DB4508AD228E26714B9C61B3E004AB66557C3688FCE51A01CD36BA1BE881F69A8C20E9955CEDD84B0F6AC7E2EFB08B227CD0D8B56711223724ABDF901958F5
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/js/jquery-ui-1.8.16.custom.min.js
Preview:	//if (console && console.log) console.log("--- jquery-ui-1.8.16.custom.min.js ---");./!. jQuery UI 1.8.16. . Copyright 2011, AUTHORS.txt (http://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * http://jquery.org/license. . http://docs.jquery.com/UI. */.(function(c,j){function k(a,b){var d=a.nodeName.toLowerCase();if("area"===d){b=a.parentNode;d=b.name;if(!a.href\|\|!d\|\|b.nodeName.toLowerCase()!=="map")return false;a=c("img[usemap=#"+d+"]")[0];return!!a&&l(a)}return(/input\|select\|textarea\|button\|object/.test(d)?!a.disabled:"a"==d?a.href\|\|b:b)&&l(a)}function l(a){return!c(a).parents().andSelf().filter(function(){return c.curCSS(this,"visibility")==="hidden"\|\|c.expr.filters.hidden(this)}).length}c.ui=c.ui\|\|{};if(!c.ui.version){c.extend(c.ui,{version:"1.8.16",.keyCode:{ALT:18,BACKSPACE:8,CAPS_LOCK:20,COMMA:188,COMMAND:91,COMMAND_LEFT:91,COMMAND_RIGHT:93,CONTROL:17,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,INSERT:45,LEFT:37,MENU:93,NUMPAD_ADD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ktag[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	12096
Entropy (8bit):	5.508912593183126
Encrypted:	false
SSDEEP:	192:VBb/rD8e81I4c9JAer6AkNnSbToc3fqFhHr51FvH/lGPMfuu6FHtl/sfcZd90Uby:THA5ASITZ3qFPtdepFHt1sfcZd90UbAZ
MD5:	3B1E989E74E2BC698C1684C02FB47629
SHA1:	2EDD4D2E46A7D0BC0062079E00E7D37696973744
SHA-256:	79F98A46ADFECDFD23CBD4CD6AD3938EDF85B30CB401B2BAA195ED314D713DDA
SHA-512:	31771A708EA7D4CF3F7DDAE61569740D04AD0C6C0C617B2879D41F6F64BA461523D63F9D1C77D2B688310F9BB1534050B6CEC49EAC47C349A082C765917B97F6
Malicious:	false
Reputation:	low
IE Cache URL:	https://resources.xg4ken.com/js/v2/ktag.js?tid=KT-N3F04-3EB
Preview:	/* ktag.js - 2021-01-21 */.var Ktag_Constants=function(){return{KENSHOO_GCLID_NAME:"ken_gclid",GOOGLE_CLICK_ID_PARAM_NAME:"gclid",BING_CLICK_ID_PARAM_NAME:"msclkid",DOMAIN_DEVICE_ID_COOKIE_NAME:"ken_xd",NO_PUBLISHER_CLICK_ID_PARAM_NAME:"npclid",AMP_CHANNEL_CLICK_ID_COOKIE_NAME:"ken_amp_gclid",AMP_LINKER_PARAM_NAME:"linker",CUSTOM_DOMAIN_TRACKING_COKIE_NAME:"ken_hgclid",UNIVERSAL_CHANNEL_PARAM_NAME:"kclid",UNIVERSAL_CHANNEL_COOKIE_NAME:"ken_uc"}}(),Ktag_Toggles=function(){return{isCrossDevice:function(){return!1},isSendCrossDeviceMatchEvent:function(){return!1},isParseAmpLinkerParameters:function(){return!1},isUseNpclid:function(){return!0},getCustomDomainTrackingDomains:function(){return""},getCustomDomainTrackingUrl:function(){return"https://kmeasure.{domain}/v1/cookie?name={name}&value={value}&max_age={max_age}"},isSupportFloodlightTag:function(){return!1},getFixelId:function(){return""},isDummyEnabled:function(){return!0},isDummyDisabled:function(){return!1},isDummyEnabledForDummyTi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\linkid[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1569
Entropy (8bit):	5.369127779967127
Encrypted:	false
SSDEEP:	48:Xpm6RFvCzWzAiWqSeTqn1PByqka1cUj54/vD978:5pfpy1Pkqka1cS52b978
MD5:	0CC3A63FE10060AF4A349E5DF666EEFE
SHA1:	3E8D3925B550345123F2CAB26568221FD4154F9C
SHA-256:	92FCA55833F48B4289AC8F1CEDD48752B580FCE4EC4B5D81670B8193D6E51B54
SHA-512:	5801C9DB98C4998480772CA5AD71F0E400C4756AE713AAB0358CA6593B3A3426499D6DEC81A768C861CBBCD8394DD8C6D647628A13F124FF3A1119F9B7793E8C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/plugins/ua/linkid.js
Preview:	(function(){var e=window,h=document,k="replace";var m=function(a,c,d,b,g){c=encodeURIComponent(c)[k](/$/g,"%28")[k](/$/g,"%29");a=a+"="+c+"; path="+(d\|\|"/")+"; ";g&&(a+="expires="+(new Date((new Date).getTime()+g)).toGMTString()+"; ");b&&"none"!=b&&(a+="domain="+b+";");b=h.cookie;h.cookie=a;return b!=h.cookie},p=function(a){var c=h.body;try{c.addEventListener?c.addEventListener("click",a,!1):c.attachEvent&&c.attachEvent("onclick",a)}catch(d){}};var q=function(a,c,d,b){this.get=function(){for(var b=void 0,c=[],d=h.cookie.split(";"),l=new RegExp("^\\s"+a+"=\\s(.?)\\s$"),f=0;f<d.length;f++){var n=d[f].match(l);n&&c.push(decodeURIComponent(n[1][k](/%28/g,"(")[k](/%29/g,")")))}for(d=0;d<c.length;d++)c[d]&&(b=c[d]);return b};this.set=function(g){return m(a,g,b,c,1E3*d)};this.remove=function(){return m(a,"",b,c,-100)}};var t=function(a,c){var d=void 0;if("function"==typeof a.get&&"function"==typeof a.set){var b=c\|\|{},g=b.hasOwnProperty("cookieName")?b.cookieName:"_gali",r=b.hasOwnProper

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\login[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67436
Entropy (8bit):	5.117108469939612
Encrypted:	false
SSDEEP:	1536:CQKRMhJz03D6gtOud9iKte6JMWTJd86Mg+kaSYHviMWorxz0+u1:CQKRM74hZ7JlT8nkaSYHviMdz8
MD5:	2B55B5EC51C007502E72C64D17FAB92A
SHA1:	17A6DF28E499F0FA263A300EBD5864BAE3910B6A
SHA-256:	3A729C6FB79158212D68000E4E420F43D514EAB95E69DD4A04CDFB24864C749A
SHA-512:	419C2F63FB275BD17228FE0C6629A5AF73614B771455DB7558E82DB376839433B4C5E0B166DDEE2135FC2B3BD5EF6C4A2C3422F022544A1726F4EB699360CF86
Malicious:	false
Reputation:	low
Preview:	. /WEB-INF/grails-app/views/layouts/efaxi_Sales.gsp --> j2_include rendered start: /html/content/layouts/efaxi_Sales.gsp --><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">....<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <title>eFax Login</title>.. <link rel="shortcut icon" href="/myaccount/images/favicon.ico" type="image/x-icon"/>.. r:require modules="efaxiSales"/ -->.. r:layoutResources/ -->.. INT-4497 -->.. <link rel="stylesheet" type="text/css" href="/myaccount/css/jquery-ui-1.8.16.custom.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/efaxi.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/cookie-banner.css"/>.<script type="text/javascript" src="/myaccount/js/jquery-1.7.2.min.js"></script>.<script type="text/javascript" src="/myaccount/js/jquery-ui-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\login[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67322
Entropy (8bit):	5.115552185661361
Encrypted:	false
SSDEEP:	1536:CQKRMhJz03D6gtOud9iKte6JMWTJdC6Mg+kaSYHviMWar0zzu1:CQKRM74hZ7JlTCnkaSYHviMmzM
MD5:	F0FF5D04CC2C12983EC0411A1CFB0B0C
SHA1:	B766E6B85D8AD04B16BC004F42F7002A5A583431
SHA-256:	1A88363DCDF267C34A15F3423C3FD11DB6FAF1151A3E18E9ABFD48C46DB25D4E
SHA-512:	DE189DAC0CBD062A17B5F0899F95A251F0D8164C0F03375AB9D9FA414A894E5AE3F6F1716DE269E3D82B0B79AD6B4379E8CCF4706667631275946CDFB0DFF811
Malicious:	false
Reputation:	low
Preview:	. /WEB-INF/grails-app/views/layouts/efaxi_Sales.gsp --> j2_include rendered start: /html/content/layouts/efaxi_Sales.gsp --><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">....<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <title>eFax Login</title>.. <link rel="shortcut icon" href="/myaccount/images/favicon.ico" type="image/x-icon"/>.. r:require modules="efaxiSales"/ -->.. r:layoutResources/ -->.. INT-4497 -->.. <link rel="stylesheet" type="text/css" href="/myaccount/css/jquery-ui-1.8.16.custom.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/efaxi.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/cookie-banner.css"/>.<script type="text/javascript" src="/myaccount/js/jquery-1.7.2.min.js"></script>.<script type="text/javascript" src="/myaccount/js/jquery-ui-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo-efax-white[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 400 x 152, 8-bit/color RGBA, interlaced
Category:	downloaded
Size (bytes):	27821
Entropy (8bit):	7.986316788805992
Encrypted:	false
SSDEEP:	768:2mteBHBOK3FGfpubNmpH8exHfjIWMSxi3ksI18QR7oDG:nteG+Gf8R4csaLI1fxoq
MD5:	77D061392A11D7F7387DB6A9F8BB0F8C
SHA1:	93B0EED5077E100DE58284DBC1321D398D048F29
SHA-256:	66655BF917205442705328F206C131B8F5CCAEF7972BB6C23E3182494EEC9674
SHA-512:	EC640C62D4E957B81BB230A3DEB5FB92162CFB1C00D9A34C203B408820B24BA55016E545A3BB79E91CE558BEB2D6CC9E18E27AD97B0A072DB887955CFA46C8FE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/default-album/logo-efax-white.png?sfvrsn=f3794b5_0
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:04F77AD4688F11E69B35A055A417EF5E" xmpMM:DocumentID="xmp.did:04F77AD5688F11E69B35A055A417EF5E"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:04F77AD2688F11E69B35A055A417EF5E" stRef:documentID="xmp.did:04F77AD3688F11E69B35A055A417EF5E"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.M.t..i.IDATx.b...?.......Z..~.:.G.9... .T.F......?3.>...0...,]..20...../daF^^...%...#d...X..z...B.C5..303c....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\meganav[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2185
Entropy (8bit):	4.654425299983378
Encrypted:	false
SSDEEP:	48:83iwHdiUiBisM3Ns/miUityE8iC3Ab85OwPtFWkK9WE:WH+fxF
MD5:	3813BC620F8C0835CF0917F0D5048AE5
SHA1:	5BAB836E7913311E1AC4F65A464F1B7F156F4E81
SHA-256:	8C4A7DE0B8986685407A9E979B1B6BCD129537AD5A0E186F577935A3832C1082
SHA-512:	0A43C6E1D21B76B527EC93D6F9FC2728E9DAF02A0663D096459E4F4D2499D1927096B7EF4BE10F47A5608C3C743396CD94404B59DA5085AB45A0B4BF2F4894DD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Scripts/MegaNav/meganav.js
Preview:	.$(document).ready(function () {.. //Mega Nav JS.. $('.slide-btn').click(function () {.. if (!$(this).hasClass('active')) {.. $(this).closest('.main-menu').find($('.mbl-dropdown')).slideToggle(400);.. $(this).find("em").toggleClass('fa-angle-up');.. $(this).find("em").toggleClass('fa-angle-down');.. } else {.. $('.main-menu .mbl-dropdown').slideUp(400);.. $('.slide-btn').find("em").addClass('fa-angle-down');.. $('.slide-btn').find("em").removeClass('fa-angle-up');.. }.. });.... $('.mobile-nav').click(function () {.. $(".meganav").toggleClass('open');.. $("body").toggleClass('hs-hide');.. });.... search();.. megaNav();.... //resize.. /* $(window).on('resize', function (e) {.. search();.. $(".mega-dropdown").find(".fa").removeClass('fa-angle-up').addClass('fa-angle-down');.. megaNav();.. .. });*/.. //Js MegaNav End..}); //closes

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\pricing[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	75497
Entropy (8bit):	5.391719693061924
Encrypted:	false
SSDEEP:	768:WEL+UFSFy6F1dKwPiRom19cUxuscgOpuq3PINT/odjjYONF/Y3etsDGZN:WEL+Us46bdq/3usgpuq3w6jxNtY3etJ
MD5:	A64BACED7A7E91E32CB2F1E06CFFDD8D
SHA1:	69BA8BCBF4D8717259A4C4DD0BB75ED24242A8E0
SHA-256:	CE1F8ED2C069C44CD8F06BF7F3A67DBCE2127A2FA6BDF572ADA74C0C36DE05D2
SHA-512:	43655C5B4A082770D9A849D0A3EBF8A3DECF9D2E5E983DAE36E6D4AB396875D11323A734CB06522FF3FD5570389F25502D48E6CA76F8E7D4283CB6C87876BF88
Malicious:	false
Reputation:	low
Preview:	....<!DOCTYPE HTML>..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<html>.. [if IE 6]> <html class="ie6"> <![endif]-->.. [if IE 7]> <html class="ie7"> <![endif]-->.. [if IE 8]> <html class="ie8"> <![endif]-->.. [if IE 9]> <html class="ie9"> <![endif]-->..<head id="head1">.. <script>.... //Start Visual Website Optimizer Asynchronous Code .. var _vwo_code = (function () {.. var account_id = 232379,.. settings_tolerance = 2000,.. library_tolerance = 2500,.. use_existing_jquery = false,.. /* DO NOT EDIT BELOW THIS LINE */.. f = false, d = document; return { use_existing_jquery: function () { return use_existing_jquery; }, library_tolerance: function () { return library_tolerance; }, finish: function () { if (!f) { f = true; var a = d.getElementById('_vis_opt_path_hides'); if (a) a.parentNode.removeChild(a); } }, finished: function () { return f; }, load: function (a) { var b = d.createEl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\recaptcha__en[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	338473
Entropy (8bit):	5.706186345779447
Encrypted:	false
SSDEEP:	6144:4C7/7q6TQbpMMaPOtSywsyJou8ABsuCupPLfVI2IBUFd6qf:JlECMEWSyzyJoQBIwI2IodHf
MD5:	762594F5F055A74E8BF7E9BD9ADA02CC
SHA1:	CA346E46F8EECDF6EDAB3E655858383EB83FCBC5
SHA-256:	DED038181A2E72755FC4C0D57EC9E45725629888A038328E238AB07CDB8E8E11
SHA-512:	6863E71E53C18036F43351BE7253A48E28070157B8ED07D6DE823191A501767B5B4D2913C446DF2A792B574E6ABBECB57E31CCA55556DB55536245F5740DAD84
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var G=function(){return[function(z,X,P,h,b,B,n,Y,S,F,Z,A,L,U,O,T,f,V,Q,p,v,D,m){return 1==(z>>(((z<<(m=[37,21,4],(z\|3)%11\|\|(F=["recaptcha-checkbox-spinner-overlay","recaptcha-checkbox",' tabindex="'],X=X\|\|{},v=X.attributes,L=X.Ze,Q=X.checked,Z=X.disabled,V=X.id,n=X.h6,P=X.RU,p=X.Mw,h=X.Is,b=c,B='<span class="'+e[m[0]](20,F[1])+" "+e[m[0]](36,"goog-inline-block")+(Q?" "+e[m[0]](m[1],"recaptcha-checkbox-checked"):" "+e[m[0]](36,"recaptcha-checkbox-unchecked"))+(Z?" "+e[m[0]](m[2],"recaptcha-checkbox-disabled"):."")+(L?" "+e[m[0]](65,L):"")+'" role="checkbox" aria-checked="'+(Q?"true":"false")+'"'+(p?' aria-labelledby="'+e[m[0]](5,p)+'"':"")+(V?' id="'+e[m[0]](m[1],V)+'"':"")+(Z?' aria-disabled="true" tabindex="-1"':F[2]+(h?e[m[0]](49,h):"0")+'"'),v?(x[34](33,X5,v)?U=v.DV().replace(/([^"'\s])$/,"$1 "):(Y=String(v),U=z_.test(Y)?Y:"zSoyz"),O=" "+U):O="",f=B+O+' dir="ltr">',A=A={h6:n,RU:P},T=A.RU,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\receive-online-step-2[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 313 x 302, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	12244
Entropy (8bit):	7.934578438172738
Encrypted:	false
SSDEEP:	192:91qIrR5v+HWqTgL8+oUKTAyce5qYeKS0EJE0d//XRfbvWYVbzJCNBQTMDTpEzc:917rjvrjL8aBJyCKS1h//RTDCN2kEY
MD5:	80E65B9A6DF15B7603A6BD4E5D6B3D0E
SHA1:	54E5FC4073C458C2341BE0F3001234980412C5A9
SHA-256:	5ABE223417DDFE03205285AF59024FAC06C8100638723FE8A6A6F322C6C6C26B
SHA-512:	4671A813DDBACA1DF81DBF01E28CB3DE36C4322267E0A57A2EDDFC4FBF54A73FC1227AF5333A431AE85F3240A9CC44B5270DF4CE2075CFBDDAA6ED0A1654B777
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.com/sf-images/default-source/how-it-works/receive-online-step-2.png?sfvrsn=2
Preview:	.PNG........IHDR...9..........2e... .IDATx....td.Y....p8IHN8@.!....-.$.......v.......q.{<c<c<.tOwk...%.v.v.........I..s.+I-u..8...#....*.r.W.......^=..!"..Jy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&.....<.""..'@D$.....dR....L.. ".Iy.DD2)O..H&......'.......`\.`.c0..:X.....7,r^..[[[...... ...100@D..V.&&&.................%..v.\|>..~"...V....VVV0>>....O/rZ........`<..v....F..L............$.`0.oF.L&.....{.;S....155.o.c0...JhCX..9..{.;S.1.6.e0...Zh.4.Gww.)r6..ccc....`.Y.......E..`

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\receive-online-step-3[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 800 x 304, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	52711
Entropy (8bit):	7.986414971605868
Encrypted:	false
SSDEEP:	768:Niz6FyeZ72XC8ErYVWzViRhSwuWzVoRhjRrqujhyGy4kNhQP5J+l0oEZ:Nioy8895mD5HyDu5J+l4
MD5:	302FF2357DA6F5F527133BA17FB88B67
SHA1:	463EF154FDBD013150A0F624F8ADBD7514E94212
SHA-256:	82B148DDDDE03FBC40FDEC81D331419DE6BD3B8562CE551FDC701D21E11026BF
SHA-512:	CD89FC48BD3C9C8D2F1440CD62C649566A7F150A1CD72E88A3A1D84F9CC070F613CC44E8E21A252B1A02A0C0D41451FD7FF257CA282FC86D3A59E2DDE9276D49
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/receive-online-step-3.png?sfvrsn=2
Preview:	.PNG........IHDR... ...0.....O9.....KiTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?>.<x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c138 79.159824, 2016/09/14-01:09:01 ">. <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#">. <rdf:Description rdf:about=""/>. </rdf:RDF>.</x:xmpmeta>.<?xpacket end="r"?> I.:.. .IDATx...y\.u....w...C........`7,PS+,.P.vC...m3k.......V.eji..F.J..jy....7.!.*.........3.p.....W.;....~...~.....2r.H.!..B.!.h.NU.L.6.=.!..B.!..8..G..8k....Z(<y..b.R.n....xK...&.............+./_....L.6..S..e...B.!..<.K...0 .....9.....ct.....j.......}..H].....Q./FQ\|\|+.w......A....ke.C.>.., u.Z...hp.....8.......1.....f...._O..G.9.._.9Y%.z^....--.........4..6.....x[..5..QU./.8."..B.!.h:...x\|....&...c..4.D.....9@Y......7a5:........o..@.\...@.`"}.r.........Fn..&....(..5kw....!..&..;....v....:...).-.V.....nNf.H&.e..w_.kZ.}~.a=.&.t@..B.!.h........n....vW....@....p .....:\|kn....S.g...]..\..R.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\responsive-layouts[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6830
Entropy (8bit):	4.917960668230237
Encrypted:	false
SSDEEP:	96:76Kd3m7diS8Zctwxi7LLlKoGLF/c/zM0yXnPLGcnLv:jd9i734oGL6/3yXnPLTD
MD5:	7BC21EA4E022736AFA1C35CD0F968BEC
SHA1:	13B57AF67EB219E31F5220217CCCBECE98BB21FE
SHA-256:	BF66B9DDDB165054EDC21FACD1915AED8B821F32F1164B2778F7A6FD91871F12
SHA-512:	BED8163239F1BBB9D3685D43A904FC3E8293D442C740252E2364CE5AC0C0FA369F4C75BB2478E897D71D51A366B653787FAB57962F380F1BB0F01F00A7F614D8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/responsive-layouts.css
Preview:	/-----------------------------------------------------------------------.eFax EU White Template..Project:...CREFI-1889 eFax UK - Sitefinity Migration.Version:...1.2.Primary use:..All resposnsive web pages styles.Lead Designer:..Josef Lagunas <josef.lagunas@j2.com> @ j2 Global, Inc...Table of Contents.[0] - less than 767px.[1] - more than 768px.[2] - more than 992px.[3] - more than 1200px.[4] - misc.------------------------------------------------------------------------/..../-----------------------------------------------------------------------.[0] - less than 767px.------------------------------------------------------------------------/..@media (max-width: 767px).{../* HEADER /...header..{..}........header .logo....{.....padding-bottom: 10px;.....padding-top: 10px;....}..../ MAIN CAROUSEL */...#main-carousel..{...border-top: solid 1px #e5e5e5;...margin-bottom: 40px;..}......#main-carousel .item .container...{....height: 370px;....padding-top: 20px;...}.......#main-carousel .it

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\subcookieJS[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1344
Entropy (8bit):	5.055859733991663
Encrypted:	false
SSDEEP:	24:mA+XJBUR4qzqIftUk+5u/Zw+8QNF0CZCRPn+qgvhDuphjO/bi/z+bYxTJ:J+ZaR4qzqUtUk+5u/S/QNF0ACR/+qWhK
MD5:	27B0542577F824BA1A62E38476C819FA
SHA1:	E811EE7A2EF413F091E5B78F12BAA9562670C1DB
SHA-256:	02A75EDD392CF5FE6C04EE0E5DE6ACAA071117515FCC8B6DF96D4DD0EA84E789
SHA-512:	2D817E4810400A877561330F4C2194DE311C34722B593D31F123E15AF03B23085929BDA01E70813E840C7E4227B5355319E7CFECAD0F832CAAB4FECDEBE3145D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/subcookieJS?v=Y7fhY7vFtOZ4Lh0Ae1AKRJoNPpVd-HHvfuftO-TrlS01
Preview:	var cookiejar={bake:function(n,t,i,r){var e="",u,f;return i&&(u=new Date,u.setTime(u.getTime()+18e5),e="; expires="+u.toGMTString()),f="; path=/",r&&(f="; path="+r),document.cookie=n+"="+escape(t)+e+"; samesite=strict"+f,!0},fetch:function(n){for(var t,r=n+"=",u=document.cookie.split(";"),i=0;i<u.length;i++){for(t=u[i];" "==t.charAt(0);)t=t.substring(1,t.length);if(0==t.indexOf(r))return unescape(t.substring(r.length,t.length))}return null},crumble:function(n){return cookiejar.bake(n,"",-1)}},subcookiejar={nameValueSeparator:"$$:$$",subcookieSeparator:"$$/$$",bake:function(n,t,i,r,u){var o,f,e;if(o=subcookiejar.fetch(n))for(e in o)e in t\|\|(t[e]=o[e]);f="";for(e in t)f+=e+subcookiejar.nameValueSeparator,f+=t[e],f+=subcookiejar.subcookieSeparator;return f=f.substring(0,f.length-subcookiejar.subcookieSeparator.length),cookiejar.bake(n,f,i,r,u)},fetch:function(n,t){var f=cookiejar.fetch(n),r;if(!f)return null;for(var e=f.split(subcookiejar.subcookieSeparator),i={},u=0,o=e.length;u<o;u++)r=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\v8BqByS_qI7sGpucbeDkUOLfQM2Pf2PrnXILrn-29dI[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	22198
Entropy (8bit):	5.589463746580333
Encrypted:	false
SSDEEP:	384:lcAHh2x2JaD9BvXzI2Jz1L5z7rTCVbrYi/FtuHSTHvylFleNJfbOOZHXVziPxi5P:MD9Bc2JxLlPW9rxt0yyOpVj
MD5:	E0B5E059F74BAF9531258CF4E0BDD1CA
SHA1:	B4AEFB4AADA77760BFF9A7C3EE8F1DDA56FF7E6F
SHA-256:	BFC06A0724BFA88EEC1A9B9C6DE0E450E2DF40CD8F7F63EB9D720BAE7FB6F5D2
SHA-512:	C465F8287CBF3071C54090682D7253D6E10706F959EDAEB65D9F957A38D582BA82B17828224512DC293BB936A2E5857942B0A4AEE9FDCB749DDD8395B050D36F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/js/bg/v8BqByS_qI7sGpucbeDkUOLfQM2Pf2PrnXILrn-29dI.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var U=function(m,Q){if((m=(Q=null,y).trustedTypes,!m)\|\|!m.createPolicy)return Q;try{Q=m.createPolicy("bg",{createHTML:f,createScript:f,createScriptURL:f})}catch(H){y.console&&y.console.error(H.message)}return Q},y=this\|\|self,f=function(m){return m};(0,eval)(function(m,Q){return(Q=U())&&1===m.eval(Q.createScript("1"))?function(H){return Q.createScript(H)}:function(H){return""+H}}(y)(Array(7824Math.random()\|0).join("\n")+'(function(){var x=function(m,Q){return(Q=typeof m,"object"==Q)&&null!=m\|\|"function"==Q},mg=function(m,Q){return m<Q?-1:m>Q?1:0},Qn=function(m,Q,y){if("object"==(y=typeof m,y))if(m){if(m instanceof Array)return"array";if(m instanceof Object)return y;if("[object Window]"==(Q=Object.prototype.toString.call(m),Q))return"object";if("[object Array]"==Q\|\|"number"==typeof m.length&&"undefined"!=typeof m.splice&&"undefined"!=typeof m.propertyIsEnumerable&&!m.propertyIsEnumerabl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Reputation:	low
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\KFOkCnqEu92Fr1Mu51xIIzQ[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21528, version 1.1
Category:	downloaded
Size (bytes):	21528
Entropy (8bit):	7.973887568128485
Encrypted:	false
SSDEEP:	384:uy/NCb8EbjU+Fos6gaUFZ3qR474EAqAG3w/Qpt/uxMsucMgwtDw031F:7/4zb7o6XqR4+3QptcuLg0w031F
MD5:	9680D5A0C32D2FD084E07BBC4C8B2923
SHA1:	8020B21E3DB55FF7A02100FAEBD92C2305E7156E
SHA-256:	2CFE69657C55133DAC6EA017B4452EFFF2131422ABD9E90500A072DF7CA5A9C8
SHA-512:	E19A498866F69F3D8136A65A5AB4E92CC047170673ED00B506E325165A84216267B9FEF1E5CFD66458E85ED820C12E9C345CEC9BEE4DE48E1C2E2B1A784F179F
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xIIzQ.woff
Preview:	wOFF......T.................................GDEF.......G...d....GPOS...............hGSUB............7b..OS/2.......R...`tq#gcmap...........L....cvt .......R...R..-.fpgm.......4....s...gasp...<............glyf...H..@...o..Na.hdmx..M....g........head..Mp...6...6...ehhea..M...."...$...{hmtx..M....k.....1<.loca..P8........6...maxp..R.... ... ....name..R4..........:.post..S........ .a.dprep..S$.......D..].x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x.....[....#N..m.m.m.mfm....SP..NuM..9]..=.U..!...[........w...\|......^p....H......;...)..........;..EoDo....E.E.D...`.0.GG.aA.H.V.Mx\xA....../..d3.Eb_.J...R.^v........\^ob.}.z..k.x).v$f$..O)+.2..*....y}6`C6b.6cs...l...........!.........<..\|.\|..\|..\|..\|.\|....o....I%.4.L.SI.&C.6..!`...{...c..\.J.(.2.C....V.A..?.M<nG......v..m.;..R.C..aj.H...=..{.>.:.....}i_Y......:....o.&k..KY.2..6k....i]..{,.p}../.....VO3.o].fJ....R-TZ..;...RN..&V...C...3.?.......&..z.s&.D....r,.I...t.R..a$k..Mm..Y.U...+b.%kQ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\SKPE8Q7R.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6911
Entropy (8bit):	5.100664215298125
Encrypted:	false
SSDEEP:	96:s7Z7QZAIGH3bpOHNR2Zfr/edevOinf1hpvOin+oMztxJFOtwtKSr5NiCXBB:s2GH90kZz/i4f7doJwsBXj
MD5:	27B9C8A2E53EF3644FBCCF76ABA688DE
SHA1:	A3B5C9E42C8BA070ECE48E32117D3513D9EC54AC
SHA-256:	C86BE8FA67CDBD0DD425132F2D47BF4CC43692FBB4F249CFACF2C8D979280E1F
SHA-512:	CB227A37D6567F01401AB82E635738F785CC45B158B4F63B917A66739B659B68F70CF383E670DAA854A044FB6D261D67D8FA021C255C385250E3031F05D0FF28
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/
Preview:	....<!doctype html>....<html xmlns="http://www.w3.org/1999/xhtml">..<head><title>...eFax. . Faxen ohne Faxger.t. Faxe online senden und empfangen - Kein Faxger.t ben.tigt...</title><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /><meta name="robots" content="noindex,nofollow,noarchive,noodp,noydir,nosnippet" /><link href="App_Themes/Main/master.css" rel="stylesheet" type="text/css" /><link href="http://efax.co.uk/s/r/images/favicon/16x16.ico" rel="shortcut icon" />.. <script src="//code.jquery.com/jquery-1.12.3.min.js" integrity="sha256-aaODHAgvwQW1bFOGXMeX+pC4PZIPsvn2h1sArYOhgXQ=" crossorigin="anonymous"></script>.. <script type="text/javascript" src="//cdn.jsdelivr.net/jquery.ajax.unobtrusive/3.2.4/jquery.unobtrusive-ajax.min.js"></script>.. <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css" />.. .. <script type="text/javascript">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\anchor[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	modified
Size (bytes):	29346
Entropy (8bit):	5.942765696360016
Encrypted:	false
SSDEEP:	768:3/Sxm8VCUXSHCx2zNtOr3/SBoIQJhztZ9DLr3Pud:ImwCUCHC4zNtM4onJzn736
MD5:	B0F3AADCC15CA570180C8C8AA1BCB3DF
SHA1:	63C15D5DF03D246F888183B5F3521A00C4990328
SHA-256:	6BA4E6954D2EBDBD565C7BB9DA107B6A014A8272CEB20CBBFB79B541D4D7ECF4
SHA-512:	ED824AE313FEF49920EB86640389520225A1928CF2631445149180F53ECE2469A3304CD82DFC063A3089C3F0A3C8E686EAB62A0CAED6FC1496C96FDC2E334BD5
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<style type="text/css">.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 500;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 900;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf) format('truetype');.}..</style>.<link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/styles__ltr.css" nonce="/DoVO5KoSOgkhkP7zgN/ew">.<script nonce="/DoVO5KoSOgkhkP7zgN/ew" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\base[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1567228
Entropy (8bit):	5.5851248126064705
Encrypted:	false
SSDEEP:	24576:2e2dUYxbHdoUDWxSrqBdt4sdwqmsu/Iei:mFHdoKWddesdwSu/Iei
MD5:	29248544656C5E83962D807F22C8E4BD
SHA1:	C08251B387ACAE29D6493DE1CBD3751F54252AC5
SHA-256:	B29E039FAB227E6326CD4F0AD48A8A29C60A7587E487578A69E855D1E45683E4
SHA-512:	E0565D19D70D5F58FE7006B08EB5435DECAF0BA2E98C712F55F28526E9D1BDCA6332BB8D2D323C3A6F47F7CD92D78C08DCD59853C6574FA9B1188B7892D452DD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/c6df6ed7/player_ias.vflset/en_US/base.js
Preview:	var _yt_player={};(function(g){var window=this;/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var k,ba,da,Naa,ha,ia,la,pa,qa,ra,sa,ta,ua,Oaa,Uaa,va,wa,Vaa,xa,ya,za,Aa,Ba,Ca,Ha,Fa,Ka,La,Yaa,Zaa,Ta,Ua,Va,$aa,aba,Xa,bba,Za,$a,cba,dba,bb,ib,eba,qb,rb,fba,xb,tb,gba,vb,hba,iba,jba,Fb,Hb,Ib,Mb,Ob,Pb,Yb,$b,cc,dc,gc,ic,jc,mba,kc,lc,mc,vc,wc,yc,Dc,Kc,Lc,Pc,Nc,qba,tba,uba,vba,Tc,Uc,Wc,Vc,Yc,ad,wba,xba,$c,yba,jd,kd,ld,md,pd,rd,sd,Aba,td,ud,yd,zd,Ad,Bd,Cd,Dd,Ed,Fd,Hd,Jd,Od,Qd,Rd,Sd,Cba,Td,Ud,Vd,Wd,Yd,Zd,fe,ie,le,pe,qe,ve,we,Ae,ye,Ce,Fe,Ee,De,Hba,ne,Re,Pe,Qe,Te,Se,me,Ue,Ve,Jba,af,cf,$e,ef,ff,gf,hf,jf,kf,.lf,mf,Kba,vf,pf,Hf,Lba,Lf,Nf,Qf,Rf,Sf,Tf,Uf,Wf,Vf,Xf,Yf,Oba,Qba,Rba,Tba,eg,fg,gg,ig,kg,lg,Uba,mg,Vba,ng,Wba,og,qg,sg,yg,zg,Cg,Xba,Fg,Eg,Gg,Yba,Pg,Zba,Qg,Sg,Tg,Ug,Vg,Wg,$ba,Xg,Yg,Zg,$g,ah,bh,ch,aca,dh,eh,fh,bca,cca,gh,ih,hh,kh,lh,oh,mh,eca,nh,ph,qh,sh,rh,gca,fca,th,ica,hca,jca,wh,kca,yh,zh,Ah,xh,Bh,lca,Ch,mca,nca,Fh,pca,Gh,Kh,Lh,qca,Nh,Ph,Sh,Vh,Xh,Uh,Th,Yh,rca,Zh,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	121289
Entropy (8bit):	5.099655038954412
Encrypted:	false
SSDEEP:	768:XyzGxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1Fx:1w/a1fIuiHlq5mN8lDbNmPbU
MD5:	95A2A663A45B3B944987C8BC387B64CA
SHA1:	09C5ED6F21D2439C5054921B940C621F312CE93F
SHA-256:	5CAAB37D6279C0290B00B44B4E576470BA2E276A9E1605D06B8B73F6EFCE9760
SHA-512:	5AE3AA1212F40C949B5676E21AD015C37C38916E2F6F196AFBF485EA47FAE503B2570ABC3CFA6430F81DE0D40028769C66DDB6DE9B98D5C9E244C09F9C13CADB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Async/libs/bootstrap-3.3.7/bootstrap.min.css
Preview:	/!.. Bootstrap v3.3.7 (http://getbootstrap.com).. * Copyright 2011-2016 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	894
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	24:/yBJNTqsSk9BTwE05su+xyBJNTqsSk9BTwE05su+R:CssSk7d0wIssSk7d0wR
MD5:	74698D2CCDCD04C5841AA1667204A064
SHA1:	43A2F38051ACBD4C5D722113DB6F8C6A5041DB54
SHA-256:	ADA75B96D514D0011CA905239089F72CF779C8ED5EBA55700C192870880EAF14
SHA-512:	4A09647CDAF0E8D0E7B890F2A7E45C8E848BA697DE49B900419E23EFF2319F7EAA7809FF0874DB670F36A0CBC3DDBF147C986AE0DDBA14456AE7CDF5C1875370
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/bullet.png
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`..PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\commonJqueryScripts[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	121203
Entropy (8bit):	5.069496480991601
Encrypted:	false
SSDEEP:	1536:OUGjh/zqXl4JUGjh/zqXl4JUGjh/zqXl4k:OlNgl4JlNgl4JlNgl4k
MD5:	6A88391E5C67BFE663B2953B011CCEC9
SHA1:	80CC824B0472FAC48598FF32BFFAB7D42CB9154C
SHA-256:	2D8444A8B0CB3CEE63F8B915BC0D51CEBC677513FC5BDB2EC7C7A82218BD22B5
SHA-512:	29C2454320C20267CB757E7D9360A014EE0C319F827617441EDB8FFA35573B3A74F6D3CD5BD0AECB720FD952DA5EBA56400F7A86EC689D83EEED32D4F0103497
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/js/commonJqueryScripts.js
Preview:	var timer, countdown, idle = 0, finalCount = 120;..../*****************************************************************************.. DOM Ready .. ******************************************************************************/..$(document).ready(function(){.....//Default formfield text...$("input.defaultText").focus(function(){....if($(this).val() == $(this)[0].title){.....$(this).removeClass("defaultTextActive");........$(this).val("");....}...});...... var $selectDefaultText = $("select.defaultText");......$.each($selectDefaultText, function(){....if ($(this).val() == ""){.. .$(this).addClass("defaultTextActive");.. }...});.... $selectDefaultText.change(function(){....if($(this).val() == ""){.....$(this).addClass("defaultTextActive");....} else.....$(this).removeClass("defaultTextActive");...});..... .. $(".defaultText").blur();.. $("#suggestionsForm input, button, #content-sendReports input, button ,#content-recieveReports input, button").blur(function(){..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\commonJqueryScripts[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	40401
Entropy (8bit):	5.069496480991601
Encrypted:	false
SSDEEP:	384:Gvitc28tP2C4ZZ8eQnAo7pxBnm/vZw5mTUpZBDKDhDQCRAZ57+OzpF/VrgW14kTY:nctUGDntDgif9zqRNl4k
MD5:	CFB5932B01779AA7972F0D1D962B8C89
SHA1:	7A0AFAFC40122C2741952E02D9EDC77315E31B62
SHA-256:	87F8F15FD3D6ABFCF7A2E5A5D37431E1188A14AA837B67DE1C7EAB4EACC8E668
SHA-512:	DBA353A5EC070F8A03CE455CE2CF7BBCAEE5AD28E30A224AB3FB89585FBDCBB9D474683F962CE4F731E2FC60E2A43933BE15269146EB6CB54C58045BB9F1B06C
Malicious:	false
Reputation:	low
Preview:	var timer, countdown, idle = 0, finalCount = 120;..../*****************************************************************************.. DOM Ready .. ******************************************************************************/..$(document).ready(function(){.....//Default formfield text...$("input.defaultText").focus(function(){....if($(this).val() == $(this)[0].title){.....$(this).removeClass("defaultTextActive");........$(this).val("");....}...});...... var $selectDefaultText = $("select.defaultText");......$.each($selectDefaultText, function(){....if ($(this).val() == ""){.. .$(this).addClass("defaultTextActive");.. }...});.... $selectDefaultText.change(function(){....if($(this).val() == ""){.....$(this).addClass("defaultTextActive");....} else.....$(this).removeClass("defaultTextActive");...});..... .. $(".defaultText").blur();.. $("#suggestionsForm input, button, #content-sendReports input, button ,#content-recieveReports input, button").blur(function(){..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\efax-style[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	29569
Entropy (8bit):	5.145924476517026
Encrypted:	false
SSDEEP:	384:cB6QJ/3ZWHOAkfIyYDxxlM8OVM8Rm6GK4Xve6OxQhYQlAWCRum3RGlHwywfU1CO:cB6U/3tm6mfe6OxwYQ0umseyP
MD5:	19E4660D21B625D65BC831811CDF891D
SHA1:	32E905383C8EEA5442DEC9F6BF8B14AAB64C0299
SHA-256:	9CDDC58D72500D39EF02DC7DE43F558DEA8FE2415A425556AAF183F9ED21A376
SHA-512:	C1ED0ADF4C6781AC2A51AB729D0288CD09AC94E8C5AE407B7292FDC3A625239CCBC4BDB2CAFE5F5E3FB60F5E22205ED04CB8517E5E39D3945F8DAC7078753CC3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/efax-style.css
Preview:	/-----------------------------------------------------------------------.eFax EU White Template..Project:...CREFI-1889 eFax UK - Sitefinity Migration.Version:...1.2.Primary use:..All web pages templates.Lead Designer:..Josef Lagunas <josef.lagunas@j2.com> @ j2 Global, Inc...Table of Contents.[0A] - Unsupported Elements.[0B] - @Font Face.[1] - Body.[1A] - Global Class.[2] - Header.[3A] - Navbar.[3B] - Carousel.[4] - Content.[4A] - Aside.[4B] - Main Content.[5] - Call To Action.[6] - Footer.[7] - Icons.[8] - Forms.[9] - Misc.------------------------------------------------------------------------/..../*-----------------------------------------------------------------------.[0A] - Sections and headings elements should work in most non-HTML5 browsers..Though unsupported, they don't need a special DOM interface and they only need.a specific CSS styling as unknown elements are styled as display:inline by default..---------------------------------------------------------------------

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Reputation:	low
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\formValidateUtil[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	66292
Entropy (8bit):	4.647274014935184
Encrypted:	false
SSDEEP:	768:2FKkS1LNyMLWVSVpbpqRpAaUbAvHFKkS1LNyMLWVSVpbpqRpAaUbAv+:zkSdRhVpbpqRpT4kSdRhVpbpqRpT+
MD5:	F05DC63812A6FEB262AAD779531C7254
SHA1:	283C293F5C298268B01B089A0D996F8F7425B515
SHA-256:	292D289B5281DF6E5302ED1878F0CE582808107BA6C2ABAF79A39E344375D819
SHA-512:	B72D64C906AA93A1709B6648325EFC6F9946BE6D51C71770B0FACE4CEF5B87875B5743221DBAC7CCF3A4FBC76B57E857E79C22356761F6CDFD1855D972981049
Malicious:	false
Reputation:	low
Preview:	//console.log("formValidateUtil.js");..var ERROR_MESSAGE_ATTRIBUTE = "errMsg";.var ERROR_DIV_ID = "myErrorDivShimId";.var TOOL_TIP_TEXT_ID = "tool-tip-text";.var TOOL_TIP_ERROR_ID = "tool-tip-error";.var INVALID_CLASS = "invalid";.var ERROR_ICON_SUFFIX = "_errIcon";.var ERROR_MESSAGES_SUFFIX = "_errorMessages";.var RequiredErrorMessage = "This Field is Required";.var RequiredFieldMessage = "Field is required";.var EmailErrorMessage = "Invalid Email Format";.var COUNTRIES_WITH_ZIPS = [ 'AU', 'FR', 'DE', 'IT', 'ES', 'NL', 'BE', 'CH',. 'AT', 'BR', 'FI', 'DK', 'SE', 'NO', 'PT', 'KR', 'JP', 'LU', 'MX', 'CA',. 'US', 'UK' ];.var FLAG = 0;.var CORPORATE_BRANDNAME = "CORPORATE";.var profileEmailFormId = "form_profileEmail";..$.ajaxSetup({. error : function(jqXHR) {. handleAjaxError(jqXHR). }.});.if (typeof Ext != 'undefined' && typeof Ext.Ajax != 'undefined') {. Ext.Ajax.on('requestexception', function(conn, response, options) {. handleAjaxError(response).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\google-play-store[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 129 x 43, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	9907
Entropy (8bit):	7.952483848136305
Encrypted:	false
SSDEEP:	192:w8cy4DpjwfNnnlDnSPO6dseo/P83c5LUXoamC8tT8IJqc:Wy4DJwf6TCT/P3dUXJ2qc
MD5:	261A3D75B686163AEB918E5B5270D5D0
SHA1:	3678A71D0FB6C3D590D9AF7890789ACF80E09926
SHA-256:	D803A9423D9CDA94201405E15E0990DC7FEF5EF52741A24CAEB2C7EACF2DFF0F
SHA-512:	FD2BC9F1BC002AD6FA5C54DD37669C4511D5F0665CEF509C75580C9D5E25F2E28A53F0F77A3710A8855A43B806959B550CA51F69271FE5170ED430A523E05F53
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/mobile-app/google-play-store.png?sfvrsn=2fdb82b5_0
Preview:	.PNG........IHDR.......+....._'......tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:CED0AAF1196F11E4A15B8B0008AB27ED" xmpMM:DocumentID="xmp.did:CED0AAF2196F11E4A15B8B0008AB27ED"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:CED0AAEF196F11E4A15B8B0008AB27ED" stRef:documentID="xmp.did:CED0AAF0196F11E4A15B8B0008AB27ED"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>\`.r..#'IDATx.\....=...7.d..\$)J0.*..b....9`...~\|b\|.gx">D...DA...d....Y2K..0;....=..7......[U.n8.V.7^y....jCYii.u.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\j[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5748
Entropy (8bit):	5.597499839182207
Encrypted:	false
SSDEEP:	96:d302reqTMabCm1pdxnrn/pW4FJWUSFwg7UM7Llln7UM78l1IjMP3LjHs7mIyM3AI:dk2aqTVp7n/pW4bUSgRX/nRiujMDjgAI
MD5:	A988A9BAE94167E92FE02E9A49A02337
SHA1:	6F5A36AE1D63C5F42AE4B5CEE37B09925762609C
SHA-256:	4D60005D999F1806438DF2B292EF713B4ADD3DB65D1569BCBE0D16C338F8FB73
SHA-512:	9678D027632802409035FF9C51FD9F59164860C48145BF6E57ABE3ECB7E88324D4CD544D62179296F39F11EAFD107BBD5E10DBCFE91B7ABB5E24A98B11CB9D68
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/j.php?a=232379&u=https%3A%2F%2Fwww.efax.ca%2Fhow-it-works&r=0.20887915394824452
Preview:	try{;(function(){var aC=window._vwo_code;if(aC){window._vwo_j_e=window._vwo_j_e\|\|0;if(window._vwo_j_e==1){window._vwo_mt="dupCode";clearTimeout(window._vwo_settings_timer);if(window.VWO&&window.VWO._&&window.VWO._.bIE){window._vwo_code.finish()}return}if(window._vwo_j_e==-1){window._vwo_j_e=1}}window._vwo_mt="live";try{window._vwo_tm="";var getMode=function(e){var n;if(window.name.indexOf(e)>-1){n=window.name}else{n=window.location.search.match("_vwo_m=([^&]*)");n=n&&n[1]}return n&&JSON.parse(decodeURIComponent(n))};if(window.name.indexOf("_vis_heatmap")>-1\|\|window.name.indexOf("_vis_editor")>-1\|\|getMode("_vwo_cc")\|\|window.name.indexOf("_vis_preview")>-1){window._vwo_mt=window.name}else if(window._vwo_tm.length){window._vwo_mt=window._vwo_tm}else if(location.href.indexOf("_vis_opt_preview_combination")!==-1&&location.href.indexOf("_vis_test_id")!==-1){window._vwo_mt="sharedPreview"}if(window._vwo_mt!=="live"){if(!getMode("_vwo_cc")){_vwo_code.load('https://dev.visualwebsiteoptimizer.co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-1.7.2.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	284520
Entropy (8bit):	5.372946098601679
Encrypted:	false
SSDEEP:	3072:VUb6GvCu09s2o2skAie6Ub6GvCu09s2o2skAie6Ub6GvCu09s2o2skAieW:6TvC38kAie1TvC38kAie1TvC38kAieW
MD5:	E5340CF345654AE6F4B4083453DA5C8B
SHA1:	72A087D87B6CAB81D667504E6A7BCEAF980F945B
SHA-256:	3041153B531982DAA41FA3DD060A8F8C45EF2B8375E5E986A310F5D3BBEC37D3
SHA-512:	A93D30D243B2D4CB52F369A2DF7589CC5ACF6575BCC74CDE656D6CE62387CBC3769F754F555D064A5651F8848726E5B9BD68ACDAFBA611CD4893BAADCA208D5E
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/js/jquery-1.7.2.min.js
Preview:	/! jQuery v1.7.2 jquery.com \| jquery.org/license /.(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView\|\|a.parentWindow:!1}function cu(a){if(!cj[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"\|\|e===""){ck\|\|(ck=c.createElement("iframe"),ck.frameBorder=ck.width=ck.height=0),b.appendChild(ck);if(!cl\|\|!ck.createElement)cl=(ck.contentWindow\|\|ck.contentDocument).document,cl.write((f.support.boxModel?"<!doctype html>":"")+"<html><body>"),cl.close();d=cl.createElement(a),cl.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ck)}cj[a]=e}return cj[a]}function ct(a,b){var c={};f.each(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}function cs(){cq=b}function cr(){setTimeout(cs,0);return cq=f.now()}function ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function cb(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTyp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-1.7.2.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	94840
Entropy (8bit):	5.372946098601679
Encrypted:	false
SSDEEP:	1536:8YRKUfAjtledhTmtaFyQHGvCXsedOgRc9izzr4yff8teLvHHEjam7W5X3yzSiLnM:VUb6GvCu09s2o2skAieW
MD5:	B8D64D0BC142B3F670CC0611B0AEBCAE
SHA1:	ABCD2BA13348F178B17141B445BC99F1917D47AF
SHA-256:	47B68DCE8CB6805AD5B3EA4D27AF92A241F4E29A5C12A274C852E4346A0500B4
SHA-512:	A684ABBE37E8047C55C394366B012CC9AE5D682D29D340BC48A37BE1A549AECED72DE6408BEDFED776A14611E6F3374015B236FBF49422B2982EF18125FF47DC
Malicious:	false
Reputation:	low
Preview:	/! jQuery v1.7.2 jquery.com \| jquery.org/license /.(function(a,b){function cy(a){return f.isWindow(a)?a:a.nodeType===9?a.defaultView\|\|a.parentWindow:!1}function cu(a){if(!cj[a]){var b=c.body,d=f("<"+a+">").appendTo(b),e=d.css("display");d.remove();if(e==="none"\|\|e===""){ck\|\|(ck=c.createElement("iframe"),ck.frameBorder=ck.width=ck.height=0),b.appendChild(ck);if(!cl\|\|!ck.createElement)cl=(ck.contentWindow\|\|ck.contentDocument).document,cl.write((f.support.boxModel?"<!doctype html>":"")+"<html><body>"),cl.close();d=cl.createElement(a),cl.body.appendChild(d),e=f.css(d,"display"),b.removeChild(ck)}cj[a]=e}return cj[a]}function ct(a,b){var c={};f.each(cp.concat.apply([],cp.slice(0,b)),function(){c[this]=a});return c}function cs(){cq=b}function cr(){setTimeout(cs,0);return cq=f.now()}function ci(){try{return new a.ActiveXObject("Microsoft.XMLHTTP")}catch(b){}}function ch(){try{return new a.XMLHttpRequest}catch(b){}}function cb(a,c){a.dataFilter&&(c=a.dataFilter(c,a.dataType));var d=a.dataTyp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-ui-1.8.16.custom.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	210601
Entropy (8bit):	5.2702270046406685
Encrypted:	false
SSDEEP:	1536:N3I7CdAf+/M/BeT+aHapfjxM5xmc3CI371uE/JKYrn6oCyiZHbrtRN0KvXfIpQtr:y7Cj/TXYrhZHFdW8uIdkz6AUAsaS02Z
MD5:	3B70E5051ABEB0D8796630EBDEE45F67
SHA1:	3C4A33C54A8744C9D2027411CBC6B88B155DE063
SHA-256:	CB0570D8A0111CE332DEB25191BDF46759F0FC06576C58DB45CF3A27DF59B084
SHA-512:	CBE1DBE5F97CBBBF9B5B7719FA4CF1CA3CA9C15C094CEA27227606327F9F73E96381B94B4BEC4FEC56D8A77C0FEA0023D2B2D065643ECFB6FB804FC0A7AA0A1D
Malicious:	false
Reputation:	low
Preview:	//if (console && console.log) console.log("--- jquery-ui-1.8.16.custom.min.js ---");./!. jQuery UI 1.8.16. . Copyright 2011, AUTHORS.txt (http://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * http://jquery.org/license. . http://docs.jquery.com/UI. */.(function(c,j){function k(a,b){var d=a.nodeName.toLowerCase();if("area"===d){b=a.parentNode;d=b.name;if(!a.href\|\|!d\|\|b.nodeName.toLowerCase()!=="map")return false;a=c("img[usemap=#"+d+"]")[0];return!!a&&l(a)}return(/input\|select\|textarea\|button\|object/.test(d)?!a.disabled:"a"==d?a.href\|\|b:b)&&l(a)}function l(a){return!c(a).parents().andSelf().filter(function(){return c.curCSS(this,"visibility")==="hidden"\|\|c.expr.filters.hidden(this)}).length}c.ui=c.ui\|\|{};if(!c.ui.version){c.extend(c.ui,{version:"1.8.16",.keyCode:{ALT:18,BACKSPACE:8,CAPS_LOCK:20,COMMA:188,COMMAND:91,COMMAND_LEFT:91,COMMAND_RIGHT:93,CONTROL:17,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,INSERT:45,LEFT:37,MENU:93,NUMPAD_ADD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-ui-1.8.16.custom.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	210601
Entropy (8bit):	5.2702270046406685
Encrypted:	false
SSDEEP:	1536:N3I7CdAf+/M/BeT+aHapfjxM5xmc3CI371uE/JKYrn6oCyiZHbrtRN0KvXfIpQtr:y7Cj/TXYrhZHFdW8uIdkz6AUAsaS02Z
MD5:	3B70E5051ABEB0D8796630EBDEE45F67
SHA1:	3C4A33C54A8744C9D2027411CBC6B88B155DE063
SHA-256:	CB0570D8A0111CE332DEB25191BDF46759F0FC06576C58DB45CF3A27DF59B084
SHA-512:	CBE1DBE5F97CBBBF9B5B7719FA4CF1CA3CA9C15C094CEA27227606327F9F73E96381B94B4BEC4FEC56D8A77C0FEA0023D2B2D065643ECFB6FB804FC0A7AA0A1D
Malicious:	false
Reputation:	low
Preview:	//if (console && console.log) console.log("--- jquery-ui-1.8.16.custom.min.js ---");./!. jQuery UI 1.8.16. . Copyright 2011, AUTHORS.txt (http://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * http://jquery.org/license. . http://docs.jquery.com/UI. */.(function(c,j){function k(a,b){var d=a.nodeName.toLowerCase();if("area"===d){b=a.parentNode;d=b.name;if(!a.href\|\|!d\|\|b.nodeName.toLowerCase()!=="map")return false;a=c("img[usemap=#"+d+"]")[0];return!!a&&l(a)}return(/input\|select\|textarea\|button\|object/.test(d)?!a.disabled:"a"==d?a.href\|\|b:b)&&l(a)}function l(a){return!c(a).parents().andSelf().filter(function(){return c.curCSS(this,"visibility")==="hidden"\|\|c.expr.filters.hidden(this)}).length}c.ui=c.ui\|\|{};if(!c.ui.version){c.extend(c.ui,{version:"1.8.16",.keyCode:{ALT:18,BACKSPACE:8,CAPS_LOCK:20,COMMA:188,COMMAND:91,COMMAND_LEFT:91,COMMAND_RIGHT:93,CONTROL:17,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,INSERT:45,LEFT:37,MENU:93,NUMPAD_ADD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery.unobtrusive-ajax.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3833
Entropy (8bit):	5.2323357745774715
Encrypted:	false
SSDEEP:	96:UB0oHdDP40xnDOwu74ABXcpxjxCUfx9xZxixjOHxLbxGlq9xuVxVEx5nxAXMNWD6:mDxFu74qeFYUfjbYMHxbAq9gVPELnSXW
MD5:	4DE669CD5BD2C919CB45996D4D45A0EB
SHA1:	B0A423A77743B7234F5F0BC531415F64367B1B53
SHA-256:	960B10FD1B4712BC07A4DEFAC2143FC9D3E8D78A139516606D747FBF747DB83E
SHA-512:	213245A108A1B91151E9B2424C4EAAE536BF2E36A2699BADA25FDDA67FB01CC3BA096363627FE6DCEACF80D7A11B642375CC6819E1903E88818559CFE9266572
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn.jsdelivr.net/jquery.ajax.unobtrusive/3.2.4/jquery.unobtrusive-ajax.min.js
Preview:	/* NUGET: BEGIN LICENSE TEXT. . Microsoft grants you the right to use these script files for the sole. * purpose of either: (i) interacting through your browser with the Microsoft. * website or online service, subject to the applicable licensing or use. * terms; or (ii) using the files as included with a Microsoft product subject. * to that product's license terms. Microsoft reserves all other rights to the. * files not expressly granted by Microsoft, whether by implication, estoppel. * or otherwise. Insofar as a script file is dual licensed under GPL,. * Microsoft neither took the code under GPL nor distributes it thereunder but. * under the terms set out in this paragraph. All notices and licenses. * below are for informational purposes only.. . NUGET: END LICENSE TEXT /./. Unobtrusive Ajax support library for jQuery. Copyright (C) Microsoft Corporation. All rights reserved..*/.(function(a){var b="unobtrusiveAjaxClick",d="unobtrusiveAjaxClickTarget",h="unobtrusiveValidati

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jqueryJS[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	288490
Entropy (8bit):	5.20950861623491
Encrypted:	false
SSDEEP:	3072:Z1nN5ebtkBUKBixkjYh5kJ0C+LCwuuHv3szaS6ISNUiSZNuAJSOSNcjNE:TnN02tixIYJ/LC7uHPsz5JSOS6jNE
MD5:	2DB38808B62DA9BAC5F7C0F47DF3EC44
SHA1:	68750E2BC094964AA3272D146F873905DDAE6363
SHA-256:	482A85EBA339EAED8C6FE3175F98B7622B958047D5F11490B6AE3F8A0DD19DD7
SHA-512:	2C5E42AC5D9519F3FDD7AE07D1B2D980A3225633EB0483B4F2841F422EDB0A80D4FC595ADD4F4F9C7B4ECAD3715D8369E6C8B1C13C815EA17BDD495C940D6D73
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/jqueryJS?v=LmorJszLaP2OiJ2g3tgcArEke5AY2FZznM60cyXOgzY1
Preview:	(function(){"use strict";function n(n){function o(o,s){var rt,ut,p=o==window,c=s&&s.message!==undefined?s.message:undefined,g,k,d,tt,nt,w,b,it,ft,et,ot;if(s=n.extend({},n.blockUI.defaults,s\|\|{}),!s.ignoreIfBlocked\|\|!n(o).data("blockUI.isBlocked")){if(s.overlayCSS=n.extend({},n.blockUI.defaults.overlayCSS,s.overlayCSS\|\|{}),rt=n.extend({},n.blockUI.defaults.css,s.css\|\|{}),s.onOverlayClick&&(s.overlayCSS.cursor="pointer"),ut=n.extend({},n.blockUI.defaults.themedCSS,s.themedCSS\|\|{}),c=c===undefined?s.message:c,p&&t&&u(window,{fadeOut:0}),c&&typeof c!="string"&&(c.parentNode\|\|c.jquery)&&(g=c.jquery?c[0]:c,k={},n(o).data("blockUI.history",k),k.el=g,k.parent=g.parentNode,k.display=g.style.display,k.position=g.style.position,k.parent&&k.parent.removeChild(g)),n(o).data("blockUI.onUnblock",s.onUnblock),d=s.baseZ,tt=e\|\|s.forceIframe?n('<iframe class="blockUI" style="z-index:'+d+++';display:none;border:none;margin:0;padding:0;position:absolute;width:100%;height:100%;top:0;left:0" src="'+s.iframeS

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\login[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67322
Entropy (8bit):	5.115258505765135
Encrypted:	false
SSDEEP:	1536:CQKRMhJz03D6gtOud9iKte6JMWTJdL6Mg+kaSYHviMWqrfzzu1:CQKRM74hZ7JlTLnkaSYHviMNzM
MD5:	E56A271862272973ACE15AF5BB253B8C
SHA1:	0EBD239298704BD05BD4D3F9D1EBF20CB449EB2B
SHA-256:	1E805C7486EACF678BA3B6DA8582FC222907C7EB20EA9B9B1F3F28780AD3DD4F
SHA-512:	11AB0B9F96AECEAA868F6110FF3BAE6DB18B136B319735A42D6867766D7E06EBE69291BC4C01BE3882313DEE472A76FE50186A1CC5FF8401BCEA71AA643A5CA2
Malicious:	false
Reputation:	low
Preview:	. /WEB-INF/grails-app/views/layouts/efaxi_Sales.gsp --> j2_include rendered start: /html/content/layouts/efaxi_Sales.gsp --><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">....<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <title>eFax Login</title>.. <link rel="shortcut icon" href="/myaccount/images/favicon.ico" type="image/x-icon"/>.. r:require modules="efaxiSales"/ -->.. r:layoutResources/ -->.. INT-4497 -->.. <link rel="stylesheet" type="text/css" href="/myaccount/css/jquery-ui-1.8.16.custom.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/efaxi.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/cookie-banner.css"/>.<script type="text/javascript" src="/myaccount/js/jquery-1.7.2.min.js"></script>.<script type="text/javascript" src="/myaccount/js/jquery-ui-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\logo_48[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ltblueBox_bottom[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 730 x 4
Category:	downloaded
Size (bytes):	159
Entropy (8bit):	5.72191337284883
Encrypted:	false
SSDEEP:	3:C3llvUeW4g2U0tlbzl7/lDpqdOG3r67NCVkRIhCKCJiIBSRkXL+2ZAV:2+efgwPl/UWuhCJJiUiSLnZQ
MD5:	017E454ACA3E23CBFC2C3220B4BD9A18
SHA1:	83A1BFFB7C332BFADB58657CD278ACB617C69B18
SHA-256:	BCA995FF80AAB453553E39E8E2C23C7F87777B2960EAE65627B448F9EF69BB27
SHA-512:	A91FD0F70B9A54F2FEDE99FE01EDCDE95832E4F40BA7C6D119E199B404148212709483FD492B26D7A639501438FF06F158658329F6395351AA5C5FB186C0E65B
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/mainShadowContainer/ltblueBox_bottom.gif
Preview:	GIF89a.......................................................!.......,..........L0.I..8...`(.di.h..l.p,.tm..p.\|....pH,..H....$..tJ.Z..,*q`....xL....%@0#.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\meganavBundle[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	44567
Entropy (8bit):	4.971786636712672
Encrypted:	false
SSDEEP:	384:yCU7kFOsUOswRCxEaC9C0tJBM+BMKkQldazvGU:vYE79q33
MD5:	06F2EE95A2C7790E28D52426C8A0D85B
SHA1:	F4503BE42C2BC6F187307090A2EC06D90C192C2A
SHA-256:	7D317A676BD8689EDB5588E11C384D6A87CAA26BBBA200A4E4EB689D5BE8E40C
SHA-512:	9522C409CB4FEF8CF1CE2E315C97C4A28B54D625C067EE576F8559AF94D2D1A666BAE5A3A745F3E15B0B239F5677DDBF04E6AFD09B77AF63F2D56DACF653A041
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Content/base/meganavBundle.css?v=q5aqGDcybh_WT_v8Xm5m_5ZsEGC2XdRojhMOXHLhT0s1
Preview:	input,select,textarea,button,a{-webkit-tap-highlight-color:rgba(0,0,0,0)}@font-face{font-family:'efax-icons';src:url('/Content/MegaNav/fonts/efax-icons.eot?86293682');src:url('/Content/MegaNav/fonts/efax-icons.eot?86293682#iefix') format('embedded-opentype'),url('/Content/MegaNav/fonts/efax-icons.woff2?86293682') format('woff2'),url('/Content/MegaNav/fonts/efax-icons.woff?86293682') format('woff'),url('/Content/MegaNav/fonts/efax-icons.ttf?86293682') format('truetype'),url('/Content/MegaNav/fonts/efax-icons.svg?86293682#efax-icons') format('svg');font-weight:normal;font-style:normal}.efax-icon{font-family:"efax-icons";font-style:normal;font-weight:normal;speak:never;display:inline-block;text-decoration:inherit;width:1em;text-align:center;font-variant:normal;text-transform:none;line-height:1em;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.icon-toll-free:before{content:'.'}.icon-close:before{content:'.'}.icon-customers:before{content:'.'}.icon-download:befor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 18900, version 1.1
Category:	downloaded
Size (bytes):	18900
Entropy (8bit):	7.96514104643824
Encrypted:	false
SSDEEP:	384:nejx4dDcsFhu/3v79dEAUdH6XSw1fz9fKQm9LQNG/X1epB:ejadDrhYTf3Udaieza98Nbz
MD5:	1F85E92D8FF443980BC0F83AD7B23B60
SHA1:	EE8642C4FAE325BB460EC29C0C2C9AD8A4C7817D
SHA-256:	EA20E5DB3BA915C503173FAE268445FC2745FC9A5DCE2F58D47F5A355E1CDB18
SHA-512:	F34099C30F35F782C8BB2B92D7F44549013D90E9EEDE13816D4C7380147D5B2C8373CC4D858CDF3248AAA8A73948350340EE57DAE9734038FC80615848C7133E
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhv.woff
Preview:	wOFF......I.......p.........................GDEF................GPOS................GSUB.......X...t...OS/2.......^...`....cmap...`.........X..cvt .......].....-..fpgm...t........s.ugasp................glyf...$..9...Y..(.head..A....6...6.%I.hhea..B,.......$.)..hmtx..BL..........O,loca..D`........9yfmaxp..F$... ... .q..name..FD........#.>.post..G4.......x.U..prep..H............k........................................x...5.A......m."gW..`.L..&N".?.......IF....a.^...b1..................Uh."4...>..=x.c`f.g......:....Q.B3_dHc.........................@`......../..?....^...... 9.8.m@J....w..!..x.\.!..q......#aff...#1Q@.'U..@5.".llt.Aa#.f\|c.W.....'..X..!..C...ITPE.;..V.j......0. .L0E...Yd.mN....:.....F....GG.g.s,x.>0....v..I;o..<.$G9.\f2...e(}.IS2..uc]p.........M.x.c.a.g``..$KY...e@.,q@.j...o@<..O.H.t.................c .p@..........3lbd.....-.}.M...!...!....x.TGw.F........)..)7.W..`.j.-...='_..sI...2...O>....[tt....TK]..\|...G..............^.m..=..x.q...+./].p...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\mem8YaGs126MiZpBA-UFVZ0d[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 18100, version 1.1
Category:	downloaded
Size (bytes):	18100
Entropy (8bit):	7.962027637722169
Encrypted:	false
SSDEEP:	384:aHQHZuiZQFFIimUy1oml4hN2Vmw1Qa57YC74ObDDj08X0UJQiXc:1ZQT0UySml4bEmAP5EC7PbDH4U1M
MD5:	DE0869E324680C99EFA1250515B4B41C
SHA1:	8033A128504F11145EA791E481E3CF79DCD290E2
SHA-256:	81F0EC27796225EA29F9F1C7B74F083EDCD7BC97A09D5FC4E8D03C0134E62445
SHA-512:	CD616DB99B91C6CBF427969F715197D54287BAFA60C3B58B93FF7837C21A6AAC1A984451AEEB9E07FD5B1B0EC465FE020ACBE1BFF8320E1628E970DDF37B0F0E
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff
Preview:	wOFF......F.......i.........................GDEF................GPOS................GSUB.......X...t...OS/2.......^...`~]..cmap...`.........X..cvt .......Y.....M..fpgm...p........~a..gasp...............#glyf......6...S...]head..>....6...6..cphhea..>........$....hmtx..?...........[$loca..A4.........f..maxp..B.... ... ....name..C.........&:A.post..D........x.U..prep..E.........C...........................................x...5.A......m."gW..`.L..&N".?.......IF....a.^...b1..................Uh."4...>..=x.c`f..8.....u..1...<.f...................A......5....1...A.._6..".-..L.....Ar,......3..(....x.\.!..q......#aff...#1Q@.'U..@5.".llt.Aa#.f\|c.W.....'..X..!..C...ITPE.;..V.j......0. .L0E...Yd.mN....:.....F....GG.g.s,x.>0....v..I;o..<.$G9.\f2...e(}.IS2..uc]p.........M.x.c.a.g.c..$KY...e@.,.."..........?....%.g....Z.....(".o..Y..Bu342.e......0..........M=.....x.uTGw.F........)..)7.W.$`*.....G.Kz.)e....t.\|.1.7...s.g...3.7mgf..~{1...s.3.S...co..o.~.Zy.u...kW.\.t...N.KG.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\myaccount[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67307
Entropy (8bit):	5.115695561972505
Encrypted:	false
SSDEEP:	1536:CQKRMhJz03D6gtOud9iKte6JMWTJdC6Mg+kaSYHviMWtr3zzu1:CQKRM74hZ7JlTCnkaSYHviMczM
MD5:	18DB83612CEDE445643BEF41A420EE36
SHA1:	4BA40012D9E088AF75DF4051A6D08AED59D8C025
SHA-256:	315F4101CE5972E905EA4B57277C2E981BC1A8E3CD868D71EF29661168CED354
SHA-512:	6EDAB1B6D293C7D2936FA54B9385EA1FCB185174457198460E755D8E6A044349F945CC627DA6CE2C13AAA55B84CC78AC6B2585114783BBD3F0D82A996CEF8ED0
Malicious:	false
Reputation:	low
Preview:	. /WEB-INF/grails-app/views/layouts/efaxi_Sales.gsp --> j2_include rendered start: /html/content/layouts/efaxi_Sales.gsp --><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">....<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <title>eFax Login</title>.. <link rel="shortcut icon" href="/myaccount/images/favicon.ico" type="image/x-icon"/>.. r:require modules="efaxiSales"/ -->.. r:layoutResources/ -->.. INT-4497 -->.. <link rel="stylesheet" type="text/css" href="/myaccount/css/jquery-ui-1.8.16.custom.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/efaxi.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/cookie-banner.css"/>.<script type="text/javascript" src="/myaccount/js/jquery-1.7.2.min.js"></script>.<script type="text/javascript" src="/myaccount/js/jquery-ui-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\navcancl[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2713
Entropy (8bit):	4.1712007174415895
Encrypted:	false
SSDEEP:	24:r3avxU5hzsIVmVMeLmVMyHf63lboxMCLxvriN6LOAPAnQay78eLx5Tb87nVkEhML:upU0GVeLVGBXvrp4n/1a5TI7Ve/G79KX
MD5:	4BCFE9F8DB04948CDDB5E31FE6A7F984
SHA1:	42464C70FC16F3F361C2419751ACD57D51613CDF
SHA-256:	BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228
SHA-512:	BB0EF3D32310644285F4062AD5F27F30649C04C5A442361A5DBE3672BD8CB585160187070872A31D9F30B70397D81449623510365A371E73BDA580E00EEF0E4E
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/navcancl.htm
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html>.... <head>.. <link rel="stylesheet" type="text/css" href="res://ieframe.dll/ErrorPageTemplate.css" />.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.... <title>Navigation Canceled</title>.... <script src="res://ieframe.dll/errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="res://ieframe.dll/httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:navCancelInit(); ">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="res://ieframe.dll/info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\opa-b7dcb10662af8baedec6b74a4afbd17d[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	92978
Entropy (8bit):	5.29280301987907
Encrypted:	false
SSDEEP:	1536:ANNP8LQPpCO+mbW/EhBmFCBklmltpQkUxiBW8SAub1A7uoZqEg3zIe9N0x:UnCO+2PhBqwklm0IBW8SAh7ubK
MD5:	C746E54CD79F9992DD2E84D7B47C0565
SHA1:	BAA577315331430E0CF908C12ECAA4241BE79184
SHA-256:	3DD6DC7767738C5833569F968DC9DDA6F4D356B0C681369476C383AAB3D65C06
SHA-512:	2C80D70965F0DC3839735AFF3225ABC62ACEB90E157126B05E97AE60315D8A3F6EAE1A7C88964DFB6BB3D10B5C3147C9E374BF903A903D2A24F554A99ED29230
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/analysis/4.0/opa-b7dcb10662af8baedec6b74a4afbd17d.js
Preview:	!function(){var e=function(e,t){var n=function(){e()?t():setTimeout(n,100)};n()};e(function(){return VWO&&VWO._&&VWO._.libLoaded},function(){window.VWO=window.VWO\|\|[],VWO.v_o="4.0.55",function(){var i=parseInt(new Date/1e3,10),e,o=function(){return e\|\|(e=VWO.data.ts\|\|i)},t=Object.keys\|\|function(e){var t,n=[];for(t in e)e.hasOwnProperty(t)&&n.push(t);return n};function n(e,t){for(var n in t)t.hasOwnProperty(n)&&(e[n]=t[n])}function r(e,t){for(var n=[],i=0;i<e.length;i++)n.push(t(e[i]));return n}function a(e,t){for(var n=[],i=0;i<e.length;i++)t(e[i],i)&&n.push(e[i]);return n}function w(e){var t=o(),n=parseInt(new Date/1e3,10)-i;return e?t+n:1e3*(t+n)+ +new Date%1e3}function y(e,t){var n,i=!1;return function(){i&&(clearTimeout(n),n=null),n=setTimeout(function(){e.call()},t),i=!0}}function s(e,t,n){"Array"===e?(this.tags=[],this.lastSent=0):"Hash"===e&&(this.tags={},this.sentTags={}),this.type=e,this.maxCount=t\|\|1/0,this.addTagCallback=n\|\|function(){}}function B(e,t,n,i){VWO._&&VWO._.custo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\pano-pricing[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 1560x338, frames 3
Category:	downloaded
Size (bytes):	25491
Entropy (8bit):	7.749383194990991
Encrypted:	false
SSDEEP:	384:C77s9m8+xVqejkpSkq6BNNmkaoKizhsFk80SFy72g8W7b12Qv924AGPJF29FW:C77Wm8rk2q0mkvKkn8JU98WV1S9FW
MD5:	279ED2167D88C659C7B0AF60F1E38F55
SHA1:	2848F90DB431D6BCFB2A4E062001CC56866B8934
SHA-256:	8C3F36D658C5D66A79BB7693B2F47BB64AD0A81CA5E55DABFD7CDC60BEA1F2A0
SHA-512:	82751DED74893372F2CB7A651929DEFC4B1BDA6E629C180701D19F0B5C930DC94AE9B94BE5B5E2866082C9CB5DF32EFD92A83CBFA603AC82E4B3F84FEFFDD36F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/rebuild/pano/pano-pricing.jpg
Preview:	......Exif..II.................Ducky.......<......Adobe.d.................................................................................................................................................R...............y.....................................................................!1A..Qaq.........."2.BR.b.......................1............?..~:9..xw^.uR.gu...RJ.6..U..T..zz..T.k..@.R.h...&.(Mz..%."Z.Q.K.jTC.k+k.R.1..Mc,.....c..h..2n....I....Eh..8.J..@.V...._.F.P.".q....%./p..,...Fw.d.\...&. .s9t.&...co.Fv....`.__`'N.J....d...........8.....@i..O.-t&.+.>....r.Z..kG.. .t.Z.fg 4L.)4SZ...V.. ..Pxz..........aWT..+M+.AH.."..d..%.er.o.G7&..{%!.l.. k?.B.5.4.....s..I....C^>.....z..D. %....... E...K.......TK..X.`L.P.....s)...O......j.F=..4Q...\f..E. .`.&....F<.......K.i.dE..T.....\.nc.'.D...R......j...@C........i.... V)v...`R.s...aMf.."...4..`6..&...' .~.!..(.i......(...Z...`. !.............q...P.vyw..x.."..#;u.".mAFwS..._.....0....u........cZ.w...9.x.5.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\real_estate_industry_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15745
Entropy (8bit):	6.460362616685944
Encrypted:	false
SSDEEP:	192:hgqpH4ByzsEJ1CtsTnjVse2v9qQkUJx5T1zTV6hyUZt1uQEjQ5JaZoLn:q8sEJ1CtsrR/JeBzTIh/jIWJe8n
MD5:	4814430930AA56C816043B875E9E9CAF
SHA1:	A7A0E27A7FF4733653B40C5D14E9C92E1CFCCF8D
SHA-256:	55E561B469D2B0457D4BA093FF758A85E30AC12C585D57B213FE91DFB0E057A8
SHA-512:	8466F1B9C6C041099E80579F9EE96747E7F2C15D8EBC5BFFAE5B5AD46530B2799E23B0FA1E37DE2EA652267985016309EE025BDDF88B951B594A663E83D28C55
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/real_estate_industry_1024.png?sfvrsn=97d990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:D4B30FBAF9D911E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:D4B30FBBF9D911E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:D4B30FB8F9D911E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:D4B30FB9F9D911E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>}.E..9.IDATx.....eyY...,.H.0(..ZS...w7..B.J..-l+.k.U...E...U.Z...%.(n.K..)`.4E....j.k.D.L....v...H..m.....sy..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\remote[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	96187
Entropy (8bit):	5.460198184664162
Encrypted:	false
SSDEEP:	1536:o+TAxhzkK3i/dK9QHd8LqHAMvooxfsNBbdpW5dFbTt9eOE1G00b0v+kJ:cxhzkP/dKiHyLq/ooxfsBbdpW5dFbTtc
MD5:	AB11F0F39FF19348A6202A0A5F4699BF
SHA1:	E29737B418178521C0F79D8267D296B5177A248E
SHA-256:	9BCD764FE88382133AE1A8ED0134B410A7ABC356AA1FE50F84D82C5DF94E716F
SHA-512:	DF0491681F9FF4320FFED4CFB0A29EFDC6C0C71A0F9EAF1CB9A2DB276D904A1C4AA0C581C04325A1698862C44AAFCB7EEAA7F90DF8222914FB0EF29CE32E2E31
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/c6df6ed7/player_ias.vflset/en_US/remote.js
Preview:	(function(g){var window=this;var Y,xHa=function(a,b){return g.Nb(a,b)},F4=function(a,b,c){a.C.set(b,c)},G4=function(a){F4(a,"zx",Math.floor(2147483648Math.random()).toString(36)+Math.abs(Math.floor(2147483648Math.random())^g.A()).toString(36));.return a},H4=function(a,b,c){Array.isArray(c)\|\|(c=[String(c)]);.g.fn(a.C,b,c)},yHa=function(a,b){var c=[];.g.mj(b,function(d){try{var e=g.Vn.prototype.B.call(this,d,!0)}catch(f){if("Storage: Invalid value was encountered"==f)return;throw f;}void 0===e?c.push(d):g.Un(e)&&c.push(d)},a);.return c},zHa=function(a,b){var c=yHa(a,b);.g.Bb(c,function(d){g.Vn.prototype.remove.call(this,d)},a)},AHa=function(a){if(a.U){if(a.U.locationOverrideToken)return{locationOverrideToken:a.U.locationOverrideToken};.if(null!=a.U.latitudeE7&&null!=a.U.longitudeE7)return{latitudeE7:a.U.latitudeE7,longitudeE7:a.U.longitudeE7}}return null},BHa=function(a,b){g.fb(a,b)\|\|a.push(b)},I4=function(a){var b=0,c;.for(c in a)b++;return b},CHa=function(a,b){var c=b instanceof g.Bc

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\seal[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 115 x 81
Category:	downloaded
Size (bytes):	1854
Entropy (8bit):	7.794263521589099
Encrypted:	false
SSDEEP:	48:Moyw1nfd0Psbkbz9wdPkxKmJF86yLieQTJkQb:MC9d0PXtwdPkNS1vQkQb
MD5:	EA69DA5897B68425A0FF1B1C6DFA82D0
SHA1:	2592D6EAD46A8A24CAF07E63434154C4C4B1A8B0
SHA-256:	BE239BAE343CD6BE0715892BC9AEB886658701091112958F31F0F87D4A47A9DD
SHA-512:	D86CCE26AD157E3CEF1700B5DDB0DD59BBE7E7E71BBB4B4CBF7DB5C5305AF2F2201FE51A53CDB585760DEF031D9173DA9AE1657018F6053BC9C3BA9F3E899E88
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/efaxi/en/seal.gif
Preview:	GIF89as.Q.........[...53/.......L...]y.......hf`..0......!.......,....s.Q......I..8...`(.di.h..l.p,.tm.x...S..........q....O..7<.....(.Q..nt.Y$.........1\|....M.qX..TDAWH.Ec<.^y.w.hi=.IX.@H.c@.zW................l..D........Q..+f......g...W.B....f......@....w.H...........I.........F..............p.$....[h..6n...8G..E.<..a.f".x..CV+....e..Q.....@..(......%...@iQ....... b.........$!N.d..3.tX..t..'.^.JF.p......P..B....$hp.).>...T...\.`B..\zj-..z....v...T].S..b.`...H2...P......A..A_.....(....KJ.. .l.......'..o.~@..V........@n.....].....[o........} .].<Z>t.f3y...\{.M*.k..7e.X.D8Qf....fM.Wl.X.C=..n.$.W..$...^=!..e%..M.&..n...S.x...N...]2.R..Ii..de..)...X...A........57.X /..Ch....rx.[`.,.Yn\FG...l4.d...!5N.._.2c..$G.h[B.^.G.YV....w....n.3....w.ncT.f....d..a.C....cy!~..r.E.T..wJ25T.8.z...a. ..N......a...W......3.B.l..Lv."...D&..u.^v.2:...@.........N2.....k)..!...{el....m.J...T.]....gDx...H........v..\M.;u.j#.F.p..k....H....\...L...8..$A.P...F0.\|..E..2t..J0...vGq

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\send-fax-second[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], progressive, precision 8, 270x213, frames 3
Category:	downloaded
Size (bytes):	27668
Entropy (8bit):	7.950224748463335
Encrypted:	false
SSDEEP:	384:r6ZdUckLPTFc9KiRdl5+VcSkyu2tCD3dBgrBF0sp6qeuPPMnbdWKr:eZdUck1cAodl5+V9k2oAi5u2l
MD5:	A3DB6B4996C59C7373B415CFF0496E66
SHA1:	EFA0307EA642D89C99C3A6C2BD592A4ABA83D63B
SHA-256:	5B662D656E495C786ABDC0B69FEBF344FFF9264CB4D37EFB667C307F11DFF081
SHA-512:	2F9F90BDFD0C835BD60992D635DAAB94824F464A32B060A940E2B2C64F4260C81AB50C9378110E5DA2E510F2BC81A726D10C95CF2043D05F59BAFADDF7030C1A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/send-fax-second.jpg?sfvrsn=2
Preview:	......Exif..II*.................Ducky.......d.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DBFCDAC1067D11E48955FBDD654B7069" xmpMM:DocumentID="xmp.did:DBFCDAC2067D11E48955FBDD654B7069"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DBFCDABF067D11E48955FBDD654B7069" stRef:documentID="xmp.did:DBFCDAC0067D11E48955FBDD654B7069"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...................;...R...l.....................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\send-faxe-first[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], progressive, precision 8, 324x188, frames 3
Category:	downloaded
Size (bytes):	23563
Entropy (8bit):	7.907377476493169
Encrypted:	false
SSDEEP:	384:dX+LGhaULNQFvv03aqZrxnxddddddddddddddddLJCDfeQCTalB0icUAAvtnzoB8:xaSaUpQBv0KAxxddddddddddddddddLA
MD5:	50C2D4966AA8245ACA4CCA14D11BC3A0
SHA1:	D42DBBD0338C290B8A16D64524918B05C8E0B571
SHA-256:	C3B85548CCD6C27F5ECB62C5AAEA0001D67164879FF7C67FDBD4027EF7546C12
SHA-512:	ED1147B5E500603426C906BA9CFC68E85AEF9CDDA7022CCBC90A4363E13EAFE373EC05201E2AC85D06D4E581D0B7961AB79B3922320F8E5D6C6FF9134AE8EFF4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/send-faxe-first.jpg?sfvrsn=2
Preview:	......Exif..II*.................Ducky.......d.....+http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:AFF4BAB1067D11E48D84D7503F1BF2AE" xmpMM:DocumentID="xmp.did:AFF4BAB2067D11E48D84D7503F1BF2AE"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:AFF4BAAF067D11E48D84D7503F1BF2AE" stRef:documentID="xmp.did:AFF4BAB0067D11E48D84D7503F1BF2AE"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>...&Adobe.d...................0...D0..\.....................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\titilliumwebregular[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), TitilliumWeb-Regular family
Category:	downloaded
Size (bytes):	64080
Entropy (8bit):	6.380278664431567
Encrypted:	false
SSDEEP:	1536:393gOKzZ8NqPD4+Cuu2E8H7O1j7ENTLkypAJ8Cs4jo:5gOK4qPDTtu2E8H7O1j7ENTIyqJLs4jo
MD5:	E3B306860491D13DE6D47F73EA93144B
SHA1:	AB5E780C717C5EB9D9FD7493A5253183CC1396DD
SHA-256:	FF777EC14F3AE65048DE8BB47FA68A330D5EE808B84A528A4C5B0A8CCC4412D1
SHA-512:	282A5C48B540B6E167033B06A7CCB4CD8B5DF9DACB09DD2020775AB31634C95B4D0184E461DC4E230CF6E39CA2816970165C9872F66B0A941181163ACF802DC4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/fonts/titilliumwebregular.eot?
Preview:	P.................................LP................... .........................(.T.i.t.i.l.l.i.u.m.W.e.b.-.R.e.g.u.l.a.r.....R.e.g.u.l.a.r...v.V.e.r.s.i.o.n. .1...0.0.1.;.P.S. .5.7...0.0.0.;.h.o.t.c.o.n.v. .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.5.3.1.1...(.T.i.t.i.l.l.i.u.m.W.e.b.-.R.e.g.u.l.a.r.................FFTM_.YV........GDEF.......@... GPOSc..Q...d..P.GSUB?.3N...`....OS/2i.}S.......`cmaph.u.........gasp.......8....glyfz:....\....head..V5.......6hhea.......D...$hmtxJ;N4....... locaZ?:R........maxp...G...h... name..)b........post..[.........preph..................A..._.<.................... ...+.:.................m.\|...m. .0.+.........................D.................@...................X...K...X...^...,............................UKWN.@. ...m.\|...m.. .............. ...........M.........S.u.B.0...0.E.0.....*...C...3...%...6.0.7..."...D...C... .0.'.0.k.0.E.0.>.0.(.0.?.0.2.0.M.0. .0.)...C...0.0.=.0.@.0.R...%...3.T...h.U. .;...U.).U...U.h.9...U...U.!...9.U...U.H.U...U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\topNav_right[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 400 x 30
Category:	downloaded
Size (bytes):	1271
Entropy (8bit):	7.442893120669859
Encrypted:	false
SSDEEP:	24:Ji/nbhaUH+7ymg+u2w7muNkf7tmJ3ZJvSmtXVo5TtKziqWtmnpG1JM5FDtsn8mG3:Azhaz7fg3Z7fitmd1ATMziqLpG1C/Dei
MD5:	6C279D245942C05FBD0337E8D2F47058
SHA1:	F06E3BE34D62EF01C25DB96B8D15FEBA7BB3AEA6
SHA-256:	FA1E5CDD97EBD571D1BAE552D884E7E106A42ADA22C9F2ED341CF3CF15C8BE2F
SHA-512:	0059D54D45B8591ECBAC4B4214FA36B2FDDD159F5656BF37494ADE8617BB3639C5143B6BB6353136A3269E561990B658CF1A1C2B20B7CDB2C7796A1C2DE1D562
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/navigation/topNav_right.gif
Preview:	GIF89a.....................................................................................................................................................................................................!......,...........@.pH,...r.l:..tJ.Z..v...B#.jL....z.n...\|N.....~....o..")..dc............................h(...d...........................f....c............................f&.c.......................H.......8."...#J.H....3j.... C..I.....8.....0c.I...8s.......@...J...>;..q..P.J.J...X.j....`..K..._..(`...p..K...x..........L..a.$..H.....#K.L....3k.....C..M.t.0...^....c.M....s...........;....+_.....K.N.....k.......k7>......_.......O.............. ....h...&....6....F(..Vh..f....g... .(.$.h.(...,...0.(.4.h.8.h\.<...@.).D.i.H&..L6..PF).TV.q.d..\v..`.).d.i.h...l...p.)...`.x..\|......j.&..6.......Vj.f..v.....j.....j....*..j........+...k..&+.q.4...F+..Vk..f...v....+..k..M......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\topNav_right_on[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 400 x 30
Category:	downloaded
Size (bytes):	1921
Entropy (8bit):	7.0224858394229015
Encrypted:	false
SSDEEP:	48:Wtmuhuo9PTbL6Si31MUjY+DGtMEtyAVy0ZU:qoo9P/GSiCUmUCy0ZU
MD5:	B204DED3C2CF7E0E3DB44F5EC1DBDFAA
SHA1:	549BF16B07653F9E5A488B3FD560B4BD0AFE49DA
SHA-256:	38880D3E9BD2E4DAB43EFEA9868106AAF315F6D31FC2AC44E056E0FE11B14A73
SHA-512:	BC29768C8D953C7A98BD0EC788F22B8432A38150FF440AE7FF3FE4A5FD9885AA3DB1603BEB3C96F423A1CC9B0DDDADE40FA4A9980359780FF848435CFD6FE61D
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/navigation/topNav_right_on.gif
Preview:	GIF89a.......>...Q..3f(..3...z..V.!...n.8...Z.;...c..^.....S..u..i..l.5..(.....=..).....3..4.............;......=.<...m.....I.,...y.7..1...4....../.....(v..C..k.2...L..o.....q. ...+......O..L.Z{..;q.f.%...W..........$..-......}..R..].....5g9.........4h.d.#k..w..@..J..R..z..P.+\|..o..5h.q.....7l.k..C.:...{..:..t..^..r.....2.m......j..b.._.&p.-}.0......I....v.8...S..@p.u..\|.....6j.Z.....s..R..H..Q..C..s....%...G.(t.....>..}..6..V.0..3\..~.#...K..].....e..w.....p..h..<..`.....#.-...X......3[.(.....n..................................................................................................................................................................................................................................................................................!.......,...............H......\....#J.H....3j.p...9j..I...(S.\...0c^..B.8s.....,g..J..Q..6t....(zH..@...X.j....`..K...h.].m..~..r....x............D....+^....#.-\|X....bp....RZ...2...S.^....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\track-3f0c180483cb4e78e02f988160e89ee1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	11584
Entropy (8bit):	5.613770365888783
Encrypted:	false
SSDEEP:	192:ey+WAKACn1dWbG6KQOhAWUsBw/2MWOSswqbu2pL92FQJZFjZth2lG4bFDTm8D:h+WAKDn1kGxRKWUsBw/XWgucpB7hMGmN
MD5:	8524641ABA6742C41EF6123887134297
SHA1:	39BA243D45D572DADA4388F65CC0301D514C4DA7
SHA-256:	1F7E8881873FD8D44F90F445A2A0562B623E82BC1550AB2E19DB2E65D21AB72B
SHA-512:	138773B2CEE81BC17D3CDF88B26D13FDF9FB80A56AA4F494E334371A93C4DC0B56A1C2CE642937A2E0DFC1899540E932E0901A87242FDFF389A9FE38BB376F9B
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/7.0/track-3f0c180483cb4e78e02f988160e89ee1.js
Preview:	!function(){var e,n,t;VWO.v_t="7.0.110",e=function(){return VWO&&VWO._&&VWO._.libLoaded},n=function(){!function(){var l={TRACK_PAGE_COOKIE_NAME:"_vwo_p",FUNNEL_EXPIRY:100,INITIAL_PRICING_VERSION:0,FEATURE_BUCKET_INDEX:1,SAMPLING_VERSION_INDEX:2,TRACK_GLOBAL_COOKIE_EXPIRY_STATE_INDEX:3,FUNNEL_INFORMATION_INDEX:2,GOAL_INFORMATION_INDEX:3,ANALYZE_INFORMATION_INDEX:4,CRO_START_TIMESTAMP_INDEX:5,PAGE_ID_INFORMATION_INDEX:1,ANALYSE_SERVER_NAME_INDEX:2,TRACK_PAGE_ID_INFORMATION_INDEX:3};function n(){var e=G.getDataStore();e&&((e=e.split(":"))[l.ANALYZE_INFORMATION_INDEX]=function(e){for(var n=C.getKeys(e),t=n.length,i="";t--;)i+=n[t]+"_"+e[n[t]]+(0===t?"":",");return i}(m.analyze),G.setDataStore(e.join(":")))}VWO._.commonUtil.extend(l,VWO._.CookieEnum);var o,r,_,s,t,I,d,u,E,e,i,c,g,N,O,A,f,a,S,T,p,V,R,C=VWO._.commonUtil,m={analyze:{}},v=0,G={init:function(){var e,n;m.analyze=(n={},(e=G.getDataStore())&&(n=function(e){var n,t,i,a={};if(!e)return a;for(e=e.split(","),v=0;v<e.length;v++)t=(n=e[v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\unnamed[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=1, software=Google], baseline, precision 8, 68x68, frames 3
Category:	downloaded
Size (bytes):	2201
Entropy (8bit):	7.737120837144127
Encrypted:	false
SSDEEP:	48:UINKD9xae1UeJ4lgmAsM/09Z3fOwgvFFV5fgN+PIV:HI2e1UeJQ3/MwAFi+AV
MD5:	C22EB9774FD0FB0D3B7A2962DC125510
SHA1:	E360518005D97BD023FB8AE772093D158BC49F05
SHA-256:	BCDF17EABC07E1B84AAAAC82F5E5F95DD90F03B5FE69156D81D7A4ADF5E35B36
SHA-512:	92FAC4C8E1027F3430A29C88B4059A5E0B1637B804EB0B3F8287AFB6237C1BECF5F140AD3ECF39307F7242B7176F2A91FB03210FF7BACF2B25BD0753BDE11143
Malicious:	false
Reputation:	low
IE Cache URL:	https://yt3.ggpht.com/ytc/AAUvwnjhe7X8ridKlqaCFLwlW80tR5YM8pAqKC_g913JWA=s68-c-k-c0x00ffffff-no-rj
Preview:	......JFIF.............Exif..II.......1...............Google..............................................................................................................................................D.D..........................................,............................!."..2A.#1Q..B.................................2.........................!1A.Qq.."2B..#aCRb.................?..ODM.4D..DM.4D..DM.4D..DM.4D..DM.4D..C..Yb.c..n..!&N<.....y..f.7@.{.-......6mG...ow...?`..g.Z..2.q.=.\.n.8.x$_......>......,vb....>......i"..>..r).+w.....Z.4.:wce.c{{..=.=.....Y.jh..&.."..X.+..!UAgv!@.rX...=.}....%rkK.kE...I./.S.e....h...3.V.G!...(....y.?.u....O...m..wt5.kG..^.si........@...o.x%.<..../a;. ..SC..?.S.....:9k..........x..-%.....2.(.....{....V=.~......F.....\|:F.....di.X...\|W>....p....h.F...S.Y...z.....:1.........e<.b{T..S4..N..>=H.1.:j.wP......;E.T...9.X.Q....J.G..\...O...m.B.....#=.....OF..UrT....^...[=...L0..%=...bZIhn.u.t.....%rx...$.8.......q.x..<@/....7....X.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\webworker[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.8971835531777215
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQKT0Pk/cVjddDuEWaee:PLKdXNQKgP2kjdBNL
MD5:	204F37A5BA6FC05A1EE8D94945D5B535
SHA1:	1A33CFE8FEEC936431B00085DE9ECE4245716435
SHA-256:	0B27095AB468B9D126C5377CFBC5BEF90E6D6E0E2F52C6170CD93342F0A1C824
SHA-512:	463EDEFEEBD06A9DED5FB52701138978465975987026EC240937067EAD3EEF17319491373DA15ED968BB9A7E4CF8CA39ECB363C979D2D4467E26DC489420E55B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=-nejAZ5my6jV0Fbx9re8ChMK
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\www-embed-player[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	160351
Entropy (8bit):	5.572624564104262
Encrypted:	false
SSDEEP:	3072:XF5DR+ZuQgAp2Gb1QTy8hdsmVKlM3i2CwoU0:bRVAIGb10y8hnXy2Cwx0
MD5:	0F3DC438EF530CB61E54ADA338002B69
SHA1:	9220A75CDB7DBE9AF30C6BB1D8CBE360D19C2F41
SHA-256:	4FC0031058A1917BED91878F9DBF98A5427F4DDD57752FD1ADB5A59E00B5B583
SHA-512:	8755817C276F357531034F87C606D6CAA1A51CF221B83F3B4CD83088F29901DC62606CD7AC05DD4F16CD94A62DCDD733CEE59492713BB0455901E4FA54A0A8BE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/c6df6ed7/www-embed-player.vflset/www-embed-player.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var m;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var ea=ca(this);function t(a,b){if(b)a:{for(var c=ea,d=a.split("."),e=0;e<d.length-1;e++){var f=d[e];if(!(f in c))break a;c=c[f]}d=d[d.length-1];e=c[d];f=b(e);f!=e&&null!=f&&ba(c,d,{configurable:!0,writable:!0,value:f})}}.t("Symbol",function(a){function b(e){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c("jscomp_symbol_"+(e\|\|"")+"_"+d++,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\495HIR2B.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	6911
Entropy (8bit):	5.100664215298125
Encrypted:	false
SSDEEP:	96:s7Z7QZAIGH3bpOHNR2Zfr/edevOinf1hpvOin+oMztxJFOtwtKSr5NiCXBB:s2GH90kZz/i4f7doJwsBXj
MD5:	27B9C8A2E53EF3644FBCCF76ABA688DE
SHA1:	A3B5C9E42C8BA070ECE48E32117D3513D9EC54AC
SHA-256:	C86BE8FA67CDBD0DD425132F2D47BF4CC43692FBB4F249CFACF2C8D979280E1F
SHA-512:	CB227A37D6567F01401AB82E635738F785CC45B158B4F63B917A66739B659B68F70CF383E670DAA854A044FB6D261D67D8FA021C255C385250E3031F05D0FF28
Malicious:	false
Reputation:	low
IE Cache URL:	http://www.efax.ch/
Preview:	....<!doctype html>....<html xmlns="http://www.w3.org/1999/xhtml">..<head><title>...eFax. . Faxen ohne Faxger.t. Faxe online senden und empfangen - Kein Faxger.t ben.tigt...</title><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no" /><meta name="robots" content="noindex,nofollow,noarchive,noodp,noydir,nosnippet" /><link href="App_Themes/Main/master.css" rel="stylesheet" type="text/css" /><link href="http://efax.co.uk/s/r/images/favicon/16x16.ico" rel="shortcut icon" />.. <script src="//code.jquery.com/jquery-1.12.3.min.js" integrity="sha256-aaODHAgvwQW1bFOGXMeX+pC4PZIPsvn2h1sArYOhgXQ=" crossorigin="anonymous"></script>.. <script type="text/javascript" src="//cdn.jsdelivr.net/jquery.ajax.unobtrusive/3.2.4/jquery.unobtrusive-ajax.min.js"></script>.. <link rel="stylesheet" type="text/css" href="//cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css" />.. .. <script type="text/javascript">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\A6XcjPjIWOUTTCmmuWun8yBJvHN-mO8hzGK9s0v6k6M[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	22159
Entropy (8bit):	5.492571983314078
Encrypted:	false
SSDEEP:	384:kZ5yEN+P20VhzsRoA9v18IsFD1P2AlTdSPwy7LsrFBZnOVdiY2R0o3AXAawiZkEo:u5ym+u0VhYbv18FFD1P2AlxkwiLsrTYY
MD5:	DAA833E8487B22E6072DE0FE2C64AD45
SHA1:	EE8E34DBF50D4B385DAB8A2EB04433E76D2B49AE
SHA-256:	03A5DC8CF8C858E5134C29A6B96BA7F32049BC737E98EF21CC62BDB34BFA93A3
SHA-512:	28F1B21887B8F8392288D039EADD10056512CA0DFF510DF80950BB6BF489FFBB287BC0705A82CA598C909AF564511F0887D69BA1DF7AFD626B3CDA85E7F21942
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/js/bg/A6XcjPjIWOUTTCmmuWun8yBJvHN-mO8hzGK9s0v6k6M.js
Preview:	(function(){var Q=function(t,h){if(h=(t=null,T).trustedTypes,!h\|\|!h.createPolicy)return t;try{t=h.createPolicy("bg",{createHTML:r,createScript:r,createScriptURL:r})}catch(n){T.console&&T.console.error(n.message)}return t},r=function(t){return t},T=this\|\|self;(0,eval)(function(t,h){return(h=Q())&&1===t.eval(h.createScript("1"))?function(n){return h.createScript(n)}:function(n){return""+n}}(T)(Array(7824*Math.random()\|0).join("\n")+'(function(){var tL=function(t){for(t=0;64>t;++t)F[t]="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".charAt(t),d["ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789-_".charAt(t)]=t;d[d[F[64]="","+"]=62,d["/"]=63,"="]=64},hL=function(t,n){if(!(t=(n=null,g).trustedTypes,t)\|\|!t.createPolicy)return n;try{n=t.createPolicy("bg",{createHTML:f,createScript:f,createScriptURL:f})}catch(h){g.console&&g.console.error(h.message)}return n},d={},M,F={},y=function(t,n){return"object"==(n=typeof t,n)&&null!=t\|\|"function"==n},nn=function(t){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOjCnqEu92Fr1Mu51S7ACc6CsI[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 21564, version 1.1
Category:	downloaded
Size (bytes):	21564
Entropy (8bit):	7.9688026243536
Encrypted:	false
SSDEEP:	384:bc6bX9TFqgFUvxQi0W1jHYHwnSthN/yiJsMw52R5oBAvhPFx466gfwu5:bcCV4aUlxHSw8ZyixnFP3N6U5
MD5:	FFCC050B2D92D4B14A4FCB527EE0BCC8
SHA1:	DE3033F27DB6BBDA89A0E6F16EC51E8C877739AB
SHA-256:	C8912EBD82B4DF2EB87E37B1F66432FA2186182E08BB8A533BA4C2DF6CE67FBA
SHA-512:	7D517BB33DE3D088B8EE4EC9250AB1645CF76B35B25F57C004BF82B5A9A30C15252C865765EFFD4679A68ACDF6EFB89E4B0319283914880935D8D1AC823FE652
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOjCnqEu92Fr1Mu51S7ACc6CsI.woff
Preview:	wOFF......T<................................GDEF.......G...d....GPOS................GSUB............7b..OS/2.......Q...`t.#ycmap...4.......L....cvt .......\...\1..Mfpgm...@...2......$.gasp...t............glyf......@...p.N..Hhdmx..M(...f........head..M....6...6...vhhea..M...."...$....hmtx..M....k......3.loca..PX........G.*"maxp..R4... ... ....name..RT........!.>gpost..S0....... .a.dprep..SH.......X9..x...1..P......PB..U.=l.@..B)..w.......Y.e.u.m.C.s...x.h.~R....R.....2.x...pfK.G...1.c>..`9..m<+;..m.x...bg.M.T...O............l...XU.../{.[_..W....c.._..72.. ." z.+..F.......&.&...`e..T].....K=..K2S....q..d...xf.$~i..$?.d..dU.....@R-/LMO-J6...[]..Z..O.C_."If..d....fS....$d.G>eL`....Tf1.......9.c>..`1.TR..x./d-........q.........7....{...v.....!.....1.QG=.4.D3-..F;=..1'.'q.rw...9..e!.....Q....f......qV.n.h.V.Z]..B..C.[B...V.......v...o.w.{...w..zRO.i=..._.....-.m....].=...[...(1.(.#.....O0/.0?..04rL.G.9.....i6..l..\|.(o.....\|$,..{\|&\|....YJ...x.e8B.#..t;R8.{+....\=.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto BlackRegularVersion 2.137; 2017Roboto-Bla
Category:	downloaded
Size (bytes):	35208
Entropy (8bit):	6.392518822467014
Encrypted:	false
SSDEEP:	768:53Dmu13ucOmpIN22bN8o6Ze0XlGV+uM49pSeCu7XniviDffw6mo/quUR:lD13DjSNz0XlG0uL9YeCu7Xn4iTo9o/4
MD5:	4D99B85FA964307056C1410F78F51439
SHA1:	F8E30A1A61011F1EE42435D7E18BA7E21D4EE894
SHA-256:	01027695832F4A3850663C9E798EB03EADFD1462D0B76E7C5AC6465D2D77DBD0
SHA-512:	13D93544B16453FE9AC9FC025C3D4320C1C83A2ECA4CD01132CE5C68B12E150BC7D96341F10CBAA2777526CF72B2CA0CD64458B3DF1875A184BBB907C5E3D731
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf
Preview:	........... GDEF......z\...dGPOS......z.....GSUB7b..........OS/2ve#...p....`cmap......r....Lcvt ...=..xX...Zfpgm..#...ud....gasp......zP....glyf.......,..i~hdmx......q ....head...R..l....6hhea.]....p....$hmtx..<...l.....locaK./...j.....maxp......j.... name..9...x....\|post.m.d..z0... prep...C..w ...8...d...(.............P...EX../....>Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^....g...........<......9.........EX../....>Y..EX../....>Y.....+X!...Y..../01.!.!.462..."&....+.g..k.kk.k......J__.__.......^.......&......9........./......9../........01..#.3..#.3.+..._+...v.S.8..S.8.......z.......... !..9.........EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#53.#53.3.3.3.3.!.3.!.#.3.#.d.C.C..,..E.D.E.E...,...C.@.,....f.........`...`.....f.Q......S.&.Q...-.r.+./..9...EX../....>Y..EX.!/..!.>Y..!...9........!..9......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\KFOmCnqEu92Fr1Mu4mxP[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-Regularht
Category:	downloaded
Size (bytes):	35408
Entropy (8bit):	6.412277939913633
Encrypted:	false
SSDEEP:	768:PX4i+tezjtQYgu30G0xL9nQbuEL7LQo9SBxQbptqKmomjJlvh:PJ2z3G0xpUusLEBKptqNomjV
MD5:	372D0CC3288FE8E97DF49742BAEFCE90
SHA1:	754D9EAA4A009C42E8D6D40C632A1DAD6D44EC21
SHA-256:	466989FD178CA6ED13641893B7003E5D6EC36E42C2A816DEE71F87B775EA097F
SHA-512:	8447BC59795B16877974CD77C52729F6FF08A1E741F68FF445C087ECC09C8C4822B83E8907D156A00BE81CB2C0259081926E758C12B3AEA023AC574E4A6C9885
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf
Preview:	........... GDEF......{`...dGPOS...h..{.....GSUB7b..........OS/2tq#...q....`cmap......s....Lcvt +.....yl...Tfpgmw.`...vd....gasp......{T....glyf.......,..j.hdmx......r ....head.j.z..m....6hhea......q....$hmtx..Vl..m.....loca?.#...k.....maxp......k.... name.U9...y....tpost.m.d..{4... prep.f....x ...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ScriptResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	downloaded
Size (bytes):	97406
Entropy (8bit):	5.3740575813564515
Encrypted:	false
SSDEEP:	1536:BYE1JVoiB9JqZdXXe2pD3PgoIK6alrUdTJbFk/zkZ4HWLZoHsrOa99TwkEb7/Hph:E4KZ+u3WLZICOaLTwkE7qD1Pa7a98Hrn
MD5:	A2BD669B2A735F301C495F8AE17567BB
SHA1:	45533CBD969227BD880D90049B02663750ACF5CA
SHA-256:	5F82E40681C384AEF67F1F639E6D51E56622F1A631A0DE303C768F498F1B4A4C
SHA-512:	259A7541A982D5BE4776C75B80BB9C056C9E9F3FBEEB75C49A3ADC1AD8D8D9DFD13CD755E492F4F9CA812ACAF62B4CF7E9F0D769B1F2EC2D59D9E7FDA5995349
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/ScriptResource.axd?d=uBiLKmMIzkaavHlylMEgvpQORDQ2SNa2NgznHTN-ZdO4W9qgezU_rbz94YBPSzW7Vi1OhXITQgij0R_gvKGZUyxhLDi68S-jNje-xUQ_T24k7KJa-x3cEBc5DiFrnsqy9f9zlYFQrQxHUZh3vX5962pXirZS0AchtlVbcLwckqXRGHqq0&t=ffffffffb5160496
Preview:	./! jQuery v1.12.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.1",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\Telerik.Web.UI.WebResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	143803
Entropy (8bit):	5.329628105362575
Encrypted:	false
SSDEEP:	1536:4GLiogSomRYvoGtT+KHsVS0bT79DSsi46j/LPyR7k4d2YB4Hy7mT4aVt0SrMUTd:4GLXGFKT79DSs6WFMM8CSZTd
MD5:	8A057AFB90D49F609F7DB64D9AEFCA61
SHA1:	1051E4544BD8619D13D7401EE5D83E00D9958F9C
SHA-256:	A754BFA018E63D7F10DEC7A1C968DCA11CA01B213C2B710A86FC8C1283CE78DE
SHA-512:	3D43CD0F1264ABAB756613AE99C2A7800BDD9E6AAF5B8E2B4F1C01BA8DCD69355B4EA081DACE835CED74DA9D2590692EACFE65D94595F11F3F041204B7939C55
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Telerik.Web.UI.WebResource.axd?_TSM_HiddenField_=ctl09_TSM&compress=0&_TSM_CombinedScripts_=%3b%3bSystem.Web.Extensions%2c+Version%3d4.0.0.0%2c+Culture%3dneutral%2c+PublicKeyToken%3d31bf3856ad364e35%3aen%3a2d39c544-8ec0-4a2c-bc21-04e23af02570%3aea597d4b%3ab25378d2
Preview:	/* START MicrosoftAjax.js */..//----------------------------------------------------------..// Copyright (C) Microsoft Corporation. All rights reserved...//----------------------------------------------------------..// MicrosoftAjax.js..Function.__typeName="Function";Function.__class=true;Function.createCallback=function(b,a){return function(){var e=arguments.length;if(e>0){var d=[];for(var c=0;c<e;c++)d[c]=arguments[c];d[e]=a;return b.apply(this,d)}return b.call(this,a)}};Function.createDelegate=function(a,b){return function(){return b.apply(a,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Function.validateParameters=function(c,b,a){return Function._validateParams(c,b,a)};Function._validateParams=function(g,e,c){var a,d=e.length;c=c\|\|typeof c==="undefined";a=Function._validateParameterCount(g,e,c);if(a){a.popStackFrame();return a}for(var b=0,i=g.length;b<i;b++){var f=e[Math.min(b,d-1)],h=f.name;if(f.parameterArray)h+="["+(b-d+1)+"]";else if(!c&&b>=d)break;a=Func

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\alertRedStopMedium[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 18 x 19
Category:	downloaded
Size (bytes):	592
Entropy (8bit):	5.835425555553921
Encrypted:	false
SSDEEP:	12:/RcwK8ae5arQgOAOvath6njAge/Y6+Uc5kz:aUeWn8geIy
MD5:	79CC5BF05AAA4658C5632D6A2DFA4B16
SHA1:	45837EC81EFB555B6B1B6FDDC69A03DFABEED88A
SHA-256:	F91A39E3664D7FB803D8F8834ED67BC18E00CA6F189992F1EA892CF326726519
SHA-512:	5B25F8D40784E12D89EDD2A26C58561B42A50A8C5EE3025DC85C6DFD26489069B7B7540C385AC0CC90619C9514B1EC1B299B621F970D84323FA9E0A2B63BDAB7
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/alertRedStopMedium.gif
Preview:	GIF89a..................c.......g..l...........K2.V<.YA.U>._G.XA.]G.bL.rY.}b.pY.za.oY..j..s.n.k..t..}.............N8.s\.u_.s_.}h.{............]K.iV.lY.bQ.p_.v..eW.\|o.\|.....]Q.bU.fZ.\|.....................................................................................................................................................................................!.....D.,............D...............#.......))..!...... ...+........*(.#................&.++......'.&335>..&..''$.32.>..."!.&".8.:74.0(..3.@.-4...6.p....G....E..bG. B.6HD...=x..H...%&.XD...@.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	47051
Entropy (8bit):	5.516264124030958
Encrypted:	false
SSDEEP:	768:ryOveCSBZfsnt5XqY/yPndFTkoWY3SoavqVy2rlebYUDTJC6g0stZm:ryJNDfs5hYdFTwY3SorSg0su
MD5:	53EE95B384D866E8692BB1AEF923B763
SHA1:	A82812B87B667D32A8E51514C578A5175EDD94B4
SHA-256:	E441C3E2771625BA05630AB464275136A82C99650EE2145CA5AA9853BEDEB01B
SHA-512:	C1F98A09A102BB1E87BFDF825A725B0E2CC1DBEDB613D1BD9E8FD9D8FD8B145104D5F4CACA44D96DB14AC20F2F51B4C653278BFC87556E7F00E48A5FA6231FAD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var l=this\|\|self,m=function(a,b){a=a.split(".");var c=l;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},r=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var t=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var u=window,v=document,w=function(a,b){v.addEventListener?v.addEventListener(a,b,!1):v.attachEvent&&v.attachEvent("on"+a,b)};var x={},y=function(){x.TAGGING=x.TAGGING\|\|[];x.TAGGING[1]=!0};var z=/:[0-9]+$/,A=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},D=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\anchor[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	28052
Entropy (8bit):	5.948410697546235
Encrypted:	false
SSDEEP:	768:3/ShEusC8X0N1vlSm+Hafr/ShcT0bhF+42OnV/kbfcxSe:gE/21t8DcT0tF4Asrcwe
MD5:	AA7B31ABDDFC1F0F6E2FE2CFC8F64229
SHA1:	9B3C4778493AD13C88736F0F556FCACA458612EC
SHA-256:	DD0E8694EE48477418D1682DFBF6A16436F579A3DB55C94598EF0407949901B4
SHA-512:	7D7666BA75FCC7F82B94576385D99286340217C16CC594E49F1AAAF90FEA56C673AA9175900343829CEBCF4611F33D231A5DF7A96D639877B4D0233848468BB4
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<style type="text/css">.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 500;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 900;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf) format('truetype');.}..</style>.<link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/styles__ltr.css" nonce="wT8qdhMOBLt2KvyyACUq2w">.<script nonce="wT8qdhMOBLt2KvyyACUq2w" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\apple-store[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 128 x 43, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5615
Entropy (8bit):	7.869927034715224
Encrypted:	false
SSDEEP:	96:t2vHaSN/Nm5e0WAQM+xLKgs67j/p9NwB0Yl7Bj4vg7iHtGBkm752:e4iAqJ39weYltEIWXmc
MD5:	8369E4514D8D6D10B8111C6D8C0497F4
SHA1:	F7444A78396668487013B3C3519C11EC96000450
SHA-256:	A936DA8D013D2DB5F4A2806D91B60A444FD1BD9D46F69D43D66E91BDEA4C27FE
SHA-512:	FB25A36D2743028B69969B2BC0BFAB2FC1AB93CD9C8E4D17B4743FB296BBDCC6C40A41FA10873D142FA06928224E29795518CA26E5D8B3FB7839A03816ED8401
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/mobile-app/apple-store.png?sfvrsn=dddc82b5_0
Preview:	.PNG........IHDR.......+............tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:DD91D411196F11E48343B359C31CB1ED" xmpMM:DocumentID="xmp.did:DD91D412196F11E48343B359C31CB1ED"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DD91D40F196F11E48343B359C31CB1ED" stRef:documentID="xmp.did:DD91D410196F11E48343B359C31CB1ED"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..;%...cIDATx..\.t.U.~...BKB.R.(..... (?..(..aE.T..r@..aAE.(..+v9.*M...R$.".`@j ...ww.....f..H......y.~..f.cF.5yyy.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	dropped
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Reputation:	low
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bat[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	28050
Entropy (8bit):	5.310811127038129
Encrypted:	false
SSDEEP:	384:otUVCwh9wC22xo1nB4KZjhbwM05Jkr9qNHfs9nB/wDSliNqCET8zT7QAEqny7YOI:pCwhBRHDOZwDhzT7QSnKYO56
MD5:	F07693F6368C988ACD20DE4362479103
SHA1:	D04355E119FAC2C9104C4FE98015E22F3F181D93
SHA-256:	4DD6C09DDCB0E53A6290CC1DF35224856073BA5F89D4134BD7C69E4FD9C6F515
SHA-512:	1A0BD6850F3E7744216FA133493FA0D686EBB815B23ED2F2F511CEA982FC79794D882EDCE8DCB22670E455B94BA7EF2FE6EFC7E95710DD3243CBF54E65449A66
Malicious:	false
Reputation:	low
IE Cache URL:	https://bat.bing.com/bat.js
Preview:	function UET(o){this.stringExists=function(n){return n&&n.length>0};this.domain="bat.bing.com";this.URLLENGTHLIMIT=4096;this.pageLoadEvt="pageLoad";this.customEvt="custom";this.pageViewEvt="page_view";o.Ver=o.Ver!==undefined&&(o.Ver==="1"\|\|o.Ver===1)?1:2;this.uetConfig={};this.beaconParams={};this.supportsCORS=this.supportsXDR=!1;this.paramValidations={string_currency:{type:"regex",regex:/^[a-zA-Z]{3}$/,error:"{p} value must be ISO standard currency code"},number:{type:"num",digits:3,max:999999999999},integer:{type:"num",digits:0,max:999999999999},hct_los:{type:"num",digits:0,max:30},date:{type:"regex",regex:/^\d{4}-\d{2}-\d{2}$/,error:"{p} value must be in YYYY-MM-DD date format"},"enum":{type:"enum",error:"{p} value must be one of the allowed values"},array:{type:"array",error:"{p} must be an array with 1+ elements"}};this.knownParams={event_action:{beacon:"ea"},event_category:{beacon:"ec"},event_label:{beacon:"el"},event_value:{type:"number",beacon:"ev"},page_title:{},page_location:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	39680
Entropy (8bit):	5.134609532741171
Encrypted:	false
SSDEEP:	768:up/wtev6UwUx0eWN3MebE9rQuFfU8Vt0azWcsi1m3K0rmq5YW:NorXfURXiUrmq5YW
MD5:	2F34B630FFE30BA2FF2B91E3F3C322A1
SHA1:	B16FD8226BD6BFB08E568F1B1D0A21D60247CEFB
SHA-256:	9EE2FCFF6709E4D0D24B09CA0FC56AADE12B4961ED9C43FD13B03248BFB57AFE
SHA-512:	A014E9ACC78D10A0A7A9FBAA29DEAC6EF17398542D9574B77B40BF446155D210FA43384757E3837DA41B025998EBFAB4B9B6F094033F9C226392B800DF068BCE
Malicious:	false
Reputation:	low
IE Cache URL:	https://stackpath.bootstrapcdn.com/bootstrap/3.4.1/js/bootstrap.min.js
Preview:	/!. Bootstrap v3.4.1 (https://getbootstrap.com/). * Copyright 2011-2019 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");!function(t){"use strict";var e=jQuery.fn.jquery.split(" ")[0].split(".");if(e[0]<2&&e[1]<9\|\|1==e[0]&&9==e[1]&&e[2]<1\|\|3<e[0])throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(),function(n){"use strict";n.fn.emulateTransitionEnd=function(t){var e=!1,i=this;n(this).one("bsTransitionEnd",function(){e=!0});return setTimeout(function(){e\|\|n(i).trigger(n.support.transition.end)},t),this},n(function(){n.support.transition=function o(){var t=document.createElement("bootstrap"),e={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var i in e)if(t.style[i]!==undefined)return{end:e[i]};return!1}(),n.support.transition&&(n.event.specia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cookieconsent.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3938
Entropy (8bit):	4.810660944554395
Encrypted:	false
SSDEEP:	48:u00LI2I/YPuYLOWjQ0cN7xjXndM78JtdnJZtTJwIjDPZw4zK4cg64cAK4cgD4cp:5kRWYbOiGdTt7ZflBHRaq
MD5:	4AFFDA653D65484BF6983822FA6ADB23
SHA1:	225DF1E9345D47CF62A552B7E6720BE1E759B49B
SHA-256:	456AB1A71507ED91ABAE14C9D08FAFFB373A7BC711A66E44341B7B8B7BB72AB4
SHA-512:	B099A8733858188D4E901DF45B4C8243DD64AAD621B1035A552BC5FC58DAE2F23A91FF06C4A517F7E44D17B3CB9667773F9E8C15081EE907FDF10FA3EA218E5B
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.css
Preview:	.cc-window{opacity:1;transition:opacity 1s ease}.cc-window.cc-invisible{opacity:0}.cc-animate.cc-revoke{transition:transform 1s ease}.cc-animate.cc-revoke.cc-top{transform:translateY(-2em)}.cc-animate.cc-revoke.cc-bottom{transform:translateY(2em)}.cc-animate.cc-revoke.cc-active.cc-bottom,.cc-animate.cc-revoke.cc-active.cc-top,.cc-revoke:hover{transform:translateY(0)}.cc-grower{max-height:0;overflow:hidden;transition:max-height 1s}..cc-link,.cc-revoke:hover{text-decoration:underline}.cc-revoke,.cc-window{position:fixed;overflow:hidden;box-sizing:border-box;font-family:Helvetica,Calibri,Arial,sans-serif;font-size:16px;line-height:1.5em;display:-ms-flexbox;display:flex;-ms-flex-wrap:nowrap;flex-wrap:nowrap;z-index:9999}.cc-window.cc-static{position:static}.cc-window.cc-floating{padding:2em;max-width:24em;-ms-flex-direction:column;flex-direction:column}.cc-window.cc-banner{padding:1em 1.8em;width:100%;-ms-flex-direction:row;flex-direction:row}.cc-revoke{padding:.5em}.cc-header{font-size:18

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\cookieconsent.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	19802
Entropy (8bit):	5.21863639193455
Encrypted:	false
SSDEEP:	384:sne5yGafGZwprGryKfxNQUDIg7jmhILuWFRv0eVdHPyZ7fxS0QoyZ+2mRwjO0dpJ:sGaf6wZKLzdLueRv0zZ7fxSlcRA5dQfY
MD5:	F2BC0804920974CDB94FECA2936B668C
SHA1:	253B288316EE7BB62B0BC755D7834B14B265F18C
SHA-256:	AF4C6683814AA527CAF53BDE3D021E6AAFE00833B45F2DEAD043C87ED7864674
SHA-512:	08ED1DF4DDE697A224F0FDE61B2EA3D56C792969D6CF29D06E244969984CDF614FF7D2919D3ECEFA134D1869EE564B718DE605539C67F4A7DBEDCD77DB09DB2B
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/cookieconsent2/3.0.3/cookieconsent.min.js
Preview:	!function(e){if(!e.hasInitialised){var t={escapeRegExp:function(e){return e.replace(/[\-\[\]\/\{\}\\+\?\.\\\^\$\\|]/g,"\\$&")},hasClass:function(e,t){var i=" ";return 1===e.nodeType&&(i+e.className+i).replace(/[\n\t]/g,i).indexOf(i+t+i)>=0},addClass:function(e,t){e.className+=" "+t},removeClass:function(e,t){var i=new RegExp("\\b"+this.escapeRegExp(t)+"\\b");e.className=e.className.replace(i,"")},interpolateString:function(e,t){var i=/{{([a-z][a-z0-9\-_])}}/gi;return e.replace(i,function(e){return t(arguments[1])\|\|""})},getCookie:function(e){var t="; "+document.cookie,i=t.split("; "+e+"=");return 2!=i.length?void 0:i.pop().split(";").shift()},setCookie:function(e,t,i,n,o){var s=new Date;s.setDate(s.getDate()+(i\|\|365));var r=[e+"="+t,"expires="+s.toUTCString(),"path="+(o\|\|"/")];n&&r.push("domain="+n),document.cookie=r.join(";")},deepExtend:function(e,t){for(var i in t)t.hasOwnProperty(i)&&(i in e&&this.isPlainObject(e[i])&&this.isPlainObject(t[i])?this.deepExtend(e[i],t[i]):e[i]=t[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\download_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	16256
Entropy (8bit):	6.773871636823615
Encrypted:	false
SSDEEP:	384:CTiJ6Dn5l2FbgqQQxCpEOzZzEQ3UZvp7WXwusbm:Gn5MFbgLpEO9P3UZh7Wgbm
MD5:	B6456D1673052A5603C936CAC659353C
SHA1:	9737D39E50BBB4A54946B73FD8D97692C32B2BB4
SHA-256:	C594B3E53539997D7DDCE9ACF98DBBE8D1EA9A15860763B38A1FA881F18F070B
SHA-512:	BAD133206C2A6E8BB55FBA83FC070CB65649E27064843C7178EE37BE9B8E0A34A4849510B18A5EECCADAA5B76201059CD43F6ED326DE3354588D91667D373F8A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/download_1024.png?sfvrsn=ebd990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:B00C371CF9D811E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:B00C371DF9D811E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:B00C371AF9D811E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:B00C371BF9D811E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..F...;.IDATx......./.t.UwC..B.t..]....5....f.j"..p4*q.Q.&.4....ihB..J.C...r.J.U.....>.)..{]..Y.....<......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\efax-help-center[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	61914
Entropy (8bit):	5.429809719800965
Encrypted:	false
SSDEEP:	768:WELzeqDAFSFy6F1sKwrRom19ctxuscgE6M/jjYONF/YN8tsDGZN:WELzeXs46bsb/CusNMrjxNtYN8tJ
MD5:	27C78D5FFF529C9C01483476DFF1186D
SHA1:	F9304FB46B07211BA2E628E9FEE57E6907FD91D0
SHA-256:	5B840CB03971C96973984998301E59E810C0117009B4910C280584124228EE75
SHA-512:	8020DAC4B73BD3EA7160B7EF8CAEC3A1179D70D0B643C77BAEFC055D58BD41D787247FC0C30E3A71E06B6DDE5A34D90EE1CF734C7B6A3B852E155ADCF7E58116
Malicious:	false
Reputation:	low
Preview:	....<!DOCTYPE HTML>..<meta http-equiv="X-UA-Compatible" content="IE=edge">..<html>.. [if IE 6]> <html class="ie6"> <![endif]-->.. [if IE 7]> <html class="ie7"> <![endif]-->.. [if IE 8]> <html class="ie8"> <![endif]-->.. [if IE 9]> <html class="ie9"> <![endif]-->..<head id="head1">.. <script>.... //Start Visual Website Optimizer Asynchronous Code .. var _vwo_code = (function () {.. var account_id = 232379,.. settings_tolerance = 2000,.. library_tolerance = 2500,.. use_existing_jquery = false,.. /* DO NOT EDIT BELOW THIS LINE */.. f = false, d = document; return { use_existing_jquery: function () { return use_existing_jquery; }, library_tolerance: function () { return library_tolerance; }, finish: function () { if (!f) { f = true; var a = d.getElementById('_vis_opt_path_hides'); if (a) a.parentNode.removeChild(a); } }, finished: function () { return f; }, load: function (a) { var b = d.createEl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\enhanced_mobility_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11474
Entropy (8bit):	5.801974659454922
Encrypted:	false
SSDEEP:	96:nf2pejzywidDPLkvpdlPNyWSqaJ920AfVKxnBMKEKprw5sTq2bzKqxuijVf7gy:wejzodcvflmqhUxTzrw58HfKWZ3
MD5:	6E1F5EA031A5CDAFD1CC7777C20E23CB
SHA1:	A990F9BBE952CA23D00E7224C4B4076D7F00B89F
SHA-256:	D91E868921CAA1BB6B0E076E33715D9475E6A537BC55FACE5BE7790C350B83E5
SHA-512:	BF5383354BE331A1E8CAA0C540186FA52EFE6A517C2E1F5ECB4533B877B6E3804798493F79AA2666018355A579239C5082C084CBEB6BB452646123ACEA9A98A9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/enhanced_mobility_1024.png?sfvrsn=e9d990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:C56BF4C7F9D811E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:C56BF4C8F9D811E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C56BF4C5F9D811E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:C56BF4C6F9D811E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.;....)@IDATx......e}..*....m..V....D.q..0...&6......<c....1FI.Q<d....E\....."".,.fPP6.......=.KU"i....{.....9.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Reputation:	low
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\fax-by-mail-three[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 298 x 183, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11067
Entropy (8bit):	7.948608398892242
Encrypted:	false
SSDEEP:	192:gYShILho/8Be/liEIORvqQlrzAXOcWauRtnw6QjGtNtBVslOZt04E:g/I1o/ke/IEvRvjYKaEw6QKHtAlOM
MD5:	6CFE1393DA08EFB107E31B8292421009
SHA1:	0740245E0D0553E11F22265A634E2B98DF9A6815
SHA-256:	7C7B21DCE7D166CCEE4018B0659299C555E3CF3C0BA367D96AB06FA4D81B189E
SHA-512:	6644AA646B6A1C3376441A348E9EB8B948B03676F362D20FAD9ED70C909D6C2D193AA794431D1A790F05FB53F63686F909493E81E6FB4224A8DCBD4B7BBE6913
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/fax-by-mail-three.png?sfvrsn=2
Preview:	.PNG........IHDR...*.................tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c061 64.140949, 2010/12/07-10:57:01 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5.1 Windows" xmpMM:InstanceID="xmp.iid:4614C85F066C11E4B7D5D0957E4ACFB9" xmpMM:DocumentID="xmp.did:4614C860066C11E4B7D5D0957E4ACFB9"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:4614C85D066C11E4B7D5D0957E4ACFB9" stRef:documentID="xmp.did:4614C85E066C11E4B7D5D0957E4ACFB9"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>WR...'.IDATx..{..g..K...=.;.8K.......O8.h....T....511...Dc.....@...a"kb...hRl./l.MJ.... ....V..ki...3..;.9;sf....&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\fetch-polyfill[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Pascal source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8543
Entropy (8bit):	5.238064281324506
Encrypted:	false
SSDEEP:	192:oQHdiEslZc0rsNYNU5mSJHqI03aej6tZoaMLQO/x5/P80+HcW:ocHslLsP5muHqI0Jj6tZcUO/x5+V
MD5:	04E3CC8A9641B3F9F9C9370F4E9B5BDD
SHA1:	9602A891F583094BB04FD407B253ABCAFFB8C8D0
SHA-256:	DE6C4FFA2BD9FD283610E28D0DB2EC48607AAB39D213A51AEF248673A0A7E980
SHA-512:	58942BCC0F39D620A475B65C1AEB4F18872F68F22C89DEC076906A0DB8BC2B7CCA9357710A7824A0FA7404FF73F41013AECA34609CAACD2187414F7BD0D490D6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/yts/jsbin/fetch-polyfill-vfl6MZH8P/fetch-polyfill.js
Preview:	/*.. Copyright (c) 2014-2016 GitHub, Inc... Permission is hereby granted, free of charge, to any person obtaining. a copy of this software and associated documentation files (the. "Software"), to deal in the Software without restriction, including. without limitation the rights to use, copy, modify, merge, publish,. distribute, sublicense, and/or sell copies of the Software, and to. permit persons to whom the Software is furnished to do so, subject to. the following conditions:.. The above copyright notice and this permission notice shall be. included in all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND,. EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF. MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND. NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE. LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION. OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\formValidateUtil[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	33146
Entropy (8bit):	4.647274014935184
Encrypted:	false
SSDEEP:	384:9LzMOuh8KKkh8KMc+dTRNPaMffcoW+M41mlyh+rMVpbpqRpAXKuUGbrLmnEKLmC2:2FKkS1LNyMLWVSVpbpqRpAaUbAv+
MD5:	5A09BAA812DD3FDDD321F9480C741F51
SHA1:	E7330206513130502406D5D9EB729FDBE537877B
SHA-256:	7F2C1420299F52603705C1C55B82C4954AD3E3D0EB7392ABE6BD4FAFC303445B
SHA-512:	54EF4F2ABE9A0B83B1D7F7E539B1A42EAA8EBA1A5425EFA7C7DB1231849DEAFD9A59365AD416AEBE2076488822F7BA1BCAC85123ABF374416494734D5D6DA829
Malicious:	false
Reputation:	low
Preview:	//console.log("formValidateUtil.js");..var ERROR_MESSAGE_ATTRIBUTE = "errMsg";.var ERROR_DIV_ID = "myErrorDivShimId";.var TOOL_TIP_TEXT_ID = "tool-tip-text";.var TOOL_TIP_ERROR_ID = "tool-tip-error";.var INVALID_CLASS = "invalid";.var ERROR_ICON_SUFFIX = "_errIcon";.var ERROR_MESSAGES_SUFFIX = "_errorMessages";.var RequiredErrorMessage = "This Field is Required";.var RequiredFieldMessage = "Field is required";.var EmailErrorMessage = "Invalid Email Format";.var COUNTRIES_WITH_ZIPS = [ 'AU', 'FR', 'DE', 'IT', 'ES', 'NL', 'BE', 'CH',. 'AT', 'BR', 'FI', 'DK', 'SE', 'NO', 'PT', 'KR', 'JP', 'LU', 'MX', 'CA',. 'US', 'UK' ];.var FLAG = 0;.var CORPORATE_BRANDNAME = "CORPORATE";.var profileEmailFormId = "form_profileEmail";..$.ajaxSetup({. error : function(jqXHR) {. handleAjaxError(jqXHR). }.});.if (typeof Ext != 'undefined' && typeof Ext.Ajax != 'undefined') {. Ext.Ajax.on('requestexception', function(conn, response, options) {. handleAjaxError(response).

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\glyphicons-halflings-regular[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), GLYPHICONS Halflings family
Category:	downloaded
Size (bytes):	20290
Entropy (8bit):	7.9554180151440725
Encrypted:	false
SSDEEP:	384:gumnAT02l28xe2OL4k+OeF3ThkM2T8jD48fY4IBUT:lmnAJlHxeXL4ZOC3ThkM2T8fJf+M
MD5:	AA16CD35628E6DDDF56E766C9AA4AE63
SHA1:	23799C0AA7B60FB1A66993D024F98AC105E74E93
SHA-256:	62FCBC4796F99217282F30C654764F572D9BFD9DF7DE9CE1E37922FA3CAF8124
SHA-512:	FBD276579BC548EB02B5D097F95A30B92EF8EB8480FBECD0D33348647B4BEFCE3242B42BAD7CDA96729EB9D1AE34CF7D544F61A14787BCFEBAEA9631DEE83903
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Content/fonts/glyphicons-halflings-regular.eot?
Preview:	BO...M............................LP.........................X....................(.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s.....R.e.g.u.l.a.r...x.V.e.r.s.i.o.n. .1...0.0.1.;.P.S. .0.0.1...0.0.1.;.h.o.t.c.o.n.v. .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.8.3.2.9...8.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s. .R.e.g.u.l.a.r.....BSGP..................v..5O.5U.-R....`.W.hKqJ.x"U:r,/.4\.....li........E.LFM.....V(g.W..6...V.`.m._.fZ.}..~....H....i%.[Dd..."w...z.,....bA..i....+2....8...,....B.IP.fI..I....+...w..3.-...b..b....\..f.0...g..-.}..P1.'...=....n}@..@....r..U.........+(,..Ug.c..1..w..L..9....n.`...Gv..!..(..\S..JT.s.3d.&ru.N...].}.Lq...4...5.W..e.o.@7.@....`.m`..6...P.p\.qf.3h.<@A...U&Q....]X.%i.,.g..!R.B.a/2...2!y3...tM....E...zE.2....p.E...`..2.).;.B....h.P...}.].jE..+I.(L...=..s..Vs..X.N..:......e..Oo.....[.......P6.R...6<k.[...\|..E.....I.D.q......_....B. VL*..T.. ...R..iY.Vn..r+....u..Z`.m...w]=...7.t%.?.\|.\.f .......E..../.$....#J..w.0I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\homebundle[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2450
Entropy (8bit):	4.992104061178446
Encrypted:	false
SSDEEP:	48:7A7Wcc/v+mQXUvjAciVHeV07iPwXhXQrc0Lpok5o/F2fvY1:7TJ+mQXUvjAcQHe+Om0c0NnoI6
MD5:	715C4C1B6E1B964361570F3936C95794
SHA1:	D8FBAC5C5DA2C1FD7A9376739E372C444ECD2A66
SHA-256:	C324C29AF8A4884106FB6D7DF4878FB5DB82699ECDD1059482368D061109A18F
SHA-512:	5B5801CE37A90AA852C96A2CF6B987BEEC0BB9988A7764C458162A119F01B5AFD2ED2284C2BAB55447854BECF3AD1B57D72CC020045737CDC371E11382782310
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Content/base/homebundle.css?v=y1CB8b6yG-PB79SbAgD5XH2IUgD6V092PCu2pj3nHxU1
Preview:	.banner-section{background:#04519f;padding:30px 0}.home-pano-banner .slider-title{color:#fff;font-size:25px;line-height:30px;margin-bottom:20px;margin-top:10px;text-align:center}.home-pano-banner .slider-sub-title{color:#fff;font-family:Lato,sans-serif;font-size:32px;font-weight:400;margin-top:10px}.home-pano-banner .slider-btn-con a .btn-arrow{background:url(/Content/images/home_signup_arrow.png) no-repeat rgba(0,0,0,0);display:inline-block;height:35px;margin-left:17px;margin-top:6px;position:absolute;width:42px}.home-pano-banner .slider-btn-con a{font-size:32px;height:52px;margin-top:8px;padding:0 0 0 43px;position:relative;text-align:left;width:385px!important}@media screen and (min-width:768px){.home-pano-banner .slider-title{font-size:43px;line-height:45px;text-align:center}.home-pano-banner .slider-sub-title{color:#fff;font-family:Lato,sans-serif;font-size:32px;font-weight:400;margin-top:10px;text-align:center}}@media screen and (min-width:992px){.home-pano-banner{margin-top:40px

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Reputation:	low
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\j2GlobalLogo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 32, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1488
Entropy (8bit):	7.46543800538508
Encrypted:	false
SSDEEP:	24:d/6OG4cm19RsJNTuy/7qTL2CxHP6nLYZ2SedtxSfAnfRglw2D7Jnt8LQz:d/6e9RsJduaQL2CRCnLYwldtQonG7Jtn
MD5:	F25E92E5754BD97394D2C278A469B099
SHA1:	9A9CB419211BCC769A1A15B42A404F89146A5E33
SHA-256:	A48397968CA9521EF5BFFDFB4BDC07F65B0D3B62276F3B82B250BFA5788708A1
SHA-512:	D2B7B2E6722B2B39BF71A7105B5C48A1D599A8BEF313758EA379D7CD4FE22653980BC43DA0AC7F6E29112C49A9D92074E254E825BF0593F7B79C15C58944D9D8
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/j2GlobalLogo.png
Preview:	.PNG........IHDR....... .............pHYs.................gAMA....\|.Q.... cHRM..z%..............u0...`..:....o._.F...FIDATx.b...?Cvv...(............0.._.t)#@.........X.d..F.B.^ ......gw.....H....N....@..lfbbb`cc....Ar...M..?..;.....0....AEE.AGG.l.H.o.........0........0....1.[.n1.}...S.!!!`.YXX......r....R..A...tpp`8r....'..Y.........V..@(^..0q.D...J..W3l..,....p.B...O3\.t.AKK.,..@L..$%%.......3.m..mnmm..d...&&&.....E%@.1!..'O.v.........~...R..;w.-....kPPP...,.......~..G..k@..:u.....v.W.....^....D.!...>}b.....A^.x."8.............bAN, .........R............Ar....b.\.....q===.###..`....(m..........H#L......r..pXb..$L..7o.b........\|..W.c#..-g.h..b.e.....0....git1..F5#@....S@...?.@.._...4...7#"..Cdb..bH.#X........I...........~......f.%.......F.b.+.#.'+3.#P.....~.._.O.......L..>0..?....!....30..0...g.............~......@L...fg.....'&2....>..00.S"Gj....1....8X...X....]..@..).(..{....@.A.......\|....._.jAn..KW... ..Q.. .X.".`.....N..N..d.<...E.......k.Mg0.:.....c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-ui-1.8.16.custom.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	210601
Entropy (8bit):	5.2702270046406685
Encrypted:	false
SSDEEP:	1536:N3I7CdAf+/M/BeT+aHapfjxM5xmc3CI371uE/JKYrn6oCyiZHbrtRN0KvXfIpQtr:y7Cj/TXYrhZHFdW8uIdkz6AUAsaS02Z
MD5:	3B70E5051ABEB0D8796630EBDEE45F67
SHA1:	3C4A33C54A8744C9D2027411CBC6B88B155DE063
SHA-256:	CB0570D8A0111CE332DEB25191BDF46759F0FC06576C58DB45CF3A27DF59B084
SHA-512:	CBE1DBE5F97CBBBF9B5B7719FA4CF1CA3CA9C15C094CEA27227606327F9F73E96381B94B4BEC4FEC56D8A77C0FEA0023D2B2D065643ECFB6FB804FC0A7AA0A1D
Malicious:	false
Reputation:	low
Preview:	//if (console && console.log) console.log("--- jquery-ui-1.8.16.custom.min.js ---");./!. jQuery UI 1.8.16. . Copyright 2011, AUTHORS.txt (http://jqueryui.com/about). * Dual licensed under the MIT or GPL Version 2 licenses.. * http://jquery.org/license. . http://docs.jquery.com/UI. */.(function(c,j){function k(a,b){var d=a.nodeName.toLowerCase();if("area"===d){b=a.parentNode;d=b.name;if(!a.href\|\|!d\|\|b.nodeName.toLowerCase()!=="map")return false;a=c("img[usemap=#"+d+"]")[0];return!!a&&l(a)}return(/input\|select\|textarea\|button\|object/.test(d)?!a.disabled:"a"==d?a.href\|\|b:b)&&l(a)}function l(a){return!c(a).parents().andSelf().filter(function(){return c.curCSS(this,"visibility")==="hidden"\|\|c.expr.filters.hidden(this)}).length}c.ui=c.ui\|\|{};if(!c.ui.version){c.extend(c.ui,{version:"1.8.16",.keyCode:{ALT:18,BACKSPACE:8,CAPS_LOCK:20,COMMA:188,COMMAND:91,COMMAND_LEFT:91,COMMAND_RIGHT:93,CONTROL:17,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,INSERT:45,LEFT:37,MENU:93,NUMPAD_ADD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\large_fileshare_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39396
Entropy (8bit):	7.6024259821375155
Encrypted:	false
SSDEEP:	768:Sw+PEbpIUYcFbHI1sYLP58xtrCSngDNRHxjopNDwA5dN0c:XbpIUYcx+sQP58xFlnQRHBiNd0c
MD5:	2A62F9BA633854EECF36F60AE811AAD2
SHA1:	C96C0F3E739627801C7A493B71E8D1EFBBA423FA
SHA-256:	F5F3803B112E4912854F08B055F838E36BC51AAC9D2BA5D00AA6DB3ED57F0C06
SHA-512:	50B160E7581B7D5C3D17257ADADF4CF38916FE50A6AE1A787EB397E2FF1C6D991C7CC26BAF7D783A0A2CD113E9BC4168CE2B18FC617C2809110B2DE0ABAE2B20
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/large_fileshare_1024.png?sfvrsn=fed990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:782A201AF9D911E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:782A201BF9D911E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:782A2018F9D911E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:782A2019F9D911E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>-V6....RIDATx....U...Gl.....P.bEQ.Fc.1F.5..;./....i*".^c.5.[..(\.....X...o.r..g.>..<.+.{..5kf.Y.f./.."....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	491344
Entropy (8bit):	5.407553833826162
Encrypted:	false
SSDEEP:	12288:A3T2NsN8NDdnNDdqNDdm4poKnENtF6BTdNqN7NRY1YdN8NDdnNDdqNDdmuRNQN8:qT2NsN8NDdnNDdqNDdm4po9Nr6BTdNqr
MD5:	167810F6875411FAE29E09A37AB11714
SHA1:	2BADB778A321392B8C33B00C7C1C01B517EA9E34
SHA-256:	C8CC539D26A9BBA258554E8D8444916C42F5B0E98C3D121F2856AD59FC2478D8
SHA-512:	D0C283A94951F1A392D4910AD761CD051C9F515D72136E2C57B967B96AFB66FE9BD6CF90A4CC98EBFF316EE6C6DD88213B5F0B177288B2BD4C8A816B3DC62781
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/main?v=bBrBs11l5agZhZyXAB1pgqSiB7kJYKEUWxPv5Q-rFTM1
Preview:	/* Minification failed. Returning unminified contents...(52,228831-228832): run-time error JS1195: Expected expression: ]..(52,229031-229032): run-time error JS1004: Expected ';': )..(52,229388-229389): run-time error JS1002: Syntax error: }..(52,229402-229403): run-time error JS1195: Expected expression: )..(52,229403-229404): run-time error JS1004: Expected ';': {..(52,229723-229724): run-time error JS1195: Expected expression: ,..(52,229736-229737): run-time error JS1195: Expected expression: )..(52,229737-229738): run-time error JS1004: Expected ';': {..(52,242943-242944): run-time error JS1195: Expected expression: ,..(52,242956-242957): run-time error JS1195: Expected expression: )..(52,242957-242958): run-time error JS1004: Expected ';': {..(52,254473-254474): run-time error JS1195: Expected expression: ,..(52,254486-254487): run-time error JS1195: Expected expression: )..(52,254487-254488): run-time error JS1004: Expected ';': {..(52,271491-271492): run-time error JS1195: Expec

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 18696, version 1.1
Category:	downloaded
Size (bytes):	18696
Entropy (8bit):	7.96597476007567
Encrypted:	false
SSDEEP:	384:yeQHZsdOZKOIVrf0uvAxZEw5w7Yc3XGi/L6:dBbVwuvAYYw7THc
MD5:	449D681CD6006390E1BEE3C3A660430B
SHA1:	2A9777AFC07BF0BB4BB48F233ED7C4BCBDB60760
SHA-256:	57C79375B1419EE1D984F443CDA77C04B9B38C0BE5330B2D41D65103115FFD72
SHA-512:	8B8436670BB4D742AFA60ABA29D7A78F3788CBEF9353C2896AA492618CF1B22E9A0679972AB930E2F2D4732F3B979C023D25AA0FA86C813AC674524FD4ECA2BE
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhv.woff
Preview:	wOFF......I.......m.........................GDEF................GPOS................GSUB.......X...t...OS/2.......^...`.-..cmap...`.........X..cvt .......[.......4fpgm...p........~a..gasp................glyf......8...W.J.4.head..A....6...6...Mhhea..A<.......$...#hmtx..A\... .....lT.loca..C\|........6..umaxp..E@... ... .t..name..E`........#.@Ppost..FP.......x.U..prep..H.........x..n........................................x...5.A......m."gW..`.L..&N".?.......IF....a.^...b1..................Uh."4...>..=x.c`fy.......:....Q.B3_dHc.........................@`........./..?....^...... 9. .m@J..........x.\.!..q......#aff...#1Q@.'U..@5.".llt.Aa#.f\|c.W.....'..X..!..C...ITPE.;..V.j......0. .L0E...Yd.mN....:.....F....GG.g.s,x.>0....v..I;o..<.$G9.\f2...e(}.IS2..uc]p.........M.x.c.a.g.c..$KY...e@.,A.".m....x.......3......?.[.o...2...:...a..b.)@.Y.....v1.b4d...36 ..x.uTGw.F........)..)7.W.$`*.....G.Kz.)e....t.\|.1.7...s.g...3.7mgf..~{1...s.3.S...co..o.~.Zy.u...kW.\.t...N.KG.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\partner_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	39899
Entropy (8bit):	7.709602708664147
Encrypted:	false
SSDEEP:	768:u80GKWe85LX0F+nBn1Gni6/K8fP9uEfdHA7WVxBZrhU5:30jyrc+nqi6//IEfdg7WLlU5
MD5:	71DF92F2100CDE69245751FB4C823E7B
SHA1:	1DF13CC7EEB8C891CDED93B02D62EA9F412E8953
SHA-256:	5EA1DF1AD7D6C1006E26FB8BC7D1D6FA48A4C994769EF49E41DF4B61290BA90F
SHA-512:	09533C1ECD29DBAEF0848834A0FB90E7FC80DBCCA5E4D706ACEA0C7707B570DBB4453D8E1B85E74AB949919F2655DBE26B12ADD46EF02D57015884B4D67E628A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/partner_1024.png?sfvrsn=91d990b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:954AAECFF9D811E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:954AAED0F9D811E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:954AAECDF9D811E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:954AAECEF9D811E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.p....IIDATx.....fS...+d_..PQ..}.&i!i.e....MD.)E....P.....[^;.h.%[v...u.d.1.3..>.....\|~.Ca..{....s...'O..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\receive-online-step-1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 312 x 299, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6317
Entropy (8bit):	7.8352575692508815
Encrypted:	false
SSDEEP:	192:8Vf7yRzq7voD3lKAgM0PYzspuuuuuuYxDUnFVD:8gJEoDVLaQ4puuuuuuvnDD
MD5:	72620421AA2D7B65B0500E9F21EACAF6
SHA1:	7C8144E7AD704C3E1EA72D4D31238F61DBFB7770
SHA-256:	30BA7511BB82A5FE267888CF1377D81B298AC326E19A4ACE7BE49BC3DEB896B7
SHA-512:	C6D3774FDE636FCFD673B18A440CB9102B9A3A286CB40015A14D4FCDB95D8CC8932695A28237756AD2902189E49A92AFCAEA1414651FF0C87A2201B7CFF054B4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/receive-online-step-1.png?sfvrsn=2
Preview:	.PNG........IHDR...8...+.....J=._....sRGB.........gAMA......a.....pHYs..........o.d...BIDATx^..o..y......U.\..M..@..0.....[.H.B)..A..U.'.\.....J.Z...WqMK..tTZ<t%..i...CR"5...33..9K....=?......9.>.%...#...".......@. 8.H....... Y...$....dAp..,.......@. 8.H....... Y...$....d.Zp...j0..^.......fJ..W....5...1...+++.......j{{..`.h..u.l...............Bf..........EUL%8m...];.B.._.k.......~?f.F.YD.k.s$.U1...!dQAp..d...!....B...#.$..G.I6....l..!$. 8BH.Ap..d...!....B...#.$..G.I6..n.6W..t.f.c.M.a......n'Mbg..1.Z.).M....6.O.....TrQ.....<+..<.ps...........2. .I)D.....Q..lfm....#d....bRSp...>F..;1_.......k....1..m...<..\.l../8IF.1....L..}.;Ew.f..4.^....~.]..R.*cB....J......"...\.b.#..h\r...V..1../.j....?....p.\p..1..K..>...:NXWw.w......._.\|a.B...QH/{.t.(.K.}mvIn<=..w<./$...P.Z .N!..5..&]c.OZW.zB:.]....X.....@..\<.wp6...>B...FE..vm.....wl..EB.._........t.tM..&...?!..~.%.U..Dy...\^...6.....m......m.........Ap..U......E0..j.N...s.o!.HJ..}'k-..,.\|.Y.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\salesQues_bkgrd[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 2 x 197
Category:	downloaded
Size (bytes):	252
Entropy (8bit):	6.002056195156968
Encrypted:	false
SSDEEP:	6:sM1OKmrelBlulxBehrgyZtNf5SoaIRMkZcN5296+H3:sGOdWBwehBPNfk35b+X
MD5:	18E2F2528B6B8924A68EB4CA3C04D4CF
SHA1:	C1A431F2895592128E8D9BF7EE825DAE396C20AB
SHA-256:	568321DBF19A583C6F111E978C20D80DCE3BC75D2387F4CF397B3C56E39FE89B
SHA-512:	4F0F35FC5694EB44673CFC6CC8AC3789DF53AB06368F1499DA20D703629A27A59110EC524E96ACA3C88195D3302871FF68A827F7E8C805CED3830F75B28AF1E9
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/salesQues_bkgrd.gif
Preview:	GIF89a.......................................................................................................!.......,..........y.%.di.$.....p,.-c3m.......0.(."...xL:..HeJ.Z...`;.x..x,(....z.V....$A...~..C.........................................!.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sddefault[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, baseline, precision 8, 640x480, frames 3
Category:	downloaded
Size (bytes):	44158
Entropy (8bit):	7.976053331164899
Encrypted:	false
SSDEEP:	768:ecNWipZANBvyaYG2gFh5RP5Ii7MRrrBbwDMU9eo+xUi5PXPu5YbJL2iDoSTTwNK4:IipyRy1HgFh5RPeiYVrpwDD9cUiBiO6x
MD5:	2AF3C0D4EEC94A5614B1264A82E12AF7
SHA1:	8C252781505A20A8885381818065079FD8CDA4FC
SHA-256:	1BDDAC667F6EC3863B3E6E623833307E19BF09B4813CD1F514CC049760D881E5
SHA-512:	9ACF4CA7EE82B94DD32329721B64B3DD79B69015506195869E9C02FDC926C95F3052542D25B0DD8E7A41B6907C7E01E3B224D514CF9D42A464E6B98C088C59AD
Malicious:	false
Reputation:	low
IE Cache URL:	https://i.ytimg.com/vi/NcnKTqv8xUs/sddefault.jpg
Preview:	......JFIF..........................................................................................................................................................."..........................................u............................!.1AQ...aq......."24BRSVWs......#$%357CGTUgru....6Fbc......8DEtv.....f.......'(de..H..&..................................E.........................!1...AQ.."RTaq.....24S.......36#Br....b.%............?..R" ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""...." ...""....-.......{.D:....~....^H..:......w.:......w..]..+.C~.>.w.t ..l......lm......7.j1.z...o....E.......o..>3..o..}.5..dC...\.5.j1.q........l.t...o\|.....^.3.h.k..H.5........i./.....Ql..g./......2......w..Z(.^:.Y..>.w...a..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\send_fax_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	26053
Entropy (8bit):	7.362079529926169
Encrypted:	false
SSDEEP:	384:alVWXHtw4UO/M4OyP1aeXi+WlcymR9jmDiD9Z98lKis9FqnzVzHe0:aloH/9aEtymrjm+xis9UnzVz+0
MD5:	B0CD246143FC8E47D512BA76EB102257
SHA1:	D2B9139A8BC2A69749F5445B0294F760B96D444B
SHA-256:	DC697679E8884E6E976E986096BB38E7E1E402391821588DF6E1AABFA6007BE5
SHA-512:	3F7CA07883B7FCA0CE51380EC90CAB1AC2C5E65FAC37EFF2447792880A1C1251CDCCC8B4C70DC973E5C38A17482EF15091B05D5C5E51197DF54EE0DA1D258BAD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/send_fax_1024.png?sfvrsn=a1d890b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:F09EC9A5F9D911E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:F09EC9A6F9D911E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:F09EC9A3F9D911E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:F09EC9A4F9D911E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>VC8...b3IDATx......U}?.7f...0(....d.$!&AqA.b]..E}...VE....E.."..nX[.*.(...Q.2....\.+V..@.-...`...Mr.9g>...=..nf~

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\styles__ltr[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	51178
Entropy (8bit):	5.968129596292632
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKSrKebyBwxDl+xedtY5PoiDH1fkQJVEwY:4UcW6v+2rKwxDliP7dnY
MD5:	E548DC0AEF0A21A2DF5B964EF93118AA
SHA1:	983091AEC1E7BFEB79F768E4B997C43B55EDE14A
SHA-256:	6B08EA3A348838BC942AD470A757575975BD09459B63C1872C6E1129A6CA1939
SHA-512:	17A4EC0CB167C2C7653ABEF6384C68BE2BCEEE6FB657D3A27132B3508F28087AEEB8072409DB95F6D4BE7BFE1F54A51D6EB073AE5D902DA90ADA5ECDE72F29FC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\time_saving_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	44634
Entropy (8bit):	7.82835535855829
Encrypted:	false
SSDEEP:	768:OSnklwv0ZJZXd7UWZcojQ6kw6MpXkt7ve07ghcQCV65GnurNzV+DewXCU3X:R5OurojJkJMOtrg/CMK++fdX
MD5:	C4F9CE2DE7AA09793C4BAE717846A429
SHA1:	A211C3D5D5F39BF57A3066BD1C974ACBCAA74DFD
SHA-256:	7260AA15BF93646B6B96D2219889C46911F67E1CEDD9F7CBC0E483D49F0E5FDC
SHA-512:	C7E4104F264ECC726F6D37E9B9A83D7B058BA8CEC484C156EB97535B07E695B568FD5CBB39917210782D5E781775E2513702E47AABE916238C5FD4F19564D6FE
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/time_saving_1024.png?sfvrsn=76d890b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:0BBF224AF9DA11E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:0BBF224BF9DA11E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:0BBF2248F9DA11E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:0BBF2249F9DA11E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>../.....IDATx......c.8.9....*../..)kI...R.TR....lei/[..,E.....B..^..q...{F....]..}..~?..s..q..f.....{.M.2....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\titilliumwebbold[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), TitilliumWeb-Bold family
Category:	downloaded
Size (bytes):	60190
Entropy (8bit):	6.378971002856508
Encrypted:	false
SSDEEP:	1536:Lj2S1DjDyx/atB0mbQYeKnha0X72mIJkWYux6qvNMG2E8H7O1j7xR+WR9AaQee:y25qvNMG2E8H7O1j7v+WRKaQR
MD5:	E89DDDAAC1D8EC980F558D6B9850AFCC
SHA1:	EB9A72C4046E2836CBAA348C2170FB4A8041D795
SHA-256:	E0A9C4AE52F6D591928DF5539E8DC7C417635770253F7E8AA77D0246244D0D3B
SHA-512:	02B8CE7FDCEB120EA6A614596BD1AA1947C57FDBF5E6C46FFBF2891B77D7DA501E00F47B3E243B8232B24E894D57E83A5C59EB135E1022C214642BAD0530717A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/fonts/titilliumwebbold.eot?
Preview:	..................................LP................... ....5.....................".T.i.t.i.l.l.i.u.m.W.e.b.-.B.o.l.d.....B.o.l.d...v.V.e.r.s.i.o.n. .1...0.0.1.;.P.S. .5.7...0.0.0.;.h.o.t.c.o.n.v. .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.5.3.1.1...".T.i.t.i.l.l.i.u.m.W.e.b.-.B.o.l.d.................FFTM_.YU........GDEF........... GPOS..t......E.GSUB?.3N........OS/2k..>.......`cmaph.u.........gasp............glyf.....\....head..U........6hhea.......D...$hmtx_b<9....... loca.x..........maxp...B...h... name2z..........post..[.........preph..................A...5_.<.................... ...#.Z.................m.\|...^. .,.#.........................?.................@...................X...K...X...^...,............................UKWN. . ...m.\|...m.. .............. ...........M.........D...7.0...0.4.0.....#...8.4.&.4.....(.0.2.......8...8.....0...0.J.0.A.0.9.0.(.0.2.0.#.0.E.0...0.....8.....0.B.0.:.0.X.......&.Z...a.J.../.~.J.*.J...J.c.-...J...J.....Q.J...J.Z.J...J...,.M.J...,.l.J.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\topNav_left_on[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 10 x 30
Category:	downloaded
Size (bytes):	1074
Entropy (8bit):	5.664425364758547
Encrypted:	false
SSDEEP:	12:5x3+EdwJOWlywJi9EjEUAqp8hQwJrjSlI1tnZ/8Ni60kmUFEaznO4gnLbxFEn:5VrVrEgQ8jIlGZTcFPacn
MD5:	FE1CB9452CAB4180A1808BC8BEB93984
SHA1:	9855097B49BC65EFA8C1F4E5DB403999EFE55F00
SHA-256:	BECC78E14C49B9F58CB64E47131282E2CD38ABD078B9378F9B34A6BFEE79550B
SHA-512:	3EDFAB3E1E269FD8758181F2541FBB3BF60B7CAD660ACC12C39DADB1D531FBAC167A3AADEC95E8D11D2D6DE1716C9FCC5E65615DE9B546E9A42DF065C74AD3ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/navigation/topNav_left_on.gif
Preview:	GIF89a.......>...3f.Q..l..V..Z.(......i..S.3...u..z..n.!..;..8...c..^.+..=..5............4..m..I.0..:..;......o..=..X.$m.....C..R.Gk..o.6..#..l...z.)v.%...#..q.$...Z.\|...v. g..<..C..V..R..O..5h.w..p.....L.-...t..6..I..../......}..].....t..`./..4../...d.,{....K..u.%...k..n..L..^..}.3\..G..h..:."......C.3...R.&q..f.2..0...2........K.c......q.......5......9j#m........@.<...j..>v.W.3......]..@y....+..\|.......)...x..M..=m.k..y.(...e....>..b..\|..w.....r.9...P..................................................................................................................................................................................................................................................................................................................................!.......,............+...a..C.+..ahD.3......H.+.?...B..)Y%.......&p..cN........' .MH....P..Q..O.r..H$.'...8h Q..S...Xhr...\|*t..@...b.....H..p...B....x....$.#....8"........$.....!.h......1..R....A.Xd.....Q..r.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\worker-70faafffa0475802f5ee03ca5ff74179[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	47679
Entropy (8bit):	5.52455125026656
Encrypted:	false
SSDEEP:	768:YW9/aqCx/8GKpRk7w5lmWsFF5DtJeM6pnT5MW/ybqMO/vkaqct:YYU/Ik7w5lOJeLpnT5MW/21aqct
MD5:	11702237CB5C61EFC4972533704A5C5D
SHA1:	7AAC6F3313243143077FA30D7C1AE80C25772686
SHA-256:	E916478D94814B1A0C2680424C323DB0514F4A022D16835CD7BCC754722308F4
SHA-512:	5283042134A364F341CC3C657668C22AD93FCE582177F2D26AF99C4F49AD39783CD70A82CD3821C33E669E60E7C5FDEE7D3F6327676B5B0B182DB6C8475B5D34
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/analysis/worker-70faafffa0475802f5ee03ca5ff74179.js
Preview:	/**. (The MIT License).. Copyright (C) 2014-2017 by Vitaly Puzrin and Andrei Tuputcyn.. Permission is hereby granted, free of charge, to any person obtaining a copy. of this software and associated documentation files (the "Software"), to deal. in the Software without restriction, including without limitation the rights. to use, copy, modify, merge, publish, distribute, sublicense, and/or sell. copies of the Software, and to permit persons to whom the Software is. furnished to do so, subject to the following conditions:.. The above copyright notice and this permission notice shall be included in. all copies or substantial portions of the Software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR. IMPLIED, INCLUDING BUT NOT LIMITED TO

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\2016LayoutBundle[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	19226
Entropy (8bit):	5.151418032655393
Encrypted:	false
SSDEEP:	192:CALFiUTbJ56IWA7w0+qIeQAiEJdO6WTkxPi+lMssfS2E:5S0qeQAiEJ1WQI+lMI
MD5:	754843A69E2AD5366C9ADEEEB8584AFF
SHA1:	D2FCE77869E054750A3230B64DB809DCE9F3F7A2
SHA-256:	1B22BCAA8673F527AE383CE1353CFDE048AD257AA2C1DBFF5AE5D0E7384959D3
SHA-512:	80A1B6A5B210461A03461C6334D4BF63F594B8EE38236C0F2FD68A5215B2C3BDD1E11CD281C8790E7C54AA5F2F0F451277FD2E58A1FDDD05D6ABE53CE755F5D7
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Content/base/2016LayoutBundle.css?v=oZ5OcTygsIv8-3NFjxqIBeDGelS7SeE8WZLEepjuxLg1
Preview:	@import"/Async/libs/bootstrap-3.3.7/bootstrap.min.css";:root{font-size:16px;font-family:'Open Sans',sans-serif}html,body{background:#fff;font-family:'Open Sans',sans-serif;font-size:16px}.col-xs-15,.col-sm-15,.col-md-15,.col-lg-15{position:relative;min-height:1px;padding-right:10px;padding-left:10px}.col-xs-15{width:20%;float:left}@media(min-width:768px){.col-sm-15{width:20%;float:left}}@media(min-width:992px){.col-md-15{width:20%;float:left}}@media(min-width:1200px){.col-lg-15{width:20%;float:left}}h1,h2,h3,h4,h5 p{font-family:'Open Sans',sans-serif}h1,h2,h3,h4,h5{color:#000}h1,.h1{font-size:42px;font-size:2.625rem;font-weight:700;margin-bottom:10px}@media only screen and (max-width:767px){h1,.h1{font-size:32px;font-size:2rem}}h2,.h2{font-size:32px;font-size:2rem}@media only screen and (max-width:767px){h2,.h2{font-size:28px;font-size:1.75rem}}h2.subheadline,.h2.subheadline{font-size:26px;font-size:1.625rem;margin-top:0;font-weight:400}h3,.h3{font-size:24px;font-size:1.5rem}h4,.h4{fon

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Reputation:	low
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ErrorPageTemplate[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/ErrorPageTemplate.css
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\NcnKTqv8xUs[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	48513
Entropy (8bit):	5.872396901682514
Encrypted:	false
SSDEEP:	768:uCD/cR6oVfO2c9lHx6oT7yMdP9P6SSFIc/Z3RVQa0j6yQijy2ZPlaq/sJLcBEH//:nuo9CBac/Z3ReaZ0yeo88qS
MD5:	A7FEA941B5DF524638D088650A629326
SHA1:	8D3CDDE110527943D3C8B9C4477C5431819E086D
SHA-256:	65F34C053FE5F660FE63C865B37D6FD5722E64A4ECCD968A6F294ACF70E17363
SHA-512:	95333D913F4C22739DF0F3D308889190730C4536D1BD846B677281EA80F9D4A8FB8EEB79E52972D931F7DF8C9F559C7B2BA1DFB39561B2C030F51E83EF0FF69B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/embed/NcnKTqv8xUs
Preview:	<!DOCTYPE html> <html lang="en" dir="ltr" data-cast-api-enabled="true">.<head><meta name="viewport" content="width=device-width, initial-scale=1"><style name="www-roboto" >@font-face{font-family:'Roboto';font-style:italic;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOkCnqEu92Fr1Mu51xIIzQ.woff)format('woff');}@font-face{font-family:'Roboto';font-style:italic;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOjCnqEu92Fr1Mu51S7ACc6CsI.woff)format('woff');}@font-face{font-family:'Roboto';font-style:normal;font-weight:500;src:url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc-.woff)format('woff');}@font-face{font-family:'Roboto';font-style:normal;font-weight:400;src:url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxM.woff)format('woff');}</style><script name="www-roboto" >if (document.fonts && document.fonts.load) {document.fonts.load("400 10pt Roboto", "");document.fonts.load("500 10pt Roboto", "");}</script> <link rel="stylesheet" href="/s/player/c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\WebResource[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	23063
Entropy (8bit):	4.7535440881548165
Encrypted:	false
SSDEEP:	384:GvUzYI+Vi4g1V5it1ONhA6w+Kv8i/4CYzLKL4DrLU0iTxZTAzIzrwDlTWMClQip9:bkON69kClQq8hDRJHp2tWU25Zt/gREVG
MD5:	90EA7274F19755002360945D54C2A0D7
SHA1:	647B5D8BF7D119A2C97895363A07A0C6EB8CD284
SHA-256:	40732E9DCFA704CF615E4691BB07AECFD1CC5E063220A46E4A7FF6560C77F5DB
SHA-512:	7474667800FF52A0031029CC338F81E1586F237EB07A49183008C8EC44A8F67B37E5E896573F089A50283DF96A1C8F185E53D667741331B647894532669E2C07
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/WebResource.axd?d=pynGkmcFUV13He1Qd6_TZNLQCHZ4tMO3etcWcEi2izK8A_JlUL1GQsEeiwQ0F_ZuPH6v6Q2&t=637290526998988531
Preview:	function WebForm_PostBackOptions(eventTarget, eventArgument, validation, validationGroup, actionUrl, trackFocus, clientSubmit) {.. this.eventTarget = eventTarget;.. this.eventArgument = eventArgument;.. this.validation = validation;.. this.validationGroup = validationGroup;.. this.actionUrl = actionUrl;.. this.trackFocus = trackFocus;.. this.clientSubmit = clientSubmit;..}..function WebForm_DoPostBackWithOptions(options) {.. var validationResult = true;.. if (options.validation) {.. if (typeof(Page_ClientValidate) == 'function') {.. validationResult = Page_ClientValidate(options.validationGroup);.. }.. }.. if (validationResult) {.. if ((typeof(options.actionUrl) != "undefined") && (options.actionUrl != null) && (options.actionUrl.length > 0)) {.. theForm.action = options.actionUrl;.. }.. if (options.trackFocus) {.. var lastFocus = theForm.elements["__LASTFOCUS"];.. if ((typeo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\ad_status[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	29
Entropy (8bit):	4.142295219190901
Encrypted:	false
SSDEEP:	3:lZOwFQvn:lQw6n
MD5:	1FA71744DB23D0F8DF9CCE6719DEFCB7
SHA1:	E4BE9B7136697942A036F97CF26EBAF703AD2067
SHA-256:	EED0DC1FDB5D97ED188AE16FD5E1024A5BB744AF47340346BE2146300A6C54B9
SHA-512:	17FA262901B608368EB4B70910DA67E1F11B9CFB2C9DC81844F55BEE1DB3EC11F704D81AB20F2DDA973378F9C0DF56EAAD8111F34B92E4161A4D194BA902F82F
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.doubleclick.net/instream/ad_status.js
Preview:	window.google_ad_status = 1;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	850
Entropy (8bit):	5.4933400992744525
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCeta1P9sLqo40RWUnYN:VKEctKoeE1SLrwUnG
MD5:	285327DC5F4F607B16EBC06F508E4899
SHA1:	FFF80CF5271CC14A53EB543FAA1B27A6F6E60452
SHA-256:	F30B839135D3DA575CD1C26ACE834EE5C59FD197ADCBDEF19FA1C1D5E85ADF55
SHA-512:	F3E3C831AFE02B6FC44CB3814DF24E3A78C6501BA8871307F2B86A1753BEF25B92D208F1D80AF8196E7590DDEDD17CCB53FFD2A8046B570CC5B7D841D91DAFF7
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api.js?hl=en
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;po.src='https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-3DOoABbW5dlI3f3pcTCrRh8r6vG8VSDvaGrsteHsjSLZUwwqbjDktaa/gIYQTNOI';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\api[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	884
Entropy (8bit):	5.572230029415313
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccA8u+KVCeta1P9sLqo40RWUnYN:VKEcvNKoeE1SLrwUnG
MD5:	2B9E210FBE6E7C14BBB55F08097BB1E2
SHA1:	B0E7C59BCAE8130BEA2FD3D1E581C95A31056D1A
SHA-256:	3B49F759FB8A5A4F4D3817870691CD16B3CD25EDD5253DA27FACBDB3CC92AD32
SHA-512:	FD62813CE7052547B999A0493CB318E2D980B994B2186B9AAEA8EB694CE91D4230E4C7A570C9A9A486C2A6C9CB7501480CDAD53705D4F6E265C358E01BF849B4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api.js?render=6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('6Le4oZsUAAAAADDGmcjXPJrYSkVZKcTqdtUa-hNH');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;po.src='https://www.gstatic.com/recaptcha/releases/-nejAZ5my6jV0Fbx9re8ChMK/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-3DOoABbW5dlI3f3pcTCrRh8r6vG8VSDvaGrsteHsjSLZUwwqbjDktaa/gIYQTNOI';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/background_gradient.jpg
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\btn_submit[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 97 x 41, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	6296
Entropy (8bit):	7.911402859709664
Encrypted:	false
SSDEEP:	192:lSgc1hb6UYqHWDHRwAZOZel8Pbz/sEWdTt:En1l69NpUI8MvdTt
MD5:	029486EF299D23C45ABEE3868547CC47
SHA1:	DC7F311D1E7D7B015CFD2DFDB6CDCB3029F4E889
SHA-256:	0B10532D8E64178F5424142460C37700026761C143593CF208537BF5724D6DCD
SHA-512:	98B805C73C60A40ECFB5F7AA8494B4BB159CB1CD3249F1F1F9FC5712C0C5FB33B03AD9B7042CC02A2EA33DFD498AC97B18B72E6FCDA08B6D497433C9DE253159
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/efaxi/en/buttons/btn_submit.png
Preview:	.PNG........IHDR...a...)......o......pHYs.................gAMA....\|.Q.... cHRM..z%..............u0...`..:....o._.F....IDATx.b...;..................Hg.t'..............@p9..9T....z....A..> ..@,.Q..0.6.a..5...... ...>...RA..A.K;3..g.#>...... (.^.....C.i...yGf...Z(V.{}.r.nw`.9..:...T.@...$#.Lbl....s.A.}."/T!..../....J.;vf......4.I.....l............W[#..$...@9.. ..P4i..../..v5..... L.I....sa.M(?.}.;....&..6....,...K..I..%{l..)x........y[...lw../...e.....vRa.j.O.".."~.Jm.K..Q[..-..3&.$.:\..<..U...>!.U...N.8..@.@..$J.......).h.R.A...&.....4..y.'\.R.X.7Y.}...3%..l&.F...dP...n...e....q%.H..W.M"....G...&.....Cs.G.Uj0..cG.7..5Z.)g:_.z.....<....2.A(.ah.Z}N.............i.v...FUU.;.9.dTk......%....rDs...T.............YW..4..?g..bl.?..._ad....s....Ac.......w.}.zy..".nx......,...#.)e..@...Iz....o.^.Gx.".I&k.L@.B.!..T...<.P...........UVY.Zwsj.../.G.}.p..y.S..F.\|/..].....M....4.'...%.....6r...q.<-....On%[..Y.#.SV.k..G.V. .B...mE.Y...7.38.0# ..x.w$,H........R....*BM..c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	dropped
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	748
Entropy (8bit):	5.154158689618115
Encrypted:	false
SSDEEP:	12:jFMO6ZN6p4aJqFMO6ZRoT6pIFqFMO6Z0/T6pkJqFMO6ZN76pYnJY:5MOYNFMOYsiMOYUT0MOYN7M
MD5:	3DCEBD80AFBC153679BBB093E8796D29
SHA1:	37C8179107F49066C393D874022CCB2A97321D35
SHA-256:	BA2E1D5704606F94AE6DEB87929535D3BFAFED07B2EA3011497485B314EE81CC
SHA-512:	165AF8F7FF7ECA3E8908FB1A8636997CBA0432E654D96B95CDE8B2B3A1AF9A027C1B18A48940123ACBF1FA686F492E4140765EEFD80ECF07C94608E424FD6F20
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhv.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UNirkOUuhv.woff) format('woff');.}.@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN7rgOUuhv.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\efaxi_bkgrdGradient[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1 x 650, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	397
Entropy (8bit):	7.192372081640937
Encrypted:	false
SSDEEP:	6:6v/lhPM04nDs0Ph1vP6YFwf8+8LAXVYlWaEpkmgiWM6SZ3TnNYYCVQYLTEwup:6v/7vX0P/HZFwROeGWPkmXWMXNYtSmTm
MD5:	C8D6013CED18A45377F8E59245CBE2E8
SHA1:	288C945D1366774EF3720C8E0F6103C081047E43
SHA-256:	053113B1924249E07761BE322F8852C9F84CF4A7C3C4B8D4AF3214DBC2792B4F
SHA-512:	85C36E3E271E2D352C72100BD6349C5BB60DCFED08CCDFD6E39EAC927FC4518C5FA62BAB4EABBD58D5E74335CA5A814B0546E7EE623FD5B88602EB8EFBF5F319
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/efaxi_bkgrdGradient.png
Preview:	.PNG........IHDR.............s.......tEXtSoftware.Adobe ImageReadyq.e<.../IDATx..U...!.k..o&.)$..:x.q..&m(. ..Z.D.O..._.~...X.b.......X.z.;...&/c..7...! ..C..m/;>...9"g.Ol...zN.{...8.q..........$....:........2...t..K..b^ .P\c..a6x...pK.X.N....I..Y.. \|C.P^.8.....^rzU..3C..7.....1s:.-..G.......f....{..<.O).9..R...zf...OK.4?..yy/...YifrX.'..\.d.;z....~.V...#....Eza.U......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\efzx-logo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 152 x 59, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4021
Entropy (8bit):	7.610925293061703
Encrypted:	false
SSDEEP:	96:XMcyOvCD+/LUjY3ed3LBXMLDF9Nb7u1IHW5EFd9z3QA2:XFVGY3ed3LyLDjNby1sLVQA2
MD5:	734E886052EB025CFBE8FABDD14A76E4
SHA1:	042B45CD389ACB5E3DA28DB5F216C6AAE4C4C96A
SHA-256:	00E03B638DA1759B8BB8ED79107452145CBA0327E0D64F096373E40152EF05A0
SHA-512:	A9098B12216A2EB2A74EA871CF502B264ABB2A54CDF2F30F7161141AB1425DA52DD0669A13A6F63B59CFA0324B29E0BD41D112E37127A3E35DCB714E39E2E090
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/default-album/efzx-logo.png?sfvrsn=37e580b5_10
Preview:	.PNG........IHDR.......;........S....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c014 79.156797, 2014/08/20-09:53:02 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:DDDDCC31715511E6A7D7A993129B3EEB" xmpMM:InstanceID="xmp.iid:DDDDCC30715511E6A7D7A993129B3EEB" xmp:CreatorTool="Adobe Photoshop CS6 (Windows)"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:3253EC0EFAB911E3B3C6DAECB0633A16" stRef:documentID="xmp.did:3253EC0FFAB911E3B3C6DAECB0633A16"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>........PLTEaaa..........BH.......................5<.\a.uziii....in....sw.PV.......,3.mr...........AAA.:@.......29...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\embed[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	30209
Entropy (8bit):	5.545742956136435
Encrypted:	false
SSDEEP:	768:JR+1MmbktOuepuR59h/vCAy4vd0v0gQRx9:jCuepuF/vCigax9
MD5:	D7C649CF9B97E3AA43C1720561B223AB
SHA1:	7A6B3557CE422C1B398A0D58745649DC24431FD0
SHA-256:	25983311E917CE5A43959CC4348617E56DC9A979964AF236373C1B0AF1C37356
SHA-512:	3A58B79DC392CA3A97C3E4EB9471E895157FDF68244714690C3CC36C6996E8369831FBF9AF0BCE4C537F15F5959808542F5282633BA7D35E29B4431B9B7CA0AA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/c6df6ed7/player_ias.vflset/en_US/embed.js
Preview:	(function(g){var window=this;var W2,X2=function(a,b){g.nf(a.u,8b+2);var c=a.u.end();a.C.push(c);a.B+=c.length;c.push(a.B);return c},Y2=function(a,b){var c=b.pop();.for(c=a.B+a.u.length()-c;127<c;)b.push(c&127\|128),c>>>=7,a.B++;b.push(c);a.B++},eGa=function(a,b,c){null!=c&&(g.nf(a.u,8b+1),a=a.u,b=c>>>0,c=Math.floor((c-b)/4294967296)>>>0,g.Af=b,g.Bf=c,g.of(a,g.Af),g.of(a,g.Bf))},Z2=function(a,b,c){null!=c&&(g.nf(a.u,8b),a.u.u.push(c?1:0))},$2=function(a,b,c){if(null!=c){b=X2(a,b);.for(var d=a.u,e=0;e<c.length;e++){var f=c.charCodeAt(e);if(128>f)d.u.push(f);else if(2048>f)d.u.push(f>>6\|192),d.u.push(f&63\|128);else if(65536>f)if(55296<=f&&56319>=f&&e+1<c.length){var h=c.charCodeAt(e+1);56320<=h&&57343>=h&&(f=1024(f-55296)+h-56320+65536,d.u.push(f>>18\|240),d.u.push(f>>12&63\|128),d.u.push(f>>6&63\|128),d.u.push(f&63\|128),e++)}else d.u.push(f>>12\|224),d.u.push(f>>6&63\|128),d.u.push(f&63\|128)}Y2(a,b)}},a3=function(a,b,c,d){null!=c&&(b=X2(a,b),d(c,a),Y2(a,b))},b3=function(a,b,c,d){if(null!=.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\enhanced_security_1024[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1024 x 1024, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	23187
Entropy (8bit):	7.29448631920898
Encrypted:	false
SSDEEP:	384:JLnIp6sMb0RmSgNTFr0+DRYBVDDWTcb6n1Pj4ESGKaoThNMYew34Ym:tnIp6sMygNJr0kYfmnxj7SGKao1R5ol
MD5:	78D5283FCDDFD746379A1804599F4996
SHA1:	6BCB0BEB92246A6073EA52248DBB92B9BDF65DE5
SHA-256:	33B770260D64E09FC3D7638D611A314FD86BC56A940D905FE66364FF5C502EB0
SHA-512:	7E9085AFD6448DBF3740539492CFCAFA54FA0EA1BFBCDE92B1B0779593441C4B59C3A97850119A9DF2E7A45157128CF898340491B9D80B343754BEB8C0205895
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/Icons/flattened-icons/enhanced_security_1024.png?sfvrsn=dd890b5_2
Preview:	.PNG........IHDR...............+.....tEXtSoftware.Adobe ImageReadyq.e<...(iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c111 79.158325, 2015/09/10-01:10:20 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CC 2015 (Macintosh)" xmpMM:InstanceID="xmp.iid:1EAAB148F9D911E5AE64BA61CD3BB7BF" xmpMM:DocumentID="xmp.did:1EAAB149F9D911E5AE64BA61CD3BB7BF"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:C56BF4C9F9D811E5AE64BA61CD3BB7BF" stRef:documentID="xmp.did:C56BF4CAF9D811E5AE64BA61CD3BB7BF"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..C\..W.IDATx.....ms.?.u8..1..e.J.7..L.(*."i..D.p.I...nR.H7..........................=..<...Y{}.{..&O.\...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\esw.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	29882
Entropy (8bit):	5.163625507757913
Encrypted:	false
SSDEEP:	768:sgm6BkJnPjGjfGk/dKetz712Y61VWlRenLm65HYLtH7j88HzEHlo:73fGk/wyj61ukuk7Hy
MD5:	E5A1DF3AE399B4F2949D42D065299407
SHA1:	8D6AE8D03AD14576E24A9B6707C9AEFB4BFE4E9D
SHA-256:	1404A28B30773DA24F69D1E6AB07F54A6538BBC73670B69180D301D1EDAE35D4
SHA-512:	637082172CF176DA6901ACC78BA0515FACE33070159DC933C14E921E9263CD3146B0DED467DD69559B627AC21EDA4D5BB623E6BFEF15EEFE97282D625659247F
Malicious:	false
Reputation:	low
IE Cache URL:	https://service.force.com/embeddedservice/5.0/esw.min.js
Preview:	(function(k){function d(){var a=!1,b;this.settings={appendHelpButton:!0,displayHelpButton:!0,isExternalPage:!0,devMode:!1,targetElement:document.body,elementForOnlineDisplay:void 0,elementForOfflineDisplay:void 0,defaultMinimizedText:"",disabledMinimizedText:"",defaultAssistiveText:"",loadingText:"Loading",showIcon:void 0,enabledFeatures:[],entryFeature:"FieldService",storageDomain:document.domain,language:void 0,linkAction:{feature:void 0,name:void 0,valid:!1},linkActionParameters:{},useCustomAuthentication:!1,.allowGuestUsers:!1,requireSLDS:!1};this.auth={};this.validLinkActions={};this.isMasterAndHasSlaves=!1;Object.defineProperty(this.auth,"oauthToken",{get:function(){return b},set:function(c){this.validateHeaderValue(c)?(b=c)?(this.setSessionData("ESW_OAUTH_TOKEN",c),this.checkAuthentication()):this.deleteSessionData("ESW_OAUTH_TOKEN"):this.error('"'+c+'" is not a valid OAuth token.')}.bind(this)});this.featureScripts={};this.storedEventHandlers={};this.messageHandlers={};this.sto

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 32 bits/pixel
Category:	dropped
Size (bytes):	1150
Entropy (8bit):	5.544413036102076
Encrypted:	false
SSDEEP:	12:3kw0p5qkb9zM4JW8/x7WM5e1GgxHNkvUzFiltlfOYXavGIIWY82kEKdIKhcyIU8v:3z0Wk2Yh/xaMsNxHN18ltlf6/IwWew
MD5:	0A3D23827E998F3DF57A30CF0DA23E50
SHA1:	C1226DB19DD24EBA6BF2EA534796EE3F1E666412
SHA-256:	39271DF74093648303340D15DB1629613981D448E7723AA09AB5954EA17B3841
SHA-512:	5417A01D3EE8850ADEEE23B77BF1B10CCD8901EA250E65D04EA6873829CC39A5618CF0C3DC78EA3C29D6AFFBA58619122D1EE658B00F1E2BF10A64387D3CD305
Malicious:	false
Reputation:	low
Preview:	............ .h.......(....... ..... ...................................."...<...<...(...............................................h...................._................................rf.M8%..............0...WH.............M........................1 .....?...y.......wl..6$..ZK.........y.......................0.......H8..0...3 ..SC......ma..8'.........o................&...5#......-...6$..PD.bX..6'..RC......4"...................... ..D+.......-....t..{.]N......h^..>-......3!..O?.R............#...%...[M..oe..H8..}t..-...0...[M..of..D4......1...0..A...............%(...}..@2..h[..dZ...5%..v..H:..pc..`T.........................M+.......@2..UF......B1..7%............../......{............ ......V+...~s..of../......3#...}-....w..H8.............................<%...K;............bT......bT..RC./...}q.9........................ ...&...+...-.......,...uk.tH7......\|.h...................................NSI...~.......3!.........q....................................7(..aS

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fax-by-email-two[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 299 x 183, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	13729
Entropy (8bit):	7.913069485210551
Encrypted:	false
SSDEEP:	384:QJXE05kmWIbQa5EJq2CjyxLrRCPMoXkpemLXG0:M35rX35EQ2F9cPMOkpemLj
MD5:	62298A0287CD0360C4C9111F89C776C0
SHA1:	6BE0156B3CC8B492EF0F9A3909FBCF45B565927F
SHA-256:	B976B19170311306FC5CF1623C2635104D8434E6C73AC2C0086BCD241440BFDC
SHA-512:	A3FC743BFA82F42D9BEF818DC203150926B62A841632E15D0409B5694F2CFD45D6C2E3532073E1AAC1CF7A4CA9A6295D2092E51F343CB180E870DCAA3FF0E368
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/fax-by-email-two.png?sfvrsn=8ee380b5_2
Preview:	.PNG........IHDR...+.........Jwx8....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fax-by-mail-one[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 284 x 183, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	15009
Entropy (8bit):	7.9640273146605205
Encrypted:	false
SSDEEP:	384:47JXE05Uav+YV9FeKYbNJvhYA20VgMnMtDt:G35Uo+YV9FedJvhYA20VgMnMP
MD5:	11B9D51514C6A4EBBF591AF710A73E67
SHA1:	097F2893D08FA1953D7C30AC6496BE726F0103CA
SHA-256:	FD433BB4D48D6C187F1E85C8383D0ED1354EADB75B0C8C9FA32871EA57DCDFCF
SHA-512:	8CB1BD2A5F53B291C8A27CED626EA7DA1FFFC0005671247E1EC6AC892CE64B1CDA2BF7AC37E044447A585AD7B5ED031B1562CE39875A173CF805C87A2959A5E9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/sf-images/default-source/how-it-works/fax-by-mail-one.png?sfvrsn=b7e380b5_2
Preview:	.PNG........IHDR..............X.y....pHYs................OiCCPPhotoshop ICC profile..x.SgTS..=...BK...KoR.. RB....&!..J.!...Q..EE..........Q,......!.........{.k.......>........H3Q5...B..........@..$p....d!s.#...~<<+".....x.....M..0.....B.\.....t.8K....@z.B..@F....&S....`.cb..P-.`'........{..[.!..... .e.D.h;...V.E.X0..fK.9..-.0IWfH.............0Q..)..{.`.##x.....F.W<.+.....x..<.$9E.[.-q.WW..(.I.+.6a.a.@..y..2.4..............x.....6..._-..."bb....p@...t~..,/...;..m..%..h^..u..f..@.....W.p.~<<E.........J.B[a.W}.g._.W.l.~<.....$.2].G......L.....b..G.......".Ib.X..Q.q.D...2.".B.).%..d..,..>.5..j>.{.-.]c..K'.Xt......o..(...h...w..?.G.%..fI.q..^D$.T.?....D...A....,.........`6.B$..B.B.d..r`)..B(...*`/.@.4.Qh..p...U..=p..a...(....A...a!..b.X#......!.H...$ ..Q"K.5H1R.T UH..=r.9.\F..;..2....G1...Q=...C..7..F...dt1......r..=.6...h..>C.0....3.l0...B.8,..c."......V.....c.w...E..6.wB a.AHXLXN.H. .$4...7...Q.'"..K.&.....b21.XH,#..../.{.C.7$..C2'...I..T...F.nR#.,..4H.#...dk..9.,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fontawesome-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), FontAwesome family
Category:	downloaded
Size (bytes):	38205
Entropy (8bit):	7.977251858504769
Encrypted:	false
SSDEEP:	768:0W2tnvnIAkUwU5MTETlmg5Qt4375ZYPG6PEqPNaw57N+RBms59Lb:0WavN8EMie4375ZYPG6PRPNaGNams5
MD5:	8B27BC96115C2D24350F0D09E6A9433F
SHA1:	7619748FE34C64FB157A57F6D4EF3678F63A8F5E
SHA-256:	39E237C07403E62F00BD6DDF0B59D3349C7BD3869250AAADC389419DB6AA40EF
SHA-512:	772CE9C1C365642279932703094BEB1BD5BB0AA80E5E373BF384F406D03598CF101343BE568245CF5B1203B0721FEDC08C9676696B3DFE9BBD3C177026BAF218
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/Async/libs/font-awesome/fonts/fontawesome-webfont.eot?
Preview:	=...W.............................LP........................gr^.....................F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .4...0...2. .2.0.1.3...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....BSGP......................O..S.~l......Y.D.M.F..x...>........)[..1.H..-A)F...1..../.d..U.'.&a-......nb$.%....J..[.`..._)q.V...l.ihu-........yx.M..q..y.S0E2...z.r.0.i...g...=?..h.k....2.[.V..0.q...0w...\..0....Q.a)....F.[>d..%[GV.4...l.G..G9...9...q.80}...;w...m=7.C.w.."k?3...eYtd....`..]T......c..4+`.....`[.....GLR....:.. a...Q..(a].]$.1?3....eq.m..$R.Y.....%.......E@K.H.......S..... .Sa.... .m....\|..........5....@_.P.L...l.B.0..fj(.42..x.yt......0...:T<...........]F..Uk..c...D6$.......q.....z{.?....j_.f...\..6 .X.).FP...N...........>.p...u.d_.-..0.!#...S.I.`...FW..d..C.G.ZM.4Z.@...&..X..e%.[...b.xG.amB.KB.(%\....K....OG5..4a.B..5..PK..eE.1..f.Y.!yQ/..,..0]U,.JA...y\.....I..c-.W.,.}F=..n.'.~...ji3c4.....y]E%....+.r..g'..2.......'./..0....k.a...Z.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\inputBackground[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 25
Category:	downloaded
Size (bytes):	94
Entropy (8bit):	4.223086091478381
Encrypted:	false
SSDEEP:	3:CM23jQ4en75t9zl7/lQlVYE:ken75t5lOPj
MD5:	1B391068D5E3530F22133A369401DF2D
SHA1:	22A63DC6FA7BF53FA4E5375577B554A7B4D265F7
SHA-256:	68A3639B6B40639335C09BA039C43CBCD7A55B6036EBB958F60F51A395F2FEA3
SHA-512:	E930211D6776EF52CAC044B5B63B93DE940CC0B5B1955DAC745749AEA92C36877254A7EFCA7176D936B690716306CEEB89472DEF5118D0831EC2949D4A941D90
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/forms/inputBackground.gif
Preview:	GIF89a.......................................................!.......,.............0.0. ....;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\j[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5742
Entropy (8bit):	5.600537657291428
Encrypted:	false
SSDEEP:	96:d302reqTMabCmhvpdxnrn/pW4FJZNUhFwg7UM7Llln7UM78l1IjMO3LjHs7mI1ML:dk2aqTBvp7n/pW4bZySgRX/nRiujMaj3
MD5:	575051B88441B06348DE67577A90938E
SHA1:	ABA38DA746D32DDA80DE5026292BCB0806985610
SHA-256:	97915F687C01F62CDA8B022794A2DD744A5D6180280C66DFC732483BCD62B926
SHA-512:	002020E01F43DAC8B2D485E162383157F650AAEE7D1025A5F945A3BC4A0C5D5D0943B28AF991E11C1E1B8B5CD0C2A8986834C1069EEB7CBC9F41CF8E9446F0F3
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/j.php?a=232379&u=https%3A%2F%2Fwww.efax.ca%2Fpricing&r=0.6083375011716613
Preview:	try{;(function(){var aC=window._vwo_code;if(aC){window._vwo_j_e=window._vwo_j_e\|\|0;if(window._vwo_j_e==1){window._vwo_mt="dupCode";clearTimeout(window._vwo_settings_timer);if(window.VWO&&window.VWO._&&window.VWO._.bIE){window._vwo_code.finish()}return}if(window._vwo_j_e==-1){window._vwo_j_e=1}}window._vwo_mt="live";try{window._vwo_tm="";var getMode=function(e){var n;if(window.name.indexOf(e)>-1){n=window.name}else{n=window.location.search.match("_vwo_m=([^&]*)");n=n&&n[1]}return n&&JSON.parse(decodeURIComponent(n))};if(window.name.indexOf("_vis_heatmap")>-1\|\|window.name.indexOf("_vis_editor")>-1\|\|getMode("_vwo_cc")\|\|window.name.indexOf("_vis_preview")>-1){window._vwo_mt=window.name}else if(window._vwo_tm.length){window._vwo_mt=window._vwo_tm}else if(location.href.indexOf("_vis_opt_preview_combination")!==-1&&location.href.indexOf("_vis_test_id")!==-1){window._vwo_mt="sharedPreview"}if(window._vwo_mt!=="live"){if(!getMode("_vwo_cc")){_vwo_code.load('https://dev.visualwebsiteoptimizer.co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\j[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5787
Entropy (8bit):	5.604665696702247
Encrypted:	false
SSDEEP:	96:d302reqTMabCmQpdxnrn/pW4FJmLUNFwg7UM7Llln7UM78l1IjMj5n3LjHs7mIM/:dk2aqTwp7n/pW4bmESgRX/nRiujMlbjr
MD5:	110BDC86CB51B370FC706D8209C02C62
SHA1:	410035CA2DC0A426C140FB0AD9BA16CBF4322686
SHA-256:	777F8E97716FF00E887B9E9929080DA3E51DB14088A73FBE99ED11729DCA0658
SHA-512:	AD828B2A3CF3AAD48A1A5A8C353B32D2BA1CBF365A1C7223AB34AB2223AD7CE96BC4492136ABF9F41E649549ABEA95BF75E4E3EA9EB4056592618B1E32CD3779
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/j.php?a=232379&u=https%3A%2F%2Fwww.efax.ca%2Fefax-help-center%23ViewContentPlaceHolder_C017_Col00&r=0.7703288790563383
Preview:	try{;(function(){var aC=window._vwo_code;if(aC){window._vwo_j_e=window._vwo_j_e\|\|0;if(window._vwo_j_e==1){window._vwo_mt="dupCode";clearTimeout(window._vwo_settings_timer);if(window.VWO&&window.VWO._&&window.VWO._.bIE){window._vwo_code.finish()}return}if(window._vwo_j_e==-1){window._vwo_j_e=1}}window._vwo_mt="live";try{window._vwo_tm="";var getMode=function(e){var n;if(window.name.indexOf(e)>-1){n=window.name}else{n=window.location.search.match("_vwo_m=([^&]*)");n=n&&n[1]}return n&&JSON.parse(decodeURIComponent(n))};if(window.name.indexOf("_vis_heatmap")>-1\|\|window.name.indexOf("_vis_editor")>-1\|\|getMode("_vwo_cc")\|\|window.name.indexOf("_vis_preview")>-1){window._vwo_mt=window.name}else if(window._vwo_tm.length){window._vwo_mt=window._vwo_tm}else if(location.href.indexOf("_vis_opt_preview_combination")!==-1&&location.href.indexOf("_vis_test_id")!==-1){window._vwo_mt="sharedPreview"}if(window._vwo_mt!=="live"){if(!getMode("_vwo_cc")){_vwo_code.load('https://dev.visualwebsiteoptimizer.co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery-1.12.3.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	97180
Entropy (8bit):	5.373746180254919
Encrypted:	false
SSDEEP:	1536:kYE1JVoiB9JqZdXXe2pD3PgoIiulrUdTJSFk/zkZ4HjL5o8srOa99TwkEb7/Jp9s:P4J+R3jL5TCOaLTwkEFdnCVQwNa98HrV
MD5:	C07F2267A050732B752CC3E7A06850AC
SHA1:	220DAD6750FBA4898E10B8D9B78CA46F4F774544
SHA-256:	69A3831C082FC105B56C53865CC797FA90B83D920FB2F9F6875B00AD83A18174
SHA-512:	9B1D0BF71B3E4798C543A3A805B4BDA0E7DD3F2CA6417B2B4808C9F2B9DCB82C40F453CFAE5AC2C6BAFC5F0A3E376E3A8CE807B483C1474785EB5390B8F4A80E
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-1.12.3.min.js
Preview:	/! jQuery v1.12.3 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.3",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.ca

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\login[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	67436
Entropy (8bit):	5.116558344816675
Encrypted:	false
SSDEEP:	1536:CQKRMhJz03D6gtOud9iKte6JMWTJdI6Mg+kaSYHviMWYraz0+u1:CQKRM74hZ7JlTInkaSYHviMOz8
MD5:	A7A00FA4B2D06F8F23A21D5FF5AB41B6
SHA1:	F1C27E19BFFDA8B26C12F8F8B0BD80405406A6E4
SHA-256:	567DC30E52CB9458AF5D2CED4F8EB12A30EE8C9276AAB929F5FED02F604F325A
SHA-512:	5D4BA9CB40050EBE1A000D174CCD1A3EA040AC454A41AC705B059D4A0D9C686B365AB46FED09EB406C59F90659FBA4E6421A544476436758C1A8284E9E87D2CC
Malicious:	false
Reputation:	low
Preview:	. /WEB-INF/grails-app/views/layouts/efaxi_Sales.gsp --> j2_include rendered start: /html/content/layouts/efaxi_Sales.gsp --><!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">....<html xmlns="http://www.w3.org/1999/xhtml">..<head>.. <meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>.. <title>eFax Login</title>.. <link rel="shortcut icon" href="/myaccount/images/favicon.ico" type="image/x-icon"/>.. r:require modules="efaxiSales"/ -->.. r:layoutResources/ -->.. INT-4497 -->.. <link rel="stylesheet" type="text/css" href="/myaccount/css/jquery-ui-1.8.16.custom.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/efaxi.css"/>.<link rel="stylesheet" type="text/css" href="/myaccount/css/cookie-banner.css"/>.<script type="text/javascript" src="/myaccount/js/jquery-1.7.2.min.js"></script>.<script type="text/javascript" src="/myaccount/js/jquery-ui-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\master[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text
Category:	downloaded
Size (bytes):	509
Entropy (8bit):	3.974657739912758
Encrypted:	false
SSDEEP:	6:4Ll+Z12jKlayjkFWmd1RJ6rgoGdpjMNH5MynzAqX92KQEEKocPHC50IHK/L+dZn:stjMAgqb4rJGsMszA+2QocKY/gZ
MD5:	A83F8C1248A48E7825AE3C2AE2A62727
SHA1:	31FBD35446523C491EB54C0F3158734D46616446
SHA-256:	6F2BBD111C3BF110DEF55FF773A3417159D64EABFDE6CE8896995DF5AAF95968
SHA-512:	90896553A58030E7A0EBC2CC7889CEED0B34AB1E5B4FCFC899F86017F6FCBADE4164302FA53DA586067E685803889DBE33D6698AFE3D35766A1A9DEF32DA369E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/Main/master.css
Preview:	./-----------------------------------------------------------------------.[Master Stylesheet]..Project:...CREFI-1889 eFax UK - Sitefinity Migration.Version:...1.1.Primary use:..All web pages templates.Lead Designer:..Josef Lagunas <josef.lagunas@j2.com> @ j2 Global, Inc..------------------------------------------------------------------------/.@import 'bootstrap.css';.@import 'efax-style.css';.@import 'responsive-layouts.css';./----------------------------------------------------------------------/

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\mem5YaGs126MiZpBA-UN_r8OUuhv[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 18668, version 1.1
Category:	downloaded
Size (bytes):	18668
Entropy (8bit):	7.969106009002288
Encrypted:	false
SSDEEP:	384:Wv4QHZChiRh3lwLOf8cWN78NXpcr6gBUA9CD/q4cOPZmPO:WvwhNOkvvxC7qnc
MD5:	A7622F60C56DDD5301549A786B54E6E6
SHA1:	D55574524345932DB3968C675E1AEA08C68A456F
SHA-256:	6E8A28A0638C920E5B76177E5F03BA94FCDEDD3E3ECD347C333D82876B51C9C0
SHA-512:	1A842E5EDFFFFBAE353AD16545D9886E3E176755F22B86ECCC9B8B010FC79DB7194B7C5518CC190BF5B78B332C7D542B70A6A53B3BAF23366708DF348C2C2D49
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/opensans/v18/mem5YaGs126MiZpBA-UN_r8OUuhv.woff
Preview:	wOFF......H.......n0........................GDEF................GPOS................GSUB.......X...t...OS/2.......^...`}...cmap...`.........X..cvt .......]........fpgm...t........~a..gasp...............#glyf... ..8...WP..M.head..@....6...6..F.hhea..A........$...chmtx..A8.........._{loca..CL........K.4&maxp..E.... ... ....name..E0........"c?Jpost..F........x.U..prep..G........:..]........................................x...5.A......m."gW..`.L..&N".?.......IF....a.^...b1..................Uh."4...>..=x.c`fig.a`e``..j...(.../2.1..`b.ffcfeabbi``Pg``..b.. 0t.vfp`P...M...C.G/S....\|...=.6 .....m/....x.\.!..q......#aff...#1Q@.'U..@5.".llt.Aa#.f\|c.W.....'..X..!..C...ITPE.;..V.j......0. .L0E...Yd.mN....:.....F....GG.g.s,x.>0....v..I;o..<.$G9.\f2...e(}.IS2..uc]p.........M.x.c.a.g.c..$K..$..`.g.e........ .......R.g......?......x.)d...........$...."....0.#.A@X..0......x.uTGw.F........)..)7.W.$`*.....G.Kz.)e....t.\|.1.7...s.g...3.7mgf..~{1...s.3.S...co..o.~.Zy.u...kW.\.t...N

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\navcancl[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	4.1712007174415895
Encrypted:	false
SSDEEP:	24:r3avxU5hzsIVmVMeLmVMyHf63lboxMCLxvriN6LOAPAnQay78eLx5Tb87nVkEhML:upU0GVeLVGBXvrp4n/1a5TI7Ve/G79KX
MD5:	4BCFE9F8DB04948CDDB5E31FE6A7F984
SHA1:	42464C70FC16F3F361C2419751ACD57D51613CDF
SHA-256:	BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228
SHA-512:	BB0EF3D32310644285F4062AD5F27F30649C04C5A442361A5DBE3672BD8CB585160187070872A31D9F30B70397D81449623510365A371E73BDA580E00EEF0E4E
Malicious:	false
Reputation:	low
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html>.... <head>.. <link rel="stylesheet" type="text/css" href="res://ieframe.dll/ErrorPageTemplate.css" />.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.... <title>Navigation Canceled</title>.... <script src="res://ieframe.dll/errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="res://ieframe.dll/httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:navCancelInit(); ">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="res://ieframe.dll/info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\navcancl[2] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	2713
Entropy (8bit):	4.1712007174415895
Encrypted:	false
SSDEEP:	24:r3avxU5hzsIVmVMeLmVMyHf63lboxMCLxvriN6LOAPAnQay78eLx5Tb87nVkEhML:upU0GVeLVGBXvrp4n/1a5TI7Ve/G79KX
MD5:	4BCFE9F8DB04948CDDB5E31FE6A7F984
SHA1:	42464C70FC16F3F361C2419751ACD57D51613CDF
SHA-256:	BEE0439FCF31DE76D6E2D7FD377A24A34AC8763D5BF4114DA5E1663009E24228
SHA-512:	BB0EF3D32310644285F4062AD5F27F30649C04C5A442361A5DBE3672BD8CB585160187070872A31D9F30B70397D81449623510365A371E73BDA580E00EEF0E4E
Malicious:	false
Reputation:	low
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html>.... <head>.. <link rel="stylesheet" type="text/css" href="res://ieframe.dll/ErrorPageTemplate.css" />.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8" />.... <title>Navigation Canceled</title>.... <script src="res://ieframe.dll/errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="res://ieframe.dll/httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="javascript:navCancelInit(); ">.... <table width="730" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="res://ieframe.dll/info_48.png" id="infoIcon" alt="Info icon">..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\otherJS[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	26684
Entropy (8bit):	5.186112575414752
Encrypted:	false
SSDEEP:	384:3AbuHqdvZIL8XNY9QhyyJNPr/VW9KYXpvjgvOcAbX6Gi6Qyef8064:QbuHqbKQhyyJxVKKYXh+GhQjf8064
MD5:	EE52B8CCCFC0F8CD593093BC2AAAA7A6
SHA1:	2DAA4C75D95FB3A384BB3DF96346751F9D9FAF10
SHA-256:	1E367BA82EEEA175FE6CECFA02CCD5B74D8AF9B71DD0D7FDA78360618AB5ACBC
SHA-512:	514999FD114E3823B21646FB034F502E2A923ED3714F3C9F34854854481419F12B834D894E5EB28BBB2D40B66D2336D5EA9878032B8F0DFAF8059E32964BCD18
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/otherJS?v=hHM3DlZUvplgAlLoAyquzfzdAkhMknu9T4ae94Qgcp81
Preview:	typeof Object.create!="function"&&(Object.create=function(n){function t(){}return t.prototype=n,new t}),function(n,t,i){var r={init:function(t,i){var r=this;r.$elem=n(i);r.options=n.extend({},n.fn.owlCarousel.options,r.$elem.data(),t);r.userOptions=t;r.loadContent()},loadContent:function(){function r(n){var i,r="";if(typeof t.options.jsonSuccess=="function")t.options.jsonSuccess.apply(this,[n]);else{for(i in n.owl)n.owl.hasOwnProperty(i)&&(r+=n.owl[i].item);t.$elem.html(r)}t.logIn()}var t=this,i;typeof t.options.beforeInit=="function"&&t.options.beforeInit.apply(this,[t.$elem]);typeof t.options.jsonPath=="string"?(i=t.options.jsonPath,n.getJSON(i,r)):t.logIn()},logIn:function(){var n=this;n.$elem.data("owl-originalStyles",n.$elem.attr("style")).data("owl-originalClasses",n.$elem.attr("class"));n.$elem.css({opacity:0});n.orignalItems=n.options.items;n.checkBrowser();n.wrapperWidth=0;n.checkVisible=null;n.setVars()},setVars:function(){var n=this;if(n.$elem.children().length===0)return!1;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\phoneIcon[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 26 x 23
Category:	downloaded
Size (bytes):	1155
Entropy (8bit):	7.602849121326505
Encrypted:	false
SSDEEP:	24:JOUjlQBSgI2FXhsAkg7rw70PrGtgk+Bl2Dk/1eZo8dqW7WOwYj1Hxe:JDjleSgIgXyAr7k70D05+Bln/oZM81HY
MD5:	45C4E2FAAD66529F3ECD0FB46F33F383
SHA1:	2805FE1A8D6C31A3A32E71A2E17646E13EDA661A
SHA-256:	1B1343066B1DDEF17584A96380F29F1B021CF0A05E01E639EE41CD47BEE7D77D
SHA-512:	0C684B2F261D12DE875E54EDE909EF415DBE8301934B48A0E09AD05E73917D550872476FAB17CD88EAB8686D26ED2C2B7943A4DAE9AF830AAA71C9EDDA8C5C87
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/phoneIcon.gif
Preview:	GIF89a.......tuw...........nnp..................657............R........654.............TTV....#..........D..G...o......m..xx\|..................{....................I................q......dcf8..efebbc...A..E........+....XXZ.............{\|.EEI...................b..j.......opq......lkjh..4..zz~............stw...rqq............a..'...KJN.................................QQSPPRR.....ijmkkm............E.....2.....qno...=.....y...................#..NNP.........llm...u..u.............................................`..<;>....545...100UUW\|..S............HIL...y.........MMP..............=.................qqu......102.........KKML........#................g.............................'&(..........................................!.......,...............H..k..*\.0..%ChMc8..:B.N(46..HsDe.(..e.\...j@.#.8p....... .84P.F#Z]9..D..v..H.c.@<w.....Dl..2...7..F.E.M.M].-B".!..}nhp$.......(sF.8Y..\|.`...K....m../..P......D.....b...n!,(\|lyq.#J.8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\topNav_left[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 10 x 30
Category:	downloaded
Size (bytes):	393
Entropy (8bit):	6.145033440466965
Encrypted:	false
SSDEEP:	6:5Yfx2hl1ErdEqgfVuvqttLwVoYDFs1AXB8cZDldcFo2+keH/:5Yg1yxqttLwVoYZdB822Zu/
MD5:	E6CEB6C0C195B942BAD0D991BBE48881
SHA1:	D3F4B05ABADEF6599616E73CEF59C41CB692B22A
SHA-256:	E178D9FDF0D2EE57DE18754A41B72F5F0A2A341942F522AB77B8449CFED7738C
SHA-512:	3CB10442D5F1617932828C0A3B215512902D27CAB6BC346AAB2C5961522E44C9C6289CAC168D7366F01CF6D5A1BC2A082DBEC83ED258781B243D8F3C922E7E6D
Malicious:	false
Reputation:	low
IE Cache URL:	https://en2.efax.com/myaccount/images/navigation/topNav_left.gif
Preview:	GIF89a....................................................................................................................................................................................................!......,...........@.pXHy.C...:\|@.i.....N...P.jGC...@f..................u....u....u....u....u....u....u....u....u....u....u....u....u....u....u................."..........u.........A.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\trio-615x297[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 645 x 297, 8-bit/color RGBA, interlaced
Category:	downloaded
Size (bytes):	222159
Entropy (8bit):	7.997577767199496
Encrypted:	true
SSDEEP:	6144:LU+UPuo8Ooudpd1XjLFKM61Y5KJ5csZEdgT+unTWm:LU9o9u73z5KM61Y5C5crU
MD5:	179EAC573135B0E3BFB12E18738BAFDD
SHA1:	A318542265CDAB8053370A6D0D551A2CA73C9CED
SHA-256:	CEE0A33E90137A1AD6FAC10437CB761239EB8AF40A3E876E4E205E4FAFEF453F
SHA-512:	8B1221FEE81771AEE9836F0671FA5C191774CE18144EDF9F00871DAD6609EC3C287B5A37A2DC83820E9A7D6B3A9E559B7AC049BEA05C13B05DCB367DD9DE573D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ch/App_Themes/images/trio-615x297.png
Preview:	.PNG........IHDR.......).......hJ....tEXtSoftware.Adobe ImageReadyq.e<..cqIDATx..Z{t......w.y..G......D.>V.k.]O...VPq..{...j..=..R9.X.==].V..U.DT....B.D..!......{....wf~.K....?../......>.U.cp..O.t.>=..R.._..`0L.L.T...R.?)~n.P.~..I.:a....b....Fm&.Im...........uwtu.oX._.:.}.......o..t.KkXMM5..p.?.....h.+F%5.......=~...P.,.0.s.I`.5.0.}.P.V7..>{..........f(N......@Q...G..`..?..r ./EI..(.R...4...\|.8...y.Yk.....GV.M....SgL..I.T...fa..(0!..}R-((-8...S...a.i....,..)... o...#....`"#...$......R./p...l.....[^>..XLLB.....k....D.. .....NR.7x& Hu.A.BU,1w.m.v..S.\t....]41..q.@7....h_{.m.....d...:.o:..,.!.i..B.....E..G......g.@.....X.:<p.}.T...3.w.)a..dL....V).g.30.....3\.Y.y...e&T.,5#.!..?..._}.O.94..enB.:.C&"...S.O..p.\|......b.uE.mP...\^SKlL34c...T2..Y..}.5.)...-.G....8..fK..BU.~E......k_.C...p1S. g..:.9.0 @.,.W.1.=.P.....>$V?...x}..c9..N.....L...S..4A^...p..AR..Xc....e.d[..i.G..pM.....m&.Z.g...}*....B....V.....-.o..1...........#....B.G."..u.>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\va-3f0c180483cb4e78e02f988160e89ee1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	212332
Entropy (8bit):	5.478990851131235
Encrypted:	false
SSDEEP:	3072:Ynfj9YvAPb9/N03oa+MhBGF4l8i4k80GVkjSCIWw+/dyr+ty+p:6ZTb9/N0lfGF4lz4k80GVkjSCLZtrp
MD5:	937AF770512C46D7734E2D9F822251A2
SHA1:	D61FC889F0CB8FEFC17DF9E3E804E590268D7E2D
SHA-256:	D2047DCA7DFBDE66A624F5C159A3304F163B9B836A341E1195C048F1017BCB2B
SHA-512:	9C330247CEFA6F1A37E1EEDFCB25318A705A7C906B5E1F9E6C2B0AFBC03B67C0F97207300A1E115D569FDC943F1BA21F0BB600F19D7607D1FBD4DD946A44C8FB
Malicious:	false
Reputation:	low
IE Cache URL:	https://dev.visualwebsiteoptimizer.com/7.0/va-3f0c180483cb4e78e02f988160e89ee1.js
Preview:	/*. This file uses jQuery materials and hashchange plugin licensed under the MIT license. * Portions, Copyright (c) 2010 "Cowboy" Ben Alman. * http://benalman.com/projects/jquery-hashchange-plugin/. * Portions, Copyright 2012 jQueryFoundation and other contributors. * http://jquery.com/. * Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated. * documentation files (the "Software"), to deal in the Software without restriction, including without limitation the. * rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to. * permit persons to whom the Software is furnished to do so, subject to the following conditions:. . The above copyright notice and this permission notice shall be included in all copies or substantial portions of the. * Software.. . THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE. * WA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\widgetJS[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	35238
Entropy (8bit):	5.189378916180564
Encrypted:	false
SSDEEP:	768:iAQlUE770aG3V8RJRVGuU2BBY0qFFA0J405d3TWtB:iTlUE770aG3GbYRF+30jg
MD5:	494C720EA7CC5AFCD9A1D8E4782AF560
SHA1:	AFDB2C8681A4DE534D368F11C910FD572C82E057
SHA-256:	93555DAF74DF9FCB89CF22051468E74DCE340E767A0A5DCE1240CD036E596A7D
SHA-512:	A81A20D9481922B0A7060ADD7F649A51AFC2270EC1ACD44F9E7D953703106BE8625FA2531303C36F916014BD011EF8CA45B9B69F4C394544EFFFED3197A308FC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.efax.ca/bundles/widgetJS?v=Cf6jqfCY0RoTJSQcPjfqrdSpCx-MRx1P5AgOPmDRiK01
Preview:	(function(n){typeof define=="function"&&define.amd?define(["jquery"],n):typeof exports=="object"?n(require("jquery")):n(jQuery)})(function(n){function i(n){return t.raw?n:encodeURIComponent(n)}function u(n){return t.raw?n:decodeURIComponent(n)}function f(n){return i(t.json?JSON.stringify(n):String(n))}function e(n){n.indexOf('"')===0&&(n=n.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return n=decodeURIComponent(n.replace(o," ")),t.json?JSON.parse(n):n}catch(i){}}function r(i,r){var u=t.raw?i:e(i);return n.isFunction(r)?r(u):u}var o=/\+/g,t=n.cookie=function(e,o,s){var y,a,h,v,c,p;if(o!==undefined&&!n.isFunction(o))return s=n.extend({},t.defaults,s),typeof s.expires=="number"&&(y=s.expires,a=s.expires=new Date,a.setTime(+a+y*864e5)),document.cookie=[i(e),"=",f(o),s.expires?"; expires="+s.expires.toUTCString():"",s.path?"; path="+s.path:"",s.domain?"; domain="+s.domain:"",s.secure?"; secure":"",s.samesite?"; samesite="+s.samesite:""].join("");for(h=e?undefined:{},v=document

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\www-player[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	344488
Entropy (8bit):	5.2421579568015915
Encrypted:	false
SSDEEP:	1536:Kzu9IdYR9WDQI0irpHrp3/fn8MZv8M5q4ay95G0hXkTNROP5kRrDJciM/By2N+CZ:Kzu99F7ZBgFyV1u3
MD5:	934E57A0B55A6997EF408E22C2946AD3
SHA1:	90AC3BA5EBC1D8C19C37DB6CF21D0DCBB44CEFAB
SHA-256:	0D450A63AFAE6834E1DE8559245EFCEEFB49738F8BCD13889F929DCFB6AF4001
SHA-512:	097D6B60E0C6236C8D8270A7A27E8E0F4B38C027BFCCFC08E0F5A5A46321B9A1DA63A28FDBD4EF082C1681530E245870645F3A5D672F986F1F960C18C9009F94
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/c6df6ed7/www-player.css
Preview:	.html5-video-player{position:relative;width:100%;height:100%;overflow:hidden;z-index:0;outline:0;font-family:"YouTube Noto",Roboto,Arial,Helvetica,sans-serif;color:#eee;text-align:left;direction:ltr;font-size:11px;line-height:1.3;-webkit-font-smoothing:antialiased;-webkit-tap-highlight-color:rgba(0,0,0,0);touch-action:manipulation;-ms-high-contrast-adjust:none}.html5-video-player:not(.ytp-transparent),.html5-video-player.unstarted-mode,.html5-video-player.ad-showing,.html5-video-player.ended-mode,.html5-video-player.ytp-fullscreen{background-color:#000}.ytp-big-mode{font-size:17px}.ytp-autohide{cursor:none}.html5-video-player a{color:inherit;text-decoration:none;-moz-transition:color .1s cubic-bezier(0.0,0.0,0.2,1);-webkit-transition:color .1s cubic-bezier(0.0,0.0,0.2,1);transition:color .1s cubic-bezier(0.0,0.0,0.2,1);outline:0}.html5-video-player a:hover{color:#fff;-moz-transition:color .1s cubic-bezier(0.4,0.0,1,1);-webkit-transition:color .1s cubic-bezier(0.4,0.0,1,1);transition:co

C:\Users\user\AppData\Local\Temp\~DF33E658DB61EBF325.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	217972
Entropy (8bit):	2.127533711531179
Encrypted:	false
SSDEEP:	768:/ML2ScnAZCxJL2ScnAZCxWjS3W570MV0MzSnUQWFm+TgGesjYMpvThQcGYMpvThn:i9CH9C6hqe/ua+p
MD5:	11CED2F800AB9758A806BEE5C6727EC7
SHA1:	F00D54260DC99A87D1BEC00C87C1EC046D0D9D4D
SHA-256:	AAF6C2D31616ACE02BCB10C5E45DF1BB2358B5A4D65C661DE33447D5792D6705
SHA-512:	323BA315444F5DFE540F8C844DE8B65A3643DD59CDE81F414264E71F43C7F97263A9C60395A943111EBC1DF2E706A7767D27FE22BC081C87F9B241388E7C17EF
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF3F2F36FBBBF41920.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.9132150639996625
Encrypted:	false
SSDEEP:	96:kBqoxDhHWSVSE+5CK7VNvol+5WhbTjFRKd98J4TCSPk:kBqoxDhHjgE+5CKMl+OBIEJdSs
MD5:	C89805923472C55F138989A26F82DEED
SHA1:	976F7416479555A6E7442D38D6EA5D50BD80FAFE
SHA-256:	CE8D55490056AC6335F5223E13AC55D25E023F0DD3E2E25A0A7972C9A197C3CE
SHA-512:	40C3BEEDE5770DF4AADA4FEEAFC84279600EFA6F14141A4103E8963C632ABB38EFAB7469646CA5582B6742BC2745E4F9CC03AD8E18EE732F87A88C011E1DE7CD
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFC70EEBD402160F5D.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.4784160034256791
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loES9loEC9lWEASMVSZ7ZOCyVCy3:kBqoIEdEbEASMVSZ7ZOfVf3
MD5:	9072A6DB1203F9D87FDC28AB83656EA9
SHA1:	95CEB404C40231C59774951C3EBCA63837867BA7
SHA-256:	89BDDD7B2F743AD3FFE2466DBF50918DABCD25A840839846A8B0BB0C211EF9AE
SHA-512:	0D1A5B283F6073034260BDDDFC02790C3688E68E5ECBE6BB545A7FFC6CAD4A34FE0B939B9B8AF1E6534FDA6BA2CE29AC75A1B86ECB6DAB2A36510595A669C568
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\F9WFIU04PMUGVF6FIGQ0.temp Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5149
Entropy (8bit):	3.178395175732872
Encrypted:	false
SSDEEP:	48:idiTPRIdC9GrIoKAsASFDxdiTPRIdh683GrIoKAczExdiTPRIdx9GrIoKAV1H:5PRL9SqAJLPRo3SqAaPRc9SqAf
MD5:	01B0949514F5C627A991F8CDA840E994
SHA1:	12EB4AD3591BE7E1E3F8B5369346876D0F89EF05
SHA-256:	5C37229B035F1B1ADA8CF335115031251522F1BEA07221A1F199A7F82DFA8BC0
SHA-512:	AD0246DACF84E920AFC4B6D805AB67044BA7BAF8B5DE6DD7FCE52B849C236033319F6E798EDDE980891EA954851C3CCADDCD9407355715F732D22C985323FCF7
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. .....@.>.....r.V.....?.c................................P.O. .:i.....+00.../C:\.....................1.....>Q.;..PROGRA~1..t......L.>Qr<....E...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......L.J..INTERN~1..T......L.;RT...............................i.n.t.e.r.n.e.t. .e.x.p.l.o.r.e.r.....f.2......L.9 .iexplore.exe..J......L.J;RT......R..........x.............i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...........S..~.....C:\Program Files\internet explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 03:43:01.343991041 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.344934940 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.378936052 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.379125118 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.380258083 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.382509947 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.382627964 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.383304119 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.415241003 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.416393042 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.416439056 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.416460037 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.416491032 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.416492939 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.416536093 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.416563034 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.416666031 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.420895100 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.421951056 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.421993017 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.422019958 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.422030926 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.422079086 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.422084093 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.422091007 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.422132015 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.426574945 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.427299976 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.427546024 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.431181908 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.431533098 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.463021040 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.463062048 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.463088036 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.463104010 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.463119030 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.463143110 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.463818073 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.466449022 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.466489077 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.466526031 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.466547012 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.466563940 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.466690063 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.469156981 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.469279051 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.469566107 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.469624043 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.470369101 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.470428944 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.473526001 CET	49752	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.475691080 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.488986015 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.512090921 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.513700962 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.513732910 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.513775110 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.513789892 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529249907 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529314995 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529356956 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529491901 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529511929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529520988 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529524088 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529531956 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529546022 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529572010 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529609919 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529645920 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529649019 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529654026 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529655933 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529684067 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529714108 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529730082 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.529778004 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.529855967 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.551182032 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.551235914 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.551275015 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.551304102 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.551314116 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.551316023 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.551316023 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.551367044 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.556497097 CET	443	49752	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.565721035 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.565762043 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.565794945 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.565809011 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.565820932 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.565851927 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.565918922 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.565932989 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566148996 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566190958 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566320896 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566375017 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566405058 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566447973 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566485882 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566509008 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566520929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566525936 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566528082 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566633940 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566662073 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566672087 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.566677094 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566764116 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.566951990 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567003012 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567042112 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567080975 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567157984 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567174911 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567187071 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567193985 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567224026 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567336082 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567353010 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567392111 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567430019 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.567482948 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567495108 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.567502975 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.587918997 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.587992907 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588022947 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588054895 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588109016 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588125944 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588184118 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588239908 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588279009 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588344097 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588382006 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.588407993 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588413954 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588417053 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.588419914 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602232933 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602289915 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602307081 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602329016 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602377892 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602377892 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602381945 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602485895 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602515936 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602523088 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602586985 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602669001 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602834940 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602874041 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602896929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.602911949 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.602929115 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603002071 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603082895 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603199959 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603240013 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603260994 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603276014 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603276968 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603328943 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603346109 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603368998 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603410006 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603446960 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603492975 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603497028 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603502035 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603534937 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603570938 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603576899 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603585958 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603601933 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603641033 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603676081 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603701115 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603705883 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603732109 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603768110 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603810072 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603877068 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603892088 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603895903 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603914976 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.603939056 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.603972912 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604058981 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604098082 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604151964 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604156017 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604161024 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604198933 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604221106 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604244947 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604262114 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604310989 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604355097 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604393005 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604428053 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604432106 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604434967 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604460001 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604496956 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604523897 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604559898 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604605913 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604621887 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604626894 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604629040 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604649067 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.604665041 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.604743958 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624488115 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624541998 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624579906 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624599934 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624618053 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624644995 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624650955 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624655008 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624665022 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624694109 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624784946 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624787092 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624795914 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624830008 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624923944 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.624928951 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624939919 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.624963045 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625056028 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625082016 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625087023 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625097990 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625106096 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625137091 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625149012 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625174999 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625190973 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625212908 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625245094 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625262976 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.625279903 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.625621080 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638439894 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638542891 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638634920 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638673067 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638689995 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638711929 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638751984 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638787031 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638823986 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638827085 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638837099 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638840914 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638844967 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638860941 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638873100 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638909101 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638935089 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638952971 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.638955116 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.638989925 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639046907 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639056921 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639062881 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639100075 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639137030 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639236927 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639271021 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639286041 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639295101 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639302015 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639302969 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639342070 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639429092 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639437914 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639451027 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639514923 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639554024 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639591932 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639626026 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639637947 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639650106 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639657021 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639667034 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639709949 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639746904 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639763117 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639774084 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639786005 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639795065 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639825106 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.639950991 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639961958 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.639995098 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640036106 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640141964 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640146971 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640158892 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640188932 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640212059 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640230894 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640242100 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640285015 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640297890 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640336990 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640363932 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640373945 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640394926 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640414000 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640431881 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640451908 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640499115 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640523911 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640533924 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640539885 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640542984 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640598059 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640607119 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640670061 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640727043 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640737057 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640760899 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640804052 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640868902 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640882015 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640892982 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.640908003 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.640944958 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641001940 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641005993 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641016006 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641022921 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641055107 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641096115 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641133070 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641182899 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641195059 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641197920 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641205072 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641211987 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641235113 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641273022 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641283035 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641290903 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641309977 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641371012 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641402006 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.641408920 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.641452074 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.642903090 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.642956018 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.642997980 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643035889 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643074036 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643076897 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643095016 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643100023 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643105984 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643110991 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643146992 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643182993 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643201113 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643209934 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643215895 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643219948 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643265963 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643306971 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643341064 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643343925 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643348932 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643353939 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643357992 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643382072 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643419981 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643454075 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:01.643476963 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643486977 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643501043 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.643508911 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:01.669120073 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.669199944 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.685688019 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.685739994 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.685769081 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.685846090 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.707523108 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.707937956 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.723476887 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.723876953 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.724189997 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.724231958 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.724294901 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.724329948 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.724533081 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.724571943 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:01.725167990 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:01.725193977 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.008249998 CET	49759	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.009939909 CET	49760	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.011181116 CET	49761	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.059829950 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.063410997 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.074875116 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.075174093 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.075206995 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.075393915 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.075423956 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.078344107 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.078375101 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.078737974 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.078803062 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.078816891 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.078881979 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.081908941 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.084462881 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.084510088 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.084518909 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.093354940 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.093481064 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.093738079 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.096889019 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.096930981 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.097014904 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.099950075 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.100106955 CET	49755	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.108953953 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.108985901 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109020948 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109070063 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109100103 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109103918 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109129906 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109134912 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109138012 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109165907 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109188080 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109203100 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109227896 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109256983 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109282017 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.109296083 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109308958 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109314919 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109321117 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109325886 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.109329939 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.112987995 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.113018036 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.113044977 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.113069057 CET	443	49757	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.113114119 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.113137007 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.113142967 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.113147020 CET	49757	443	192.168.2.4	104.16.19.94
Jan 27, 2021 03:43:02.155252934 CET	443	49755	104.16.19.94	192.168.2.4
Jan 27, 2021 03:43:02.160486937 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.161417007 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.162626028 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.163158894 CET	80	49759	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.163304090 CET	49759	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.163733959 CET	49759	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.164799929 CET	80	49760	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.164899111 CET	49760	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.165318012 CET	49760	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.165740013 CET	80	49761	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.165834904 CET	49761	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.166213989 CET	49761	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.197144985 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.201311111 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.201359987 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.201488972 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.201534986 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202224016 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202266932 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202306032 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202343941 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202383041 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202385902 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202397108 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202402115 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202405930 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202420950 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.202580929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.202605009 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.213931084 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.213993073 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214035988 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214073896 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214122057 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214123011 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214142084 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214147091 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214150906 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214164972 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214186907 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214205027 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214238882 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214242935 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214267969 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214282990 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214320898 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214359045 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214418888 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214448929 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214461088 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214473009 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214478970 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214483976 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214487076 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214488029 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214524031 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214560032 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214562893 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214566946 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214571953 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214600086 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214628935 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214647055 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214657068 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214688063 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214728117 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214736938 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214749098 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214756966 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.214983940 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.214993954 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.285054922 CET	49760	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.285156965 CET	49761	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.285218000 CET	49759	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.288530111 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.291649103 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.316268921 CET	80	49759	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.316359043 CET	49759	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.317784071 CET	80	49760	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.317850113 CET	49760	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.318526030 CET	80	49761	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:02.318675995 CET	49761	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:02.327250957 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327310085 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327348948 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327374935 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327388048 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327392101 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327398062 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327425957 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327459097 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327475071 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327483892 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327517986 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327557087 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327580929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327594042 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327594995 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327600002 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327634096 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327667952 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327719927 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327721119 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327784061 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327795982 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327838898 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327845097 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327877045 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327903986 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.327915907 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.327954054 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328003883 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328013897 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328021049 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328222990 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328299046 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328402996 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328439951 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328478098 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328516960 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328553915 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328563929 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328563929 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.328569889 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328574896 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328743935 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.328979015 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329029083 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329072952 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329113007 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329149008 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329153061 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329159021 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329164982 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329191923 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329317093 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329340935 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329349041 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329494953 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329533100 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329602003 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329644918 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329684019 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329685926 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329694033 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329698086 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329701900 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329722881 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329874039 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329914093 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329936981 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329943895 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329948902 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.329952955 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.329953909 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330017090 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330019951 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330054998 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330104113 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330208063 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330219030 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330228090 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330585003 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330625057 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330666065 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330682993 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330735922 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330806971 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330845118 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330883980 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330921888 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.330923080 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330935001 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330943108 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330948114 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.330971956 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331125021 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331135035 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331161022 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331198931 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331233025 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331238985 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331269026 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331278086 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331295013 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331326008 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331368923 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331567049 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331593037 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331600904 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331695080 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331732035 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331780910 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331825018 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331862926 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.331862926 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331871033 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331875086 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331880093 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.331902027 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332077026 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332098961 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332205057 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332252979 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332295895 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332334042 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332371950 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332371950 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332381010 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332385063 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332390070 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332411051 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332566023 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332582951 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332688093 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332784891 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332825899 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332864046 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332902908 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332905054 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332915068 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332921028 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.332950115 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.332993031 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333030939 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333049059 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333055973 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333065033 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333069086 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333070993 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333072901 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333111048 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333129883 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333149910 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333189011 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333307028 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333321095 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333331108 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333364010 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333429098 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333467960 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333491087 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333498955 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333508015 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333538055 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333545923 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333575964 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333594084 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333600044 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333722115 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333733082 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333774090 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333794117 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333815098 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333833933 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.333856106 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333894968 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.333934069 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.334000111 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.334005117 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334016085 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334021091 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334024906 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334048986 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334048986 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.334095955 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.334129095 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:02.334541082 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334563017 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.334569931 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:02.785381079 CET	49762	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:02.789642096 CET	49763	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:02.937988043 CET	80	49762	204.11.168.165	192.168.2.4
Jan 27, 2021 03:43:02.938167095 CET	49762	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:02.939223051 CET	49762	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:02.942097902 CET	80	49763	204.11.168.165	192.168.2.4
Jan 27, 2021 03:43:02.942213058 CET	49763	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:03.092957973 CET	80	49762	204.11.168.165	192.168.2.4
Jan 27, 2021 03:43:03.093070984 CET	49762	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:03.093187094 CET	49762	80	192.168.2.4	204.11.168.165
Jan 27, 2021 03:43:03.248454094 CET	80	49762	204.11.168.165	192.168.2.4
Jan 27, 2021 03:43:03.727381945 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.764216900 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:03.764262915 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:03.764295101 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.764388084 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.764482021 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:03.764538050 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.795620918 CET	49768	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:03.796263933 CET	49769	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:03.798679113 CET	49770	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:03.877031088 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.915704012 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:03.915787935 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.915813923 CET	443	49751	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:03.915889978 CET	49751	443	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:03.950582027 CET	80	49768	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:03.950817108 CET	49768	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:03.950906992 CET	80	49769	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:03.950994968 CET	49769	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:03.953507900 CET	80	49770	204.11.168.2	192.168.2.4
Jan 27, 2021 03:43:03.953685045 CET	49770	80	192.168.2.4	204.11.168.2
Jan 27, 2021 03:43:04.526556015 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:04.564579010 CET	80	49771	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:04.564683914 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:04.565315962 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:04.603159904 CET	80	49771	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:04.605426073 CET	80	49771	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:04.605526924 CET	80	49771	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:04.605556965 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:04.605597973 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:04.605715036 CET	80	49771	108.128.28.146	192.168.2.4
Jan 27, 2021 03:43:04.605784893 CET	49771	80	192.168.2.4	108.128.28.146
Jan 27, 2021 03:43:06.875026941 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.875190020 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.880649090 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.882544041 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.889992952 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.890088081 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.890114069 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.890250921 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.890846014 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.891352892 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.905873060 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906120062 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906738043 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906778097 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906814098 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906822920 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.906846046 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.906850100 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.906877995 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.906949043 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.907300949 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.907339096 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.907386065 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.907398939 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.907418013 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.907422066 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.907423019 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.907480001 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.907978058 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.908070087 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.908926010 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.909127951 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.909209967 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.909972906 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.916472912 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.916842937 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.916958094 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.917201042 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.917612076 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.931518078 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.931546926 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.931619883 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.931643009 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.931765079 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.931818008 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.932109118 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.932526112 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.932555914 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.932635069 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.932652950 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.932696104 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.932703018 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.933188915 CET	49784	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.935229063 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.935273886 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.935282946 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.935321093 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.935349941 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.935410023 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.935607910 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.935667992 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.935825109 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.936211109 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.936512947 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938402891 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938443899 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938481092 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938503981 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.938538074 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.938544989 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.938714981 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938754082 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938780069 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.938787937 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.938798904 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.938843966 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.939905882 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.949224949 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.949640036 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.949928999 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.950139046 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.950268030 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.950495005 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.951690912 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.952286005 CET	443	49784	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.952558994 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.953216076 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.954727888 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.967139006 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.967236042 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.967770100 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.967781067 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.967921972 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.968002081 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.968450069 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.969461918 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.969526052 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.969527960 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.969589949 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.969724894 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.969794035 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.969820023 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.969851971 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.970758915 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.970801115 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.970840931 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.970865965 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.971784115 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.971826077 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.971859932 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.971885920 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.972825050 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.972865105 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.972902060 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.972923994 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.973901987 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.973942041 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.973984003 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.974008083 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.974919081 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.974958897 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.974997997 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.975022078 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.975980997 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.976022959 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.976049900 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.976073027 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.976428986 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.976979017 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977019072 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.977056026 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.977081060 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.977082014 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977101088 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.977108002 CET	443	49789	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977133036 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.977152109 CET	49789	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.977530003 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977555990 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977622986 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.977633953 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.977689981 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978054047 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.978096008 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.978132010 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.978132963 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978176117 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978180885 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.978204966 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978218079 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978221893 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978245020 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978306055 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978313923 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978354931 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978363991 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978399992 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978414059 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978440046 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978451014 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978468895 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978498936 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978517056 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978538036 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978585005 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978620052 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978657961 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978684902 CET	443	49788	161.71.1.166	192.168.2.4
Jan 27, 2021 03:43:06.978683949 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978720903 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.978730917 CET	49788	443	192.168.2.4	161.71.1.166
Jan 27, 2021 03:43:06.979077101 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.979139090 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.984375954 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.984416962 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.984457016 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.984481096 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.984869957 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.984906912 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.984934092 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.984956980 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.985518932 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.985785961 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.985897064 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.985937119 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.985968113 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.985991001 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.987021923 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.987071037 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.987097979 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.987122059 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.988024950 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.988065958 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.988090992 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.988114119 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.989053011 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.989094973 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.989109993 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.989141941 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.990101099 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.990139008 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.990174055 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.990197897 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.991121054 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.991162062 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.991192102 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.991215944 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.992178917 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.992218018 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.992249012 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.992274046 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.993256092 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.993297100 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.993326902 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.993350983 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.994294882 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.994337082 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.994362116 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.994386911 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.995194912 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.995233059 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.995251894 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.995276928 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.995953083 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.996004105 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.996006012 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.996054888 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.996741056 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.996783018 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.996814966 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.996835947 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.997582912 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.997621059 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.997644901 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.997670889 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.998451948 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.998528957 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.998786926 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.998826981 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.998858929 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.998864889 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.998878002 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.998903036 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.998920918 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.998964071 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.999420881 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.999459982 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:06.999553919 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.999594927 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:06.999638081 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.999676943 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:06.999691963 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:06.999733925 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.000482082 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.000523090 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.000572920 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.000596046 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.001312017 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.001349926 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.001391888 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.001406908 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.001415014 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.001446962 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.001471043 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.001503944 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.001976013 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.002268076 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.002306938 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.002342939 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.002343893 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.002357960 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.002379894 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.002398968 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.002422094 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.003231049 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.003271103 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.003302097 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.003309965 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.003314972 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.003349066 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.003359079 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.003403902 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.004226923 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.004276037 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.004303932 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.004333973 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.004348040 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.004401922 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.004409075 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.004460096 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.005142927 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.005196095 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.005215883 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.005232096 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.005247116 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.005279064 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.005279064 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.005335093 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.006129980 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.006170034 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.006185055 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.006201982 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.006220102 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.006258965 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.008105993 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.008510113 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.008882999 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.009087086 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.009166956 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.009485006 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.014142036 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.021023035 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.026148081 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026176929 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026204109 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026238918 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026246071 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026285887 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026328087 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026374102 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026567936 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026603937 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.026635885 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026664019 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.026937008 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.027460098 CET	49791	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.031426907 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.042368889 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.042398930 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.042423010 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.042463064 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.042495012 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.043194056 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.044588089 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.049356937 CET	443	49791	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063121080 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.063432932 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063476086 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063515902 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063523054 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.063544035 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.063554049 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063556910 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.063591003 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063622952 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.063630104 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.063651085 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.063702106 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.064697981 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.064735889 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.064769030 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.064794064 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.065928936 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.065970898 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.066001892 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.067229033 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.067279100 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.067297935 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.067459106 CET	49790	443	192.168.2.4	172.217.20.226
Jan 27, 2021 03:43:07.089657068 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.090410948 CET	443	49790	172.217.20.226	192.168.2.4
Jan 27, 2021 03:43:07.104612112 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106333971 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106389999 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106426954 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106445074 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106467009 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106472969 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106473923 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106554031 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106599092 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106641054 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106669903 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106693029 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106698036 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106754065 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106766939 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106810093 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.106926918 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.106991053 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107084036 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107151031 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107203007 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107244968 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107264996 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107285023 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107299089 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107331991 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107353926 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107383966 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107671022 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.107728004 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.107923985 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:07.127873898 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:07.155114889 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.155242920 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.155913115 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.157114029 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.157140017 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.157238007 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.157246113 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.157799006 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.174627066 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.174659967 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.174717903 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.174762011 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.175545931 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.175621033 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.194506884 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.194546938 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206479073 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206525087 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206549883 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206605911 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.206654072 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.206659079 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.206763983 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206803083 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206830025 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.206842899 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.206876040 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.206885099 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.215349913 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.215497971 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.215861082 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.216015100 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.216078043 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.233073950 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.233104944 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.233131886 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.233155012 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.233185053 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.233211994 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.233227968 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.233239889 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.233846903 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.234308958 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.234426975 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.234472036 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.234508038 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.234529972 CET	49795	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.240060091 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.251986980 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.256999016 CET	443	49795	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.299452066 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.300859928 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.300983906 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.301039934 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.301086903 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.301104069 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.301137924 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.301189899 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.305314064 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.305363894 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.305417061 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.305428982 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.305470943 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.305536985 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.309873104 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.309953928 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.310247898 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.313812017 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.313863039 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.313882113 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.313914061 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.315370083 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.315450907 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.315464020 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.315521002 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.315696001 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:07.333127975 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:07.364417076 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.364480972 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.381831884 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.381921053 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.381956100 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.381994963 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.382601976 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.382703066 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.399995089 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.400684118 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.413578033 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.413626909 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.413697004 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.413738012 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.414341927 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.414382935 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.414582014 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.424187899 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.424276114 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.424837112 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.424994946 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.425060034 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.441708088 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.441771984 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.441773891 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.441840887 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442214966 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.442244053 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.442286968 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442315102 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442416906 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.442445993 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.442478895 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442508936 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442523956 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.442750931 CET	49796	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.447093010 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.452848911 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.452874899 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453138113 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453425884 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453505039 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.453638077 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453663111 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453704119 CET	443	49792	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.453716993 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.453738928 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.453752995 CET	49792	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.454128981 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.454168081 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.454200029 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.454222918 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.454243898 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.454269886 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.454292059 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.454319954 CET	443	49793	136.147.111.106	192.168.2.4
Jan 27, 2021 03:43:07.454334974 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.454377890 CET	49793	443	192.168.2.4	136.147.111.106
Jan 27, 2021 03:43:07.459922075 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.464488029 CET	443	49796	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.504020929 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.504055977 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.504081964 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.504106998 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.504115105 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.504152060 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.504167080 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.504446983 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:07.521869898 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:07.760054111 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.760107994 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.796792030 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.796823025 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.796866894 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.796916962 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.797817945 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.797956944 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.834489107 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834569931 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834588051 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834604025 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834615946 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834625006 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.834635973 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.834683895 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.834690094 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.835540056 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835556984 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835596085 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835598946 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.835613012 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835616112 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.835633993 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835645914 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.835649014 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.835664988 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.835704088 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.836550951 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.836566925 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.836638927 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.836663008 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.855520010 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.858099937 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.858201981 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.892575026 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.892723083 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.895261049 CET	443	49800	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.895302057 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.895353079 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.895354986 CET	49800	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.895392895 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.895426989 CET	443	49801	34.241.47.148	192.168.2.4
Jan 27, 2021 03:43:07.895432949 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.895469904 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.895476103 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:07.895479918 CET	49801	443	192.168.2.4	34.241.47.148
Jan 27, 2021 03:43:16.363922119 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:16.369821072 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.376055956 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.381591082 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.396297932 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.396435022 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.397413015 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.403058052 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.403143883 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.414295912 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.414330006 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.414462090 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:16.415115118 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.415143013 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.415186882 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:16.415230989 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:16.423607111 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.423960924 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.424029112 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.424058914 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.424069881 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.424122095 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.424127102 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.453918934 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.454070091 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:16.458234072 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.458611012 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.458992958 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.459144115 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.476639986 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:16.480745077 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.481081963 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.481115103 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.481136084 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.481148005 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.481161118 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.481187105 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.484493017 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.484518051 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.484579086 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.484627962 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.484778881 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.484823942 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.484973907 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.485630035 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.485671997 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.485683918 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.485722065 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.485761881 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.485807896 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.486097097 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.486114979 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.486140966 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.486156940 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.495318890 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.495371103 CET	49809	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.497071981 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.497508049 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.521342993 CET	443	49809	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.523904085 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.523952961 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.523967981 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.524009943 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.524082899 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:16.524128914 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.525250912 CET	49810	443	192.168.2.4	108.177.15.155
Jan 27, 2021 03:43:16.556085110 CET	443	49810	108.177.15.155	192.168.2.4
Jan 27, 2021 03:43:22.063107014 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:22.074764967 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.075872898 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.077456951 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.078455925 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.080379009 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.092170954 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.093235970 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.093399048 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.093420982 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.094770908 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.094983101 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.097197056 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.097485065 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.098328114 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.098342896 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.098401070 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.099822044 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.099826097 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.099865913 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.099930048 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:22.099944115 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.099989891 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:22.099991083 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.100023985 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:22.100672007 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:22.112133026 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.112271070 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.115688086 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.117444038 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.122056007 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:22.125811100 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.125833035 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.125845909 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.125861883 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.125900984 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.125933886 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.126008987 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.126024961 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.126044035 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.126060963 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.126089096 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.126127005 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.129842997 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.129864931 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.129879951 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.129915953 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.129945040 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.131614923 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.131635904 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.131649971 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.131688118 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.131720066 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.138550997 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.141864061 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.143393993 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.144424915 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.145313978 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.145402908 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.145740986 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.146120071 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.146521091 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.147124052 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.156235933 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.156264067 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.156393051 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.157272100 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.159254074 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.161344051 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.163016081 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.163039923 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.163058996 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.163113117 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.163129091 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.163141012 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.163203001 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.163239956 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.163252115 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.163259983 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.163264036 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.163266897 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.163338900 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.163357973 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.164159060 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.164176941 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.164243937 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.164248943 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.164315939 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.164453983 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.164516926 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.168236971 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.172334909 CET	49814	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.172704935 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.172754049 CET	49813	443	192.168.2.4	216.58.207.129
Jan 27, 2021 03:43:22.172895908 CET	49816	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.181538105 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.189888954 CET	443	49814	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.190089941 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.195643902 CET	443	49813	216.58.207.129	192.168.2.4
Jan 27, 2021 03:43:22.195768118 CET	443	49816	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.218926907 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.218957901 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.218975067 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.218986988 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.219016075 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.219062090 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.220237017 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.220257998 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.220364094 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.221612930 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.221633911 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.221703053 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.222996950 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.223021030 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.223165989 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.223191977 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.224394083 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.224412918 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.224505901 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.224535942 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.225819111 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.225837946 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.225914001 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.225965977 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.227202892 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.227221966 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.227324963 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.236445904 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.236466885 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.236696959 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.237082958 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.237106085 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.237178087 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.237236023 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.238513947 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.238543034 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.238621950 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.239918947 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.239942074 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.240063906 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.240092039 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.241297007 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.241318941 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.241374969 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.241410971 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.242722988 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.242746115 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.242829084 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.244096041 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.244117975 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.244206905 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.245502949 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.245541096 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.245620966 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.245661020 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.246844053 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.246870995 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.246946096 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.248141050 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:22.248481035 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.249165058 CET	49815	443	192.168.2.4	172.217.23.22
Jan 27, 2021 03:43:22.271193027 CET	443	49815	172.217.23.22	192.168.2.4
Jan 27, 2021 03:43:26.716711044 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.731894016 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735275030 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735330105 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735368013 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735394001 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735419989 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.735435009 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.735471964 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.735496044 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.737253904 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.757285118 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:26.910204887 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:26.925820112 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:27.013720036 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:27.013763905 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:27.013784885 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:27.013912916 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:27.014895916 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:27.014914036 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:27.029939890 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:27.314569950 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.332190037 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.411602974 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.411672115 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.411840916 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.411876917 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.412715912 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.412760019 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.412806988 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.415273905 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.464133978 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:27.481759071 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:27.502791882 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:27.520339966 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:27.581649065 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:27.581685066 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:27.581720114 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:27.581773043 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:27.581862926 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:27.581909895 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:27.581917048 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:27.582515955 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:27.602740049 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:31.717749119 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.732671022 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.736238956 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.736262083 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.736361980 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.736375093 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.736377954 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.736414909 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.736447096 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.736454964 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.739705086 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.739852905 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.759084940 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.771140099 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.787619114 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.875439882 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.875480890 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.875509024 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:31.875566959 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.875586987 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.890419006 CET	49785	443	192.168.2.4	34.96.102.137
Jan 27, 2021 03:43:31.905361891 CET	443	49785	34.96.102.137	192.168.2.4
Jan 27, 2021 03:43:32.185180902 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:32.204442978 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:32.237588882 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:32.237649918 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:32.237809896 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:32.238766909 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:32.238797903 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:32.238837004 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:32.238857031 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:32.300430059 CET	49794	443	192.168.2.4	216.58.207.162
Jan 27, 2021 03:43:32.323738098 CET	443	49794	216.58.207.162	192.168.2.4
Jan 27, 2021 03:43:33.279506922 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.296838999 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:33.359147072 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:33.359189034 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:33.359215021 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:33.359240055 CET	443	49797	172.217.22.227	192.168.2.4
Jan 27, 2021 03:43:33.359292984 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.359352112 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.359359026 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.359365940 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.363293886 CET	49797	443	192.168.2.4	172.217.22.227
Jan 27, 2021 03:43:33.381824970 CET	443	49797	172.217.22.227	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 03:42:34.595423937 CET	52991	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:34.610610962 CET	53	52991	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:35.235198975 CET	53700	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:35.250166893 CET	53	53700	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:36.291311979 CET	51726	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:36.307444096 CET	53	51726	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:36.911740065 CET	56794	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:36.927169085 CET	53	56794	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:37.638854980 CET	56534	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:37.654743910 CET	53	56534	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:38.573755026 CET	56627	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:38.588838100 CET	53	56627	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:39.274013996 CET	56621	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:39.290102959 CET	53	56621	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:39.363349915 CET	63116	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:39.380419970 CET	53	63116	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:40.628170967 CET	64078	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:40.638077974 CET	64801	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:40.645421028 CET	53	64078	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:40.653361082 CET	53	64801	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:40.960170984 CET	61721	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:41.148454905 CET	53	61721	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:41.338354111 CET	51255	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:41.353507042 CET	53	51255	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:42.525465012 CET	61522	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:42.540443897 CET	53	61522	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:42.839737892 CET	52337	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:42.844285011 CET	55046	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:42.855851889 CET	53	52337	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:42.951668978 CET	53	55046	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:43.706243992 CET	49612	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:43.721528053 CET	53	49612	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:43.791780949 CET	49285	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:43.807416916 CET	53	49285	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:43.824472904 CET	50601	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:43.848069906 CET	53	50601	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:44.538296938 CET	60875	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:44.553699017 CET	53	60875	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:45.212430000 CET	56448	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:45.231242895 CET	53	56448	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:45.931477070 CET	59172	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:45.947066069 CET	53	59172	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:47.252450943 CET	62420	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:47.268807888 CET	53	62420	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:49.228869915 CET	60579	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:49.243907928 CET	53	60579	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:57.827542067 CET	50183	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:42:57.996360064 CET	53	50183	8.8.8.8	192.168.2.4
Jan 27, 2021 03:42:59.776932001 CET	61531	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:00.786154032 CET	61531	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:00.902812958 CET	53	61531	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:01.053148031 CET	49228	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:01.342154980 CET	53	49228	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:01.543384075 CET	59794	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:01.561481953 CET	53	59794	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:01.631577969 CET	55916	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:01.637012005 CET	52752	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:01.648005009 CET	53	55916	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:01.653501987 CET	60542	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:01.653608084 CET	53	52752	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:01.827277899 CET	53	60542	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:02.456262112 CET	60689	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:02.711437941 CET	53	60689	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:03.104240894 CET	64206	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:03.276509047 CET	53	64206	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:03.455859900 CET	50904	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:03.572232962 CET	53	50904	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:05.098068953 CET	57525	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:05.486948013 CET	53	57525	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:05.816179037 CET	53814	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:05.846319914 CET	53	53814	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:06.646554947 CET	53418	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.662128925 CET	53	53418	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:06.857758045 CET	62833	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.859213114 CET	59260	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.859994888 CET	49944	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.861360073 CET	63300	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.873051882 CET	53	62833	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:06.876166105 CET	53	63300	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:06.878046989 CET	53	59260	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:06.923326015 CET	61449	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:06.947173119 CET	53	61449	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.003804922 CET	53	49944	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.138103962 CET	51275	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:07.155153036 CET	53	51275	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.323438883 CET	63492	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:07.362350941 CET	53	63492	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.737304926 CET	58945	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:07.741175890 CET	60779	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:07.748718023 CET	64014	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:07.752870083 CET	53	58945	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.756613016 CET	53	60779	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:07.766284943 CET	53	64014	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:09.353565931 CET	57091	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:09.369695902 CET	53	57091	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:09.679389954 CET	55904	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:09.697130919 CET	53	55904	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:10.033335924 CET	52109	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:10.048672915 CET	53	52109	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:10.355319977 CET	57091	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:10.371659040 CET	53	57091	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:11.034818888 CET	52109	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:11.049916983 CET	53	52109	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:11.360615015 CET	57091	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:11.376344919 CET	53	57091	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:12.039021015 CET	52109	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:12.054399967 CET	53	52109	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:13.362973928 CET	57091	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:13.378880024 CET	53	57091	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:13.618958950 CET	54450	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:13.643004894 CET	53	54450	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:13.921196938 CET	49374	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:13.936065912 CET	53	49374	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:14.043029070 CET	52109	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:14.058815002 CET	53	52109	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:16.344172955 CET	50436	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:16.368177891 CET	53	50436	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:16.475425005 CET	62605	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:16.504245043 CET	53	62605	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:17.496098042 CET	57091	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:17.511910915 CET	53	57091	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:18.054258108 CET	52109	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:18.069802046 CET	53	52109	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:22.042179108 CET	54256	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:22.048619986 CET	52189	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:22.066725969 CET	53	54256	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:22.072448015 CET	53	52189	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:50.899686098 CET	56131	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:50.916692019 CET	53	56131	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:54.729953051 CET	62992	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:54.778157949 CET	53	62992	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:56.217277050 CET	54432	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:56.255916119 CET	53	54432	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:56.787961960 CET	57227	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:56.803519011 CET	53	57227	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:57.109426975 CET	58383	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:57.151485920 CET	53	58383	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:57.481437922 CET	63136	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:57.501233101 CET	53	63136	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:57.881882906 CET	50911	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:57.900073051 CET	53	50911	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:58.289330959 CET	63409	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:58.343641996 CET	53	63409	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:58.473917961 CET	59185	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:58.497991085 CET	53	59185	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:59.333178043 CET	64236	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:43:59.349301100 CET	53	64236	8.8.8.8	192.168.2.4
Jan 27, 2021 03:43:59.964199066 CET	56157	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:44:00.005182028 CET	53	56157	8.8.8.8	192.168.2.4
Jan 27, 2021 03:44:00.267441034 CET	55601	53	192.168.2.4	8.8.8.8
Jan 27, 2021 03:44:00.285253048 CET	53	55601	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 03:42:40.628170967 CET	192.168.2.4	8.8.8.8	0x3e0	Standard query (0)	www.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:42:40.960170984 CET	192.168.2.4	8.8.8.8	0x299f	Standard query (0)	en2.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:42:42.844285011 CET	192.168.2.4	8.8.8.8	0xd620	Standard query (0)	sassets.j2global.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:42:57.827542067 CET	192.168.2.4	8.8.8.8	0x2935	Standard query (0)	en2.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:42:59.776932001 CET	192.168.2.4	8.8.8.8	0x3f68	Standard query (0)	en.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:00.786154032 CET	192.168.2.4	8.8.8.8	0x3f68	Standard query (0)	en.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.053148031 CET	192.168.2.4	8.8.8.8	0x594c	Standard query (0)	www.efax.ch	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.543384075 CET	192.168.2.4	8.8.8.8	0x7816	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.631577969 CET	192.168.2.4	8.8.8.8	0xaad7	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.637012005 CET	192.168.2.4	8.8.8.8	0xe85a	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.653501987 CET	192.168.2.4	8.8.8.8	0x854e	Standard query (0)	go.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:02.456262112 CET	192.168.2.4	8.8.8.8	0x7033	Standard query (0)	efax.co.uk	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:03.104240894 CET	192.168.2.4	8.8.8.8	0xabda	Standard query (0)	www.efax.co.uk	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:03.455859900 CET	192.168.2.4	8.8.8.8	0x95be	Standard query (0)	en3.efax.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:05.098068953 CET	192.168.2.4	8.8.8.8	0x2859	Standard query (0)	www.efax.ca	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.857758045 CET	192.168.2.4	8.8.8.8	0xac9f	Standard query (0)	dev.visualwebsiteoptimizer.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.859213114 CET	192.168.2.4	8.8.8.8	0xa145	Standard query (0)	service.force.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.859994888 CET	192.168.2.4	8.8.8.8	0xadf5	Standard query (0)	j2global.secure.force.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.861360073 CET	192.168.2.4	8.8.8.8	0xe924	Standard query (0)	stackpath.bootstrapcdn.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.138103962 CET	192.168.2.4	8.8.8.8	0x1c67	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.323438883 CET	192.168.2.4	8.8.8.8	0x8aa6	Standard query (0)	www.google.co.uk	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.741175890 CET	192.168.2.4	8.8.8.8	0xffd9	Standard query (0)	resources.xg4ken.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.748718023 CET	192.168.2.4	8.8.8.8	0x4b5f	Standard query (0)	r.turn.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:13.618958950 CET	192.168.2.4	8.8.8.8	0xab28	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.344172955 CET	192.168.2.4	8.8.8.8	0x910c	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.475425005 CET	192.168.2.4	8.8.8.8	0x5448	Standard query (0)	static.doubleclick.net	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:22.042179108 CET	192.168.2.4	8.8.8.8	0x44b9	Standard query (0)	yt3.ggpht.com	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:22.048619986 CET	192.168.2.4	8.8.8.8	0x9a9b	Standard query (0)	i.ytimg.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 03:42:40.645421028 CET	8.8.8.8	192.168.2.4	0x3e0	No error (0)	www.efax.com	www.efax.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:42:41.148454905 CET	8.8.8.8	192.168.2.4	0x299f	No error (0)	en2.efax.com	en2.efax.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:42:42.951668978 CET	8.8.8.8	192.168.2.4	0xd620	No error (0)	sassets.j2global.com	sassets.j2global.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:42:57.996360064 CET	8.8.8.8	192.168.2.4	0x2935	No error (0)	en2.efax.com	en2.efax.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:00.902812958 CET	8.8.8.8	192.168.2.4	0x3f68	No error (0)	en.efax.com	en.efax.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:01.342154980 CET	8.8.8.8	192.168.2.4	0x594c	No error (0)	www.efax.ch	j2-cloud-eu-sf-alb-1688558620.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:01.342154980 CET	8.8.8.8	192.168.2.4	0x594c	No error (0)	j2-cloud-eu-sf-alb-1688558620.eu-west-1.elb.amazonaws.com		108.128.28.146	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.342154980 CET	8.8.8.8	192.168.2.4	0x594c	No error (0)	j2-cloud-eu-sf-alb-1688558620.eu-west-1.elb.amazonaws.com		34.241.222.244	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.561481953 CET	8.8.8.8	192.168.2.4	0x7816	No error (0)	cdn.jsdelivr.net	dualstack.f3.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:01.648005009 CET	8.8.8.8	192.168.2.4	0xaad7	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:01.653608084 CET	8.8.8.8	192.168.2.4	0xe85a	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.653608084 CET	8.8.8.8	192.168.2.4	0xe85a	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:01.827277899 CET	8.8.8.8	192.168.2.4	0x854e	No error (0)	go.efax.com		204.11.168.2	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:02.711437941 CET	8.8.8.8	192.168.2.4	0x7033	No error (0)	efax.co.uk		204.11.168.165	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:03.276509047 CET	8.8.8.8	192.168.2.4	0xabda	No error (0)	www.efax.co.uk	www.efax.co.uk.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:03.572232962 CET	8.8.8.8	192.168.2.4	0x95be	No error (0)	en3.efax.com	en3.efax.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:05.486948013 CET	8.8.8.8	192.168.2.4	0x2859	No error (0)	www.efax.ca	www.efax.ca.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:06.873051882 CET	8.8.8.8	192.168.2.4	0xac9f	No error (0)	dev.visualwebsiteoptimizer.com		34.96.102.137	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.876166105 CET	8.8.8.8	192.168.2.4	0xe924	No error (0)	stackpath.bootstrapcdn.com	cds.j3z9t3p6.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	service.force.com	location.force.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.force.com	location.l.force.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.1.166	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.0.38	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.10.41	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.10.172	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.10.44	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.878046989 CET	8.8.8.8	192.168.2.4	0xa145	No error (0)	location.l.force.com		161.71.0.166	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:06.947173119 CET	8.8.8.8	192.168.2.4	0xfcc2	No error (0)	pagead.l.doubleclick.net		172.217.20.226	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	j2global.secure.force.com	na62.force.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	na62.force.com	na62-dfw.force.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	na62-dfw.force.com	na62-dfw.dfw.r.force.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	na62-dfw.dfw.r.force.com		136.147.111.106	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	na62-dfw.dfw.r.force.com		136.147.109.234	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.003804922 CET	8.8.8.8	192.168.2.4	0xadf5	No error (0)	na62-dfw.dfw.r.force.com		136.147.111.234	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.155153036 CET	8.8.8.8	192.168.2.4	0x1c67	No error (0)	googleads.g.doubleclick.net	pagead46.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.155153036 CET	8.8.8.8	192.168.2.4	0x1c67	No error (0)	pagead46.l.doubleclick.net		216.58.207.162	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.362350941 CET	8.8.8.8	192.168.2.4	0x8aa6	No error (0)	www.google.co.uk		172.217.22.227	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	resources.xg4ken.com	resourcesgeo.sat4ken.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	resourcesgeo.sat4ken.com	resources-prd-elb-ir.xg4ken.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	resources-prd-elb-ir.xg4ken.com	awseb-e-g-awsebloa-nt5wfb9wmmft-1397624435.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	awseb-e-g-awsebloa-nt5wfb9wmmft-1397624435.eu-west-1.elb.amazonaws.com		34.241.47.148	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	awseb-e-g-awsebloa-nt5wfb9wmmft-1397624435.eu-west-1.elb.amazonaws.com		52.48.111.126	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.756613016 CET	8.8.8.8	192.168.2.4	0xffd9	No error (0)	awseb-e-g-awsebloa-nt5wfb9wmmft-1397624435.eu-west-1.elb.amazonaws.com		54.228.170.24	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:07.766284943 CET	8.8.8.8	192.168.2.4	0x4b5f	No error (0)	r.turn.com	r.turn.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:13.643004894 CET	8.8.8.8	192.168.2.4	0xab28	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:16.368177891 CET	8.8.8.8	192.168.2.4	0x910c	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:16.368177891 CET	8.8.8.8	192.168.2.4	0x910c	No error (0)	stats.l.doubleclick.net		108.177.15.155	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.368177891 CET	8.8.8.8	192.168.2.4	0x910c	No error (0)	stats.l.doubleclick.net		108.177.15.156	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.368177891 CET	8.8.8.8	192.168.2.4	0x910c	No error (0)	stats.l.doubleclick.net		108.177.15.157	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.368177891 CET	8.8.8.8	192.168.2.4	0x910c	No error (0)	stats.l.doubleclick.net		108.177.15.154	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:16.504245043 CET	8.8.8.8	192.168.2.4	0x5448	No error (0)	static.doubleclick.net	static-doubleclick-net.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:22.066725969 CET	8.8.8.8	192.168.2.4	0x44b9	No error (0)	yt3.ggpht.com	photos-ugc.l.googleusercontent.com		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 03:43:22.066725969 CET	8.8.8.8	192.168.2.4	0x44b9	No error (0)	photos-ugc.l.googleusercontent.com		216.58.207.129	A (IP address)	IN (0x0001)
Jan 27, 2021 03:43:22.072448015 CET	8.8.8.8	192.168.2.4	0x9a9b	No error (0)	i.ytimg.com		172.217.23.22	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

go.efax.com

efax.co.uk

www.efax.ch

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49759	204.11.168.2	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 03:43:02.163733959 CET	1144	OUT	GET /s/r/js/jquery.cycle2.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: go.efax.com Connection: Keep-Alive Cookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Jan 27, 2021 03:43:02.316268921 CET	1226	IN	HTTP/1.1 301 Moved Permanently Location: https://www.efax.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
1	192.168.2.4	49760	204.11.168.2	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 03:43:02.165318012 CET	1145	OUT	GET /s/r/js/bootstrap.min.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: go.efax.com Connection: Keep-Alive Cookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Jan 27, 2021 03:43:02.317784071 CET	1226	IN	HTTP/1.1 301 Moved Permanently Location: https://www.efax.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
2	192.168.2.4	49761	204.11.168.2	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 03:43:02.166213989 CET	1146	OUT	GET /s/r/js/jquery.cycle2.center.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: go.efax.com Connection: Keep-Alive Cookie: AKAINFO="client=hdzagzebzgd//city=ZURICH//state=ZH//country=CH//region=EU//bandwidth=vhigh//timezone=GMT+1//version=3"; ak_bmsc=05F35FD9BEE3390E05ED927CA9A5137202150C9D3C4E000022D310607D4B7821~pl9StssWGfBl+QTX/fICUMUu+nV5vnp9Irhut24LmnEcMPcz+c/fwUc0UEyqFjtmyuqYV+mU48YXjek5HMqR8xESVH1y9YEpbLOojKDBp7kfpbeC7Z5NsfpUiXj8NhyAqB/qp8OVPB/Tmn/qMogniMDmnppyBkYWbgVmP4J2ZYtznF7EXNjWYpCxOy9vvDFGSkVnV8iGODMt3lMwlLaIBUOtHSrapgzEvPbycyiJfD/ZU=
Jan 27, 2021 03:43:02.318526030 CET	1226	IN	HTTP/1.1 301 Moved Permanently Location: https://www.efax.com

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
3	192.168.2.4	49762	204.11.168.165	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 03:43:02.939223051 CET	1359	OUT	GET /s/r/images/favicon/16x16.ico HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Host: efax.co.uk Connection: Keep-Alive
Jan 27, 2021 03:43:03.092957973 CET	1360	IN	HTTP/1.1 301 Moved Permanently Location: https://www.efax.co.uk/s/r/images/favicon/16x16.ico Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
4	192.168.2.4	49771	108.128.28.146	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 27, 2021 03:43:04.565315962 CET	1432	OUT	GET / HTTP/1.1 Accept: / Accept-Encoding: gzip, deflate User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Connection: Keep-Alive Host: www.efax.ch
Jan 27, 2021 03:43:04.605426073 CET	1433	IN	HTTP/1.1 200 OK Date: Wed, 27 Jan 2021 02:43:04 GMT Content-Type: text/html; charset=utf-8 Content-Length: 2587 Connection: keep-alive Cache-Control: private Content-Encoding: gzip Vary: Accept-Encoding Server: X-AspNet-Version: X-Frame-Options: SAMEORIGIN Data Raw: 1f 8b 08 00 00 00 00 00 04 00 ed bd 07 60 1c 49 96 25 26 2f 6d ca 7b 7f 4a f5 4a d7 e0 74 a1 08 80 60 13 24 d8 90 40 10 ec c1 88 cd e6 92 ec 1d 69 47 23 29 ab 2a 81 ca 65 56 65 5d 66 16 40 cc ed 9d bc f7 de 7b ef bd f7 de 7b ef bd f7 ba 3b 9d 4e 27 f7 df ff 3f 5c 66 64 01 6c f6 ce 4a da c9 9e 21 80 aa c8 1f 3f 7e 7c 1f 3f 22 7e e3 e4 37 4e 1e ff ae b3 6a da 5e af f2 74 de 2e ca 23 fe 08 bf a5 ef 16 e5 b2 f9 ec a3 79 db ae 1e dd bd 7b 75 75 35 be ba 37 ae ea 8b bb bb 0f 1f 3e bc fb 0e 6d 3e a2 e6 8f e7 79 36 3b 7a dc 16 6d 99 d3 9f 3f 96 3f cb de fd 23 7f 43 fa 9f fc 41 7f 6a 4a bf e5 cb b4 9a 2f 73 fc 7a 91 d7 ff e8 5f d6 8e f1 6b 9e 56 cb b2 a0 8f 9b 7c 39 a3 26 eb e5 2c cd 17 ab f3 6c 79 41 7f 6d a7 bf 57 5e 2c d1 4e 5e 49 27 f9 f2 1f fd 3b da e2 a2 1d 53 77 77 a5 a7 c7 8b bc cd d2 65 b6 c8 3f fb e8 b2 c8 af 56 55 dd 7e 94 4e ab 65 9b 2f db cf 3e ba 2a 66 ed fc b3 59 7e 59 4c f3 6d fe 63 94 16 cb a2 2d b2 72 bb 99 66 65 fe d9 ee 28 5d 64 ef 8a c5 7a e1 3e 58 37 79 cd 7f 65 13 fa 60 59 7d 94 de 0d 3a aa ab 49 d5 36 5e 37 cb aa a0 01 bc 1b 2d ab f3 aa 2c ab 2b fa 25 ab a7 f3 e2 32 a7 df aa d9 8a fe bd 9e 15 35 fd 68 96 c5 6a 95 13 8a 04 91 86 fe 36 9d d7 f9 f9 67 1f 1d af 56 bf ff 9b 79 be c8 9b bb 5f 64 c5 f2 ee 22 6b da bc 1e 4f 1b ea a5 ce cb cf 3e 6a da eb 32 6f e6 39 5e c5 2c 7d f6 51 9b bf 6b ef 72 83 10 94 4e 54 7e 9e bd 1b 4f ab f1 fa ed dd e6 6e 7d b7 58 64 17 04 fc 3c 23 4a 54 cb bb bb 9f be db fd 74 4c bf 1a f0 73 a2 db 74 dd a6 f4 d1 12 10 7f e3 24 a5 e7 71 33 ad 8b 55 9b 36 f5 f4 b3 8f ee de 9d 56 b3 7c fc d3 bf 68 9d d7 d7 04 7a 71 57 7e dd de 1d ef ee 8d ef 8d 17 c5 72 fc d3 84 4e 41 44 b9 a8 8b f6 1a 60 b3 bd fb 9f 6e 67 d9 97 4f bf 7d 7c 71 79 f5 13 df dd 9d 3c fb f2 f3 df fb 8b fc f7 fe 64 75 b2 ff f2 a7 ce 5e 36 97 cb bd f9 6e 73 5c ff 3e 5f ce 2f 7e ef 9f f8 8c a8 5a 57 4d 53 d5 c5 45 b1 fc ec a3 6c 59 2d af 17 d5 ba f9 e8 e8 f1 5d c1 86 71 33 98 79 b4 f8 e9 ec 32 93 4f 3f b2 08 cf 80 d2 2c 2f 8b cb 7a bc cc a9 0d 63 3c ce 7e 9a 88 b3 5e 56 93 b6 5e 37 34 4b 77 ef 8d f7 c6 fb e6 5b ef 8b 6d 6e a9 23 eb 60 c0 34 17 ea 6d 98 1c 99 14 46 e5 a7 9b f1 b4 ac d6 b3 f3 32 ab 73 26 20 a0 df 2d 8b 49 43 a4 ad de 16 39 11 9f 44 a1 dd 23 7c 76 c6 f7 c2 0f 19 0b 06 69 66 27 4d e5 e7 66 5a d8 c6 69 7a 99 d5 c4 b3 80 f9 b2 2a 8b e9 f5 97 ab b6 20 e0 e9 67 e9 f7 be 7f e8 9a e9 e3 3e 38 5f 2f a7 68 19 bc bc 75 27 fd c5 ae 09 1e ff 5b 07 ba d3 a8 fb ac aa d5 7a f5 24 9b be bd a8 2b 92 ff 93 aa ac ea 47 e9 c7 3f 9e cf f2 f3 f3 fb 1f 8f 6e f1 f6 1b 1a b1 7d ef e0 de c1 bd 87 bb 37 bd 37 59 b7 6d b5 b4 2f ed 4f 0e 76 f3 83 9b 5e ca df ad 8a 3a bf 7e 9a 5d 3f 4a ef ed dc d0 98 44 b9 21 91 7b 94 7e f4 74 4d aa 20 9d 15 79 7a 4e 42 46 52 98 b7 3f 68 f3 f4 c5 ba fd c1 7a 79 81 2f 48 dd a4 df cd 27 4d 5e d0 e7 4d 5b 2c 16 a4 fe 5e d3 0b 33 fa e2 27 f3 fa 8a d4 23 9a 5e d2 14 9c 30 91 9b f4 22 5f fc a3 7f d9 3f fa 17 92 ce a4 b7 a9 d9 47 37 e0 33 2b 9a 45 d1 34 a0 15 e1 74 46 18 5d e6 35 29 99 79 7e d3 9b e0 60 7a 05 7a a5 21 c5 02 0b c0 ca 65 96 df 5d d5 c5 65 36 bd fe 71 41 6a fb 55 31 9d b7 24 16 c5 8d 30 9f 93 ec 28 2a fd 77 87 5f fd 25 5d 2e bd 22 bd 5b 5d 8d b3 d9 ec f4 92 64 e4 79 41 23 5a e6 f5 d6 47 65 95 cd 3e 1a a5 86 73 fb cc 8a 47 df Data Ascii: `I%&/m{JJt`$@iG#)eVe]f@{{;N'?\fdlJ!?~\|?"~7Nj^t.#y{uu57>m>y6;zm??#CAjJ/sz_kV\|9&,lyAmW^,N^I';Swwe?VU~Ne/>fY~YLmc-rfe(]dz>X7ye`Y}:I6^7-,+%25hj6gVy_d"kO>j2o9^,}QkrNT~On}Xd<#JTtLst$q3U6V\|hzqW~rNAD`ngO}\|qy<du^6ns\>_/~ZWMSElY-]q3y2O?,/zc<~^V^74Kw[mn#`4mF2s& -IC9D#\|vif'MfZiz* g>8_/hu'[z$+G?n}77Ym/Ov^:~]?JD!{~tM yzNBFR?hzy/H'M^M[,^3'#^0"_?G73+E4tF]5)y~`zz!e]e6qAjU1$0(*w_%]."[]dyA#ZGe>sG
Jan 27, 2021 03:43:04.605526924 CET	1434	IN	Data Raw: 16 be 35 62 46 28 c0 3c 14 4d be 15 79 05 cf 47 2b b2 13 6d 9b 7f f4 28 06 d4 3c 1f 31 6f 6e 6e 83 e7 a3 89 65 7e 6a 2c b8 04 32 34 66 40 1d 11 b9 81 be ac 05 36 81 03 f1 19 d0 30 9c 5f b2 a1 8f 8f 44 80 a8 87 0f 1e 9d 40 ba 09 97 f8 57 43 28 7e Data Ascii: 5bF(<MyG+m(<1onne~j,24f@60_D@WC(~$QPCy#DuG-9(]d! T^.1YpUuBb]H~#^&x__rl#aR,L<-4}}~L.c6I_igm~Z
Jan 27, 2021 03:43:04.605715036 CET	1435	IN	Data Raw: 2a 13 39 cd 9b 11 cd e1 74 9c 1e 97 65 4a 39 e2 39 79 f3 35 12 68 97 f9 cc 38 0d 94 10 c5 0f 70 c0 63 0a 03 8e 7e 61 9d 5f 1c d2 77 f4 6b 4a ee 77 46 2f 5c 20 51 44 13 9d b6 35 d9 ff 45 56 bf 4d ab f3 a1 be e8 55 c0 a3 1f 82 73 38 10 7f ac 7d 17 Data Ascii: 9teJ99y5h8pc~a_wkJwF/\ QD5EVMUs8}}'LiLOgri/;!x'{[$8o87Me=&Jq4Ef~#7

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 27, 2021 03:43:01.416536093 CET	108.128.28.146	443	192.168.2.4	49751	CN=*.efax.de CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Jun 24 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Jul 24 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 27, 2021 03:43:01.422079086 CET	108.128.28.146	443	192.168.2.4	49752	CN=*.efax.de CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Jun 24 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Jul 24 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 27, 2021 03:43:01.724231958 CET	104.16.19.94	443	192.168.2.4	49755	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:01.724231958 CET	104.16.19.94	443	192.168.2.4	49755	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:01.724571943 CET	104.16.19.94	443	192.168.2.4	49757	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:01.724571943 CET	104.16.19.94	443	192.168.2.4	49757	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.906850100 CET	34.96.102.137	443	192.168.2.4	49784	CN=*.visualwebsiteoptimizer.com, OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Jun 20 00:03:14 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014	Wed Jul 06 14:37:36 CEST 2022 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
Jan 27, 2021 03:43:06.907422066 CET	34.96.102.137	443	192.168.2.4	49785	CN=*.visualwebsiteoptimizer.com, OU=Domain Control Validated CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Jun 20 00:03:14 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014	Wed Jul 06 14:37:36 CEST 2022 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Starfield Secure Certificate Authority - G2, OU=http://certs.starfieldtech.com/repository/, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Starfield Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
Jan 27, 2021 03:43:06.938481092 CET	161.71.1.166	443	192.168.2.4	49788	CN=*.um4.force.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon May 11 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Apr 28 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.938481092 CET	161.71.1.166	443	192.168.2.4	49788	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.938787937 CET	161.71.1.166	443	192.168.2.4	49789	CN=*.um4.force.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon May 11 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Wed Apr 28 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.938787937 CET	161.71.1.166	443	192.168.2.4	49789	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.998826981 CET	172.217.20.226	443	192.168.2.4	49790	CN=www.googleadservices.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:43 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:42 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.998826981 CET	172.217.20.226	443	192.168.2.4	49790	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.999459982 CET	172.217.20.226	443	192.168.2.4	49791	CN=www.googleadservices.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:43 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:42 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:06.999459982 CET	172.217.20.226	443	192.168.2.4	49791	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.206525087 CET	216.58.207.162	443	192.168.2.4	49795	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:07:00 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:06:59 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.206525087 CET	216.58.207.162	443	192.168.2.4	49795	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.206803083 CET	216.58.207.162	443	192.168.2.4	49794	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:07:00 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:06:59 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.206803083 CET	216.58.207.162	443	192.168.2.4	49794	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.301137924 CET	136.147.111.106	443	192.168.2.4	49793	CN=*.na62.force.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Aug 07 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu Aug 05 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.301137924 CET	136.147.111.106	443	192.168.2.4	49793	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.305470943 CET	136.147.111.106	443	192.168.2.4	49792	CN=*.na62.force.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Aug 07 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu Aug 05 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.305470943 CET	136.147.111.106	443	192.168.2.4	49792	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.413626909 CET	172.217.22.227	443	192.168.2.4	49797	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:42 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:41 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.413626909 CET	172.217.22.227	443	192.168.2.4	49797	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.414382935 CET	172.217.22.227	443	192.168.2.4	49796	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:42 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:41 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.414382935 CET	172.217.22.227	443	192.168.2.4	49796	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:07.835540056 CET	34.241.47.148	443	192.168.2.4	49801	CN=*.xg4ken.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Mon Sep 14 14:50:49 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Sat Oct 16 14:50:49 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 27, 2021 03:43:07.836550951 CET	34.241.47.148	443	192.168.2.4	49800	CN=*.xg4ken.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Mon Sep 14 14:50:49 CEST 2020 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Sat Oct 16 14:50:49 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 27, 2021 03:43:16.424029112 CET	108.177.15.155	443	192.168.2.4	49809	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:07:00 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:06:59 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:16.424029112 CET	108.177.15.155	443	192.168.2.4	49809	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:16.481115103 CET	108.177.15.155	443	192.168.2.4	49810	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:07:00 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:06:59 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:16.481115103 CET	108.177.15.155	443	192.168.2.4	49810	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.125861883 CET	216.58.207.129	443	192.168.2.4	49814	CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:08 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:07 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.125861883 CET	216.58.207.129	443	192.168.2.4	49814	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.126060963 CET	216.58.207.129	443	192.168.2.4	49813	CN=*.googleusercontent.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 13:11:08 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 14:11:07 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.126060963 CET	216.58.207.129	443	192.168.2.4	49813	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.129879951 CET	172.217.23.22	443	192.168.2.4	49815	CN=edgestatic.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 12:53:26 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 13:53:25 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.129879951 CET	172.217.23.22	443	192.168.2.4	49815	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.131649971 CET	172.217.23.22	443	192.168.2.4	49816	CN=edgestatic.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Jan 05 12:53:26 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Mar 30 13:53:25 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 03:43:22.131649971 CET	172.217.23.22	443	192.168.2.4	49816	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 6900 Parent PID: 800

General

Start time:	03:42:38
Start date:	27/01/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff64e4a0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 6960 Parent PID: 6900

General

Start time:	03:42:38
Start date:	27/01/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6900 CREDAT:17410 /prefetch:2
Imagebase:	0x820000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Reset < >

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://www.efax.com/login?utm_source=j2es&utm_medium=email&utm_term=click-here&utm_content=text&utm_campaign=paid-inbound-fax-success&j=true

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 6900 Parent PID: 800

General

Chronological Activities

Analysis Process: iexplore.exe PID: 6960 Parent PID: 6900

General

Chronological Activities

Disassembly