Play interactive tour

Edit tour

Analysis Report https://lowrybrenda714e.myportfolio.com/

Overview

General Information

Sample URL:	https://lowrybrenda714e.myportfolio.com/
Analysis ID:	344886
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish_10

HTML body contains low number of good links

HTML title does not match URL

Invalid 'forgot password' link found

Classification

Startup

System is w10x64

iexplore.exe (PID: 3892 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 2416 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3892 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Secure[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: https://lowrybrenda714e.myportfolio.com/

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Show sources

Source: https://nobledriving.co.uk/securefax/Secure/

UrlScan: Label: phishing brand: microsoft

Perma Link

Phishing:

Yara detected HtmlPhish_10

Show sources

Source: Yara match	File source: 609290.0.links.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Secure[1].htm, type: DROPPED

Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Number of links: 0
Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Number of links: 0

Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Title: Sign in to Outlook does not match URL
Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Title: Sign in to Outlook does not match URL

Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Invalid link: Forgot my password
Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: Invalid link: Forgot my password

Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: No <meta name="author".. found
Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: No <meta name="author".. found

Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: No <meta name="copyright".. found
Source: https://nobledriving.co.uk/securefax/Secure/	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 151.101.0.119:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.0.119:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.5.181:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.5.181:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.235.215.62:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.235.215.62:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49725 version: TLS 1.2

Networking:

Source: unknown

DNS traffic detected: queries for: lowrybrenda714e.myportfolio.com

Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: main[1].js.2.dr	String found in binary or memory: http://jquery.com/
Source: main[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: main[1].js.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: PEOKBA7N.js.2.dr	String found in binary or memory: http://typekit.com/eulas/000000000000000000017750
Source: PEOKBA7N.js.2.dr	String found in binary or memory: http://typekit.com/eulas/00000000000000007735a6b9
Source: main[1].js.2.dr	String found in binary or memory: http://www.appelsiini.net/projects/lazyload
Source: main[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p
Source: imagestore.dat.2.dr, Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Source: Secure[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.min.js
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/$Cust
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/$CustRoot
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/$Custo.uk/securefax/Secure/#Root
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/$Custo.uk/securefax/Secure/Root
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/$Customer
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/Root
Source: CBDX8KFB.htm.2.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/home
Source: ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/p
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://lowrybrenda714e.myportfolio.com/r
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://nobledriving.c
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://nobledriving.ce.myportfolio.com/r
Source: CBDX8KFB.htm.2.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DFB052A6523F436CBD.TMP.1.dr, Secure[1].htm.2.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/#
Source: ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/#.ico
Source: ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/#Visited:
Source: {8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/$Sign
Source: ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/7
Source: ~DFB052A6523F436CBD.TMP.1.dr	String found in binary or memory: https://nobledriving.co.uk/securefax/Secure/Visited:
Source: PEOKBA7N.js.2.dr	String found in binary or memory: https://p.typekit.net/p.gif
Source: CBDX8KFB.htm.2.dr	String found in binary or memory: https://pro2-bar-s3-cdn-cf2.myportfolio.com/92ba9c29-e151-43bb-9cb5-03e2bee5b76a/d42c286c3ea44af105d
Source: PEOKBA7N.js.2.dr	String found in binary or memory: https://use.typekit.net/af/3e2979/00000000000000007735a6b9/30/
Source: PEOKBA7N.js.2.dr	String found in binary or memory: https://use.typekit.net/af/54d47a/000000000000000000017750/27/

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49707 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49707
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723

Source: unknown	HTTPS traffic detected: 151.101.0.119:443 -> 192.168.2.3:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.0.119:443 -> 192.168.2.3:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.5.181:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.5.181:443 -> 192.168.2.3:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.235.215.62:443 -> 192.168.2.3:49721 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.235.215.62:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49725 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: mal64.phis.win@3/33@10/5

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFBA9B5AC1B8981F21.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3892 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3892 CREDAT:17410 /prefetch:2

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://lowrybrenda714e.myportfolio.com/	0%	Virustotal		Browse
https://lowrybrenda714e.myportfolio.com/	0%	Avira URL Cloud	safe
https://lowrybrenda714e.myportfolio.com/	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
cs1100.wpc.omegacdn.net	0%	Virustotal	Browse
prod.adobe-prod-view.map.fastly.net	0%	Virustotal	Browse
aadcdn.msftauth.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label	Link
https://nobledriving.co.uk/securefax/Secure/	100%	UrlScan	phishing brand: microsoft	Browse
https://nobledriving.co.uk/securefax/Secure/#Visited:	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	0%	Avira URL Cloud	safe
https://nobledriving.co.uk/securefax/Secure/7	0%	Avira URL Cloud	safe
https://nobledriving.c	0%	Avira URL Cloud	safe
https://nobledriving.co.uk/securefax/Secure	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	0%	Avira URL Cloud	safe
https://nobledriving.co.uk/securefax/Secure/#.ico	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	0%	URL Reputation	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	0%	URL Reputation	safe
https://nobledriving.co.uk/securefax/Secure/$Sign	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343	0%	Avira URL Cloud	safe
https://nobledriving.co.uk/securefax/Secure/Visited:	0%	Avira URL Cloud	safe
https://nobledriving.co.uk/securefax/Secure/#	0%	Avira URL Cloud	safe
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pro2-bar-s3-cdn-cf2.myportfolio.com	143.204.5.181	true	false		high
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	0%, Virustotal, Browse	unknown
cdnjs.cloudflare.com	104.16.19.94	true	false		high
prod.adobe-prod-view.map.fastly.net	151.101.0.119	true	false	0%, Virustotal, Browse	unknown
nobledriving.co.uk	23.235.215.62	true	false		unknown
lowrybrenda714e.myportfolio.com	unknown	unknown	false		high
use.typekit.net	unknown	unknown	false		high
p.typekit.net	unknown	unknown	false		high
code.jquery.com	unknown	unknown	false		high
js-agent.newrelic.com	unknown	unknown	false		high
aadcdn.msftauth.net	unknown	unknown	false	0%, Virustotal, Browse	unknown
bam-cell.nr-data.net	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://nobledriving.co.uk/securefax/Secure/	true	100%, UrlScan, Browse	unknown
https://lowrybrenda714e.myportfolio.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	font-awesome[1].css.2.dr	false		high
https://nobledriving.co.uk/securefax/Secure/#Visited:	~DFB052A6523F436CBD.TMP.1.dr	true	Avira URL Cloud: safe	unknown
http://jquery.org/license	main[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://sizzlejs.com/	main[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.s	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://lowrybrenda714e.myportfolio.com/$CustRoot	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://lowrybrenda714e.myportfolio.com/	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DFB052A6523F436CBD.TMP.1.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://typekit.com/eulas/000000000000000000017750	PEOKBA7N.js.2.dr	false		high
https://use.typekit.net/af/3e2979/00000000000000007735a6b9/30/	PEOKBA7N.js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://pro2-bar-s3-cdn-cf2.myportfolio.com/92ba9c29-e151-43bb-9cb5-03e2bee5b76a/d42c286c3ea44af105d	CBDX8KFB.htm.2.dr	false		high
https://nobledriving.co.uk/securefax/Secure/7	~DFB052A6523F436CBD.TMP.1.dr	true	Avira URL Cloud: safe	unknown
https://nobledriving.c	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php	main[1].js.2.dr	false		high
https://nobledriving.co.uk/securefax/Secure	CBDX8KFB.htm.2.dr	false	Avira URL Cloud: safe	unknown
https://nobledriving.co.uk/securefax/Secure/	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr, ~DFB052A6523F436CBD.TMP.1.dr, Secure[1].htm.2.dr	true	100%, UrlScan, Browse	unknown
https://lowrybrenda714e.myportfolio.com/$Custo.uk/securefax/Secure/#Root	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://lowrybrenda714e.myportfolio.com/Root	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_96f69d0cefd8a8ba623a182c351ccc64.png	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css	Secure[1].htm0.2.dr	false		high
https://nobledriving.co.uk/securefax/Secure/#.ico	~DFB052A6523F436CBD.TMP.1.dr	true	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	imagestore.dat.2.dr, Secure[1].htm0.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://code.jquery.com/jquery-3.1.1.min.js	Secure[1].htm0.2.dr	false		high
https://lowrybrenda714e.myportfolio.com/r	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://lowrybrenda714e.myportfolio.com/p	~DFB052A6523F436CBD.TMP.1.dr	false		high
http://www.appelsiini.net/projects/lazyload	main[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	imagestore.dat.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://lowrybrenda714e.myportfolio.com/home	CBDX8KFB.htm.2.dr	false		high
http://typekit.com/eulas/00000000000000007735a6b9	PEOKBA7N.js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	imagestore.dat.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://nobledriving.ce.myportfolio.com/r	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://nobledriving.co.uk/securefax/Secure/$Sign	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	true	Avira URL Cloud: safe	unknown
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.s	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://fontawesome.io/license	font-awesome[1].css.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://p.typekit.net/p.gif	PEOKBA7N.js.2.dr	false		high
https://use.typekit.net/af/54d47a/000000000000000000017750/27/	PEOKBA7N.js.2.dr	false		high
https://nobledriving.co.uk/securefax/Secure/Visited:	~DFB052A6523F436CBD.TMP.1.dr	true	Avira URL Cloud: safe	unknown
https://lowrybrenda714e.myportfolio.com/$Custo.uk/securefax/Secure/Root	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://nobledriving.co.uk/securefax/Secure/#	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	true	Avira URL Cloud: safe	unknown
https://lowrybrenda714e.myportfolio.com/$Customer	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://lowrybrenda714e.myportfolio.com/$Cust	{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
http://jquery.com/	main[1].js.2.dr	false		high
https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_5bc252567ef56db648207d9c36a9d004.p	Secure[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
23.235.215.62	unknown	United States	22611	IMH-WESTUS	false
152.199.23.37	unknown	United States	15133	EDGECASTUS	false
151.101.0.119	unknown	United States	54113	FASTLYUS	false
143.204.5.181	unknown	United States	16509	AMAZON-02US	false
104.16.19.94	unknown	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	344886
Start date:	27.01.2021
Start time:	11:47:10
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 29s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://lowrybrenda714e.myportfolio.com/
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@3/33@10/5
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://nobledriving.co.uk/securefax/Secure
Warnings:	Show All Exclude process from analysis (whitelisted): ielowutil.exe, SgrmBroker.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.43.193.48, 104.108.39.131, 95.101.22.225, 95.101.22.218, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 104.108.48.251, 168.61.161.212, 162.247.243.146, 162.247.243.147, 209.197.3.24, 95.101.184.67, 152.199.19.161, 95.101.27.142, 95.101.27.163 Excluded domains from analysis (whitelisted): e6653.dscf.akamaiedge.net, au.download.windowsupdate.com.edgesuite.net, cds.s5x3j6q5.hwcdn.net, tls12.newrelic.com.cdn.cloudflare.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, use-stls.adobe.com.edgesuite.net, audownload.windowsupdate.nsatc.net, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, p.typekit.net-v3.edgekey.net, fs.microsoft.com, ie9comview.vo.msecnd.net, f4.shared.global.fastly.net, aadcdnoriginneu.azureedge.net, skypedataprdcolcus17.cloudapp.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcolcus15.cloudapp.net, aadcdnoriginneu.ec.azureedge.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, a1988.dscg1.akamai.net, cs9.wpc.v0cdn.net Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{8E041430-60D8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.851745667660784
Encrypted:	false
SSDEEP:	48:IwDGcprzGwpLjG/ap8+trGIpcrHVGvnZpvrHXGoCqp9rH5Go49pmrq8GW449r3G8:r5ZtZD2q9WrytrTfr69MrZrtrbfrGsX
MD5:	631D29480A2EC171E00528553996C818
SHA1:	2929FA9CB80B9286E125377004698B3C0FB70E7A
SHA-256:	40FC5E910ED3F44E7CB1233661591362D563ED094FC691B891E30E55B44E65EB
SHA-512:	3E8B26475135105BEE0537C38FEBB096EE62577B532B0DFC1B3784F6722B5D10F5E93091578A72D8F990E8E52C663B4305EF921BF977210F83DDA9AB99E3B2D3
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8E041432-60D8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	54592
Entropy (8bit):	2.1091612985215047
Encrypted:	false
SSDEEP:	384:rtJyCahNxN29CqMzmMXetmyAmtNMCpxHe+kfO:TEz+
MD5:	4DA08B4E3257DC3F6653DA8D607DBB0C
SHA1:	9C5AE53BECDE12B8FFF12D48A5D68230E7100A64
SHA-256:	42D2C97B4237FD3EE85F651562EE4A751B7BEBD5953F6133FAE53E76DEDD7400
SHA-512:	8EB898FD47B51F5F5A98BC2D1480A6199EE52213D48915C356E3B64EFAD3901D8AF420CCEA2A20B189D99A7184B4B9295A1388DA7FC22258955BF156C26B5E47
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{8E041433-60D8-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5655320477507368
Encrypted:	false
SSDEEP:	48:IwRGcprkGwpav0G4pQNmGrapbSqrGQpKEG7HpR7sTGIpG:rnZcQM6yBSqFAPT74A
MD5:	8767D84E048FAAE353E8E6B636038D5E
SHA1:	F2CB1057A8DE22DCA5B7D4B2E407D2C59AF31CAD
SHA-256:	C66496053A3CB9A8E449CC67E6AE8138ADAD309FA98967F0D6D66DBC2E0CC364
SHA-512:	4B9BE50BFD33F502EEA112016D0CDC49D3696D5341D181CCF6FAF2277FEC195A63DBEADE45457BDA3E492D0CE0D358B74C095E37CC63F55CF49D6ECB3C3F9461
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	18500
Entropy (8bit):	3.141141526588462
Encrypted:	false
SSDEEP:	48:yJ56J5PJ5XJ5YgyyyyyyyyyyyyyXJ5KCJ5/QQQQQt:y4TTwr9QQQQQt
MD5:	C3C046E79AFF9CAC76C5C6AD1E37A781
SHA1:	57ACF932447BC97662BF7A87D8C9741525688F18
SHA-256:	1550E4A08EB8F2FD82B4B342019E58D63FE1855F8CCA4A2900045F5B315D75BB
SHA-512:	195A1DAFEE40BD4D9C7CEEFF16E8A71F098FCF1BC373B1060900B80FEA763A43218152BFC9D034D37F92ACFC5CA92C305487936139359913F49E74D9F906485C
Malicious:	false
Reputation:	low
Preview:	Y.h.t.t.p.s.:././.a.a.d.c.d.n...m.s.f.t.a.u.t.h...n.e.t./.e.s.t.s./.2...1./.c.o.n.t.e.n.t./.i.m.a.g.e.s./.f.a.v.i.c.o.n._.a._.e.u.p.a.y.f.g.g.h.q.i.a.i.7.k.9.s.o.l.6.l.g.2...i.c.o.~(................h(......(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...3333333333333333

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2_bc3d32a696895f78c19df6c717586a5d[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\53_8b36337037cff88c3df203bb73d58e41[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 342 x 72, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5139
Entropy (8bit):	7.865234009830226
Encrypted:	false
SSDEEP:	96:oX2DsRVNYc82nTGTirCPqKO1gDPFjDiwK3aM5yO/bUlVV6JKo5N9jIMw7RLW1ZHb:ofRgc82nTprQsgDNDP7QgVVoH9+kMK9
MD5:	8B36337037CFF88C3DF203BB73D58E41
SHA1:	1ADA36FA207B8B96B2A5F55078BFE2A97ACEAD0E
SHA-256:	E4E1E65871749D18AEA150643C07E0AAB2057DA057C6C57EC1C3C43580E1C898
SHA-512:	97D8CC97C4577631D8D58C0D9276EE55E4B80128080220F77E01E45385C20FE55D208122A8DFA5DADCB87543B1BC291B98DBBA44E8A2BA90D17C638C15D48793
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/applogos/53_8b36337037cff88c3df203bb73d58e41.png
Preview:	.PNG........IHDR...V...H.............tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 21.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:DB120779422011EA9888910153D3A5E6" xmpMM:DocumentID="xmp.did:DB12077A422011EA9888910153D3A5E6"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:DB120777422011EA9888910153D3A5E6" stRef:documentID="xmp.did:DB120778422011EA9888910153D3A5E6"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>P.WI....IDATx..]]l.......(.5.K0P..0...E.qT..J X)F.(5X....J.}(m.R5.Q...RUEUPU~.....qp@.b......L...k.m"0......"c.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 18008, version 0.0
Category:	downloaded
Size (bytes):	18008
Entropy (8bit):	7.977764422214136
Encrypted:	false
SSDEEP:	384:7mAUrbRiggCDixr7Tzx92P5jYDdASFl4B8ZbHr2:1qbRi1jnxgP50lFl4qLr2
MD5:	F072C46AC454354FEF9915B3A1DDBB8D
SHA1:	49126892FEAF3A75D962BE43C3AB61382C4E4B0A
SHA-256:	F0D84AEF3E8F76C35FD7B689CFD19A1198E25A4F65E2365B7EEFF74831BFE741
SHA-512:	686FF0EE58A2FEB14352A4D98D7D774B7469C08DC377BD46ED27B0640E2088933A898A5349699B2AB2EE6D1E0203EDFD183748C1A8B4AEAC01861DD295D8EED8
Malicious:	false
Reputation:	low
IE Cache URL:	https://use.typekit.net/af/54d47a/000000000000000000017750/27/d?subset_id=2&fvd=n4&v=3
Preview:	wOFFOTTO..FX......d.........................CFF ...<..2{..<G.%.VDYNA..6.........dM..GDEF..7d...!..."...qGDYN..7.........3Y.#GPOS..8\...\.....f..OS/2.......R...`.jY.cmap..D...........r.gasp...D............head...L...6...6.9..hhea....... ...$....hmtx..B........D.v#.maxp...4..........P.name.......9...i8y.Rpost..D........ ......................e._.<..........D.d......V..E..................x.R.N.1.....C.J...O U.w....@Dp@....b.U.8Zo..>B...>./..{....z..1.m9d-.........x..(a.\|.\..j.-q.U\|......q.o........7..?=.!YU....oK..%l....Q+.y\...G...\|.x.[._.o"...~.s...<.... b)..XF.u.....'zR.q:....L..,..I>P.Pt.L8...2.W.P.f.,5#5....&y2T....#ve..4[A+.c1.......\Y.s.E/.Z..U.".,.-....i.[.3..7...(.R..up...,.GE1m7..b..ia.h(.MC..D....4.X G.!F( ...Cr.!p(......H.a....j'TX\|Jt..y.!s...c.9.Pd..w...Wo4n....=.c...'7un6+._p.:.z..'U\..........c...C`.FH.s.!.q..z..;'....C..c\0?d...z.Ug.3m.u\.....).]..y.....}=..~.~.........m48.v{..1=.?.i0...b...%....=(....x.c`f\|.8.......).....B3.1.0..E....@...d.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\e7fb1b89a0[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\translations[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	141
Entropy (8bit):	4.468570157713101
Encrypted:	false
SSDEEP:	3:qorzMYEGJfAFEHRMKQeA6YBCrMW5MsBPmtrrX5MsBKsAF24ne:q9YE4vHRM1ZAJAJpXn
MD5:	C2571C36C331F0D5BD8C67FF789A6100
SHA1:	F879DE1FDB675BAF27BBBEBA94114CA23BE099DA
SHA-256:	6650C64DAB8BFBA200DAAB73D82C0A8A3E5E7021B2E7A008A21489CFD65E7779
SHA-512:	2CCE0C3A47335873C40EF9368DA8767F85F0694EAE19DD54DF9143181C141E9587B85EEB75B4B1DA5E355A02ADDA9614717DC96648CEAC7EFB6041FE45F8146B
Malicious:	false
Reputation:	low
IE Cache URL:	https://lowrybrenda714e.myportfolio.com/site/translations?cb=
Preview:	var __languages__ = {"localizedValidationMessages":{"required":"This field is required","Email":"This field must be a valid email address"}};

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\PEOKBA7N.js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	16979
Entropy (8bit):	5.5733201476327885
Encrypted:	false
SSDEEP:	384:70N2tpIgIPs51iRm2lIew42noFeFsP9btiCtpIaCR:oHq1iRm2XwMqsbbt6J
MD5:	F4BD26CA15C36CBF51350C9EEB3FCDFE
SHA1:	4659CEE856BECFE5AB99913F32613E2A258C97A4
SHA-256:	558BB2E6CF04847D13B6F33BE772F266C68C1DC9203621893F5CB57528B211F0
SHA-512:	E25D7ECAA222975A5D163D34CF576DC628E0403E8DB4569299204A630DBABC7DE991575A660B153D6D64AF9A34FA30E005348FC187800989C3E041610CC9BF17
Malicious:	false
Reputation:	low
IE Cache URL:	https://use.typekit.net/ik/B9mSgM2bUlJHekf6iRjH4H4lW4bTtUvKAHzhP1Xzou9fenwgfHYEBsJzwD9oFDIDWhjoFDiy5Q4qweFRwRwojDMuFRJhwQscwhs8wQMowRZyZcjuFhbkwhI-mkG0dW83da4XZcNC-Av0jhNlOfG0SY4zwKuh-AmaOcuoSeNkieZzde8zOcFzdPUlpWgzS1scdhUTdkoRdhXCSY4zwKuh-AmaOcuoSeNkieZzde8zOcFzdPJIjcT3ZkGHfH_JMsMMeMb6MKGHfHDJMsMMeMS6MTMga0_BtM9.js?cb=
Preview:	/. The Typekit service used to deliver this font or fonts for use on websites. * is provided by Adobe and is subject to these Terms of Use. * http://www.adobe.com/products/eulas/tou_typekit. For font license. * information, see the list below.. . bjpg:. * - http://typekit.com/eulas/000000000000000000017750. * - http://typekit.com/eulas/00000000000000007735a6b9. . . 2009-2020 Adobe Systems Incorporated. All Rights Reserved.. */.if(!window.Typekit)window.Typekit={};window.Typekit.config={"a":"359713","dl":"AAAAOgAAAAqUFa0vAgThMw","fi":[25646,25644],"fc":[{"id":25646,"family":"bjpg","src":"https://use.typekit.net/af/54d47a/000000000000000000017750/27/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"400","style":"normal","display":"auto","subset_id":2}},{"id":25644,"family":"bjpg","src":"https://use.typekit.net/af/3e2979/00000000000000007735a6b9/30/{format}{?primer,subset_id,fvd,v}","descriptors":{"weight":"700","style":"normal","display":"auto","subset_id":2}}],"f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	513
Entropy (8bit):	4.720499940334011
Encrypted:	false
SSDEEP:	12:t4BdU/uRqv6DLfBHKFWJCDLfBSU1pRXIFl+MJ4bADc:t4TU/uRff0EcfIU1XXU+t2c
MD5:	A9CC2824EF3517B6C4160DCF8FF7D410
SHA1:	8DB9AEBAD84CA6E4225BFDD2458FF3821CC4F064
SHA-256:	34F9DB946E89F031A80DFCA7B16B2B686469C9886441261AE70A44DA1DFA2D58
SHA-512:	AA3DDAB0A1CFF9533F9A668ABA4FB5E3D75ED9F8AFF8A1CAA4C29F9126D85FF4529E82712C0119D2E81035D1CE1CC491FF9473384D211317D4D00E0E234AD97F
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/arrow_left_a9cc2824ef3517b6c4160dcf8ff7d410.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24"><title>assets</title><path d="M18,11.578v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944.594.594L7.617,11.578Z" fill="#404040"/><path d="M10.944,7.056l.594.594L7.617,11.578H18v.844H7.617l3.921,3.928-.594.594L6,12l4.944-4.944m0-.141-.071.07L5.929,11.929,5.858,12l.071.071,4.944,4.944.071.07.071-.07.594-.595.071-.07-.071-.071L7.858,12.522H18.1V11.478H7.858l3.751-3.757.071-.071-.071-.07-.594-.595-.071-.07Z" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ellipsis_635a63d500a92a0b8497cdc58d0f66b1[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	900
Entropy (8bit):	3.8081778439799248
Encrypted:	false
SSDEEP:	24:t4CvnAVRHf1QqCSzGUdiHTVtpRduf1QqCWbVHTVeUV0Uv6f1QqCWbVHTVeUV0UFl:fn+1QqC4GuiHFXS1QqCWRHQ3V1QqCWRV
MD5:	635A63D500A92A0B8497CDC58D0F66B1
SHA1:	A32EBA4B4D139E8DA52C5801A13C1EE222B2B882
SHA-256:	61D7CCC5D2C41BF86BE6CEFB0063405067849BA64E9F219F60596EF09A54A942
SHA-512:	EFFE15E105FC5FA853E76917B533AAE6C75EBA9A256049FB5EAB88BBF319D63A4CE4AE3743A09D6A5F474B01649D6EDC5C8BCCC61B8CA9EA9E5C39E7AE724C16
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_635a63d500a92a0b8497cdc58d0f66b1.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	3.8525277758130154
Encrypted:	false
SSDEEP:	24:t4CvnAVRfFArf1QqCSzGUdiHTVtpRduf1QqCWbVHTVeUV0Uv6f1QqCWbVHTVeUVx:fn1r1QqC4GuiHFXS1QqCWRHQ3V1QqCWz
MD5:	2B5D393DB04A5E6E1F739CB266E65B4C
SHA1:	6A435DF5CAC3D58CCAD655FE022CCF3DD4B9B721
SHA-256:	16C3F6531D0FA5B4D16E82ABF066233B2A9F284C068C663699313C09F5E8D6E6
SHA-512:	3A692635EE8EBD7B15930E78D9E7E808E48C7ED3ED79003B8CA6F9290FA0E2B0FA3573409001489C00FB41D5710E75D17C3C4D65D26F9665849FB7406562A406
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/ellipsis_grey_2b5d393db04a5e6e1f739cb266e65b4c.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path fill="#777777" d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\font-awesome[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	troff or preprocessor input, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	37414
Entropy (8bit):	4.82325822639402
Encrypted:	false
SSDEEP:	768:mmMtI+A4CSIDqvnI+YTBrFPvVrJjhiRAiiEL:mXtI+A4GDUI+Y9rpVljhiIEL
MD5:	C495654869785BC3DF60216616814AD1
SHA1:	0140952C64E3F2B74EF64E050F2FE86EAB6624C8
SHA-256:	36E0A7E08BEE65774168528938072C536437669C1B7458AC77976EC788E4439C
SHA-512:	E40F27C1D30E5AB4B3DB47C3B2373381489D50147C9623D853E5B299364FD65998F46E8E73B1E566FD79E97AA7B20354CD3C8C79F15372C147FED9C913FFB106
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). /./ FONT PATH. * -------------------------- /.@font-face {. font-family: 'FontAwesome';. src: url('../fonts/fontawesome-webfont.eot?v=4.7.0');. src: url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'), url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'), url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'), url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'), url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');. font-weight: normal;. font-style: normal;.}..fa {. display: inline-block;. font: normal normal normal 14px/1 FontAwesome;. font-size: inherit;. text-rendering: auto;. -webkit-font-smoothing: antialiased;. -moz-osx-font-smoothing: grayscale;.}./ makes the font 33% larger relative to the icon container */..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\main[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	11553
Entropy (8bit):	5.530327781931645
Encrypted:	false
SSDEEP:	192:+3b3h34J/A7Npoh66i85hVefXIMEAOb3J1lMmPbx1ZaZiSJUSwUKpMAIXU4MMNop:RXlml1jjqPSYas
MD5:	C2CA4403CD337D44981DCC6F4DF8A21A
SHA1:	A72AC2384AF4AD64E7D7D3732EE6C351D3BA4C8D
SHA-256:	009A029A1FBE7EC1821F8884761847D0C4857770DC9AEFE51C13FF36C9AC6FD2
SHA-512:	750822CB33C9AD4B3FD0CA04C8BFB37E95C8D668D2D3E9D38B5FDC95A8B8B5AB9193E1109DDEBFA7D9A250B842D1D35F50A942B22E143FCC7A1597D211B6DD9B
Malicious:	false
Reputation:	low
IE Cache URL:	https://lowrybrenda714e.myportfolio.com/dist/css/main.css
Preview:	.disable-download img {. pointer-events: none; }.@-webkit-keyframes rotate-forever {. 0% {. -webkit-transform: rotate(0deg);. -moz-transform: rotate(0deg);. -ms-transform: rotate(0deg);. -o-transform: rotate(0deg);. transform: rotate(0deg); }. 100% {. -webkit-transform: rotate(360deg);. -moz-transform: rotate(360deg);. -ms-transform: rotate(360deg);. -o-transform: rotate(360deg);. transform: rotate(360deg); } }..@-moz-keyframes rotate-forever {. 0% {. -webkit-transform: rotate(0deg);. -moz-transform: rotate(0deg);. -ms-transform: rotate(0deg);. -o-transform: rotate(0deg);. transform: rotate(0deg); }. 100% {. -webkit-transform: rotate(360deg);. -moz-transform: rotate(360deg);. -ms-transform: rotate(360deg);. -o-transform: rotate(360deg);. transform: rotate(360deg); } }..@keyframes rotate-forever {. 0% {. -webkit-transform: rotate(0deg);. -moz-transform: rotate(0deg);. -ms-transform: rotate(0deg);. -o-transform

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\p[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	35
Entropy (8bit):	2.9302005337813077
Encrypted:	false
SSDEEP:	3:CUHaaatrllH5:aB
MD5:	81144D75B3E69E9AA2FA3E9D83A64D03
SHA1:	F0FBC60B50EDF5B2A0B76E0AA0537B76BF346FFC
SHA-256:	9B9265C69A5CC295D1AB0D04E0273B3677DB1A6216CE2CCF4EFC8C277ED84B39
SHA-512:	2D073E10AE40FDE434EB31CBEDD581A35CD763E51FB7048B88CAA5F949B1E6105E37A228C235BC8976E8DB58ED22149CFCCF83B40CE93A28390566A28975744A
Malicious:	false
Reputation:	low
IE Cache URL:	https://p.typekit.net/p.gif?s=2&k=359713_f977a92d0cc239c0562614f3de10926aff57d23a&ht=tk&h=lowrybrenda714e.myportfolio.com&f=25646.25644&a=359713&js=1.20.0&app=typekit&e=js&_=1611776880827
Preview:	GIF89a.............,..............;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\picker_account_add_56e73414003cdb676008ff7857343074[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	222
Entropy (8bit):	5.004415423297573
Encrypted:	false
SSDEEP:	3:tIsqDmJS4RKb5zMc7XpCN+bJMacvRxyJAgR/QvfqhcDQKG2TcVER+HLZqWTboZUq:tI9mc4slztdbC/yXADQKDTcVEqLwDZsc
MD5:	56E73414003CDB676008FF7857343074
SHA1:	9ED7A58CD0E81E9689AC8C6D548A47D0185E0FDC
SHA-256:	749F85621D92A5B31B2A377A8C385A36D48A83327DAD9A8A8DA93CD831B8C9A2
SHA-512:	FAD0071AC2DFA23989BFBC7D3850415F3C340A74A54D3D8D797AFCCD6A301513BBC769DF4E5148605BE1E23A8750973EB80726F3CC959A2A457B0EC09AE14F27
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_add_56e73414003cdb676008ff7857343074.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M25,23H36v2H25V36H23V25H12V23H23V12h2Z" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Secure[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	252
Entropy (8bit):	5.159199482734767
Encrypted:	false
SSDEEP:	6:pn0+Dy9xwol6hEr6VX16hu9nP2Xe1+3mzw22+KqD:J0+ox0RJWWPb1+3mzwET
MD5:	906456EFC733F23B6480F07A2470AB27
SHA1:	665365E73633E421B1B652404BE25EDD8B52B0F9
SHA-256:	C0BB2227B11586F24D0146F589B942CD226ED843EAFB1634E5CFE0A12469C33F
SHA-512:	BE68092FD9220E4BE922BD38F494362F1DE5FEC9C5267962853EA2F0130DC4F5D89043A9334C468C2AB4E4DBF689346849B9F1517BC9DE57CD1BE76E6A653F6B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\Secure[1].htm, Author: Joe Security
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>301 Moved Permanently</title>.</head><body>.<h1>Moved Permanently</h1>.<p>The document has moved <a href="https://nobledriving.co.uk/securefax/Secure/">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\d[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, CFF, length 18408, version 0.0
Category:	downloaded
Size (bytes):	18408
Entropy (8bit):	7.981061241431765
Encrypted:	false
SSDEEP:	384:9cTTA9ogK6CvLGDQWxFXaZozltCNslyplZ/hYhNDcoa0c8o18yp:uTIz/QC/ZcfddGQtp
MD5:	049375D4B5658F1E309CBDB23B267BB4
SHA1:	69814BB116C89EC2CF059C61A9FFA62CCA0D6F6A
SHA-256:	4F60549518CA1750042DF065161EF6ACD6A5FF3609C2FA069E5E1299DCD5B427
SHA-512:	868DCA96EAEB91ABCBA6C964B02530A2F35DCABF736BE1B709463978A8C8189CBC245209D8D523450A1FAFE08A657CD54C13A26A9C2E22BE29D0BFFF9651D43D
Malicious:	false
Reputation:	low
IE Cache URL:	https://use.typekit.net/af/3e2979/00000000000000007735a6b9/30/d?subset_id=2&fvd=n7&v=3
Preview:	wOFFOTTO..G.......f.........................CFF ...8..3...<\|...7DYNA..7D........b..fGDEF..7....!..."...vGDYN..8.............GPOS..8....e..."...bOS/2.......T...`..H{cmap..F`...........yhead...0...6...6..bhhea....... ...$.}.>hmtx..DP.......H...vmaxp...0..........P.name...h...T...4).n.post..FL....... ............<.._.<..........D0D.......{.<...E..............x.R.N.@.=q.R..U..f....?HbV.!.,P......%.A..(../....t.m..@....OL.....{.9..3..x..ha.}.Z......A._.....w..?....xh.&>.W....7.Z.7l...kp.[.~..t...m\|v...y...'.{.7.8...l;..vU..\|..E e....{b....Gz67.d6.[.T.\|.......{e)l...2..S.'..,L.2...qR%Sum[\^.P..h..q..b.\z.'.7.7G....)-...e&.0.&q4.T.E...O.(.?J'j4P.V...JU..3.{R..{...2..........I.SU+.+...\|....N2Hc.@..+T(0E.9_..+..Ep-.....1..Jl.0;b..5>!.0nq.r..@..B.E..\|..%..Dc3....3...CJna........LX.p.L.%.._Pm....C.1oQ......:x....oV.y.wF.....}..j.?.......r7b..~.l.._.r.O^.,...OFJ.b.._...N....{...j.Z.../..9..`.}...&.kNV.o.'^W.b....B.=`...r\.xx.c`f.`..................D........ .e.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	354344
Entropy (8bit):	4.166048581919882
Encrypted:	false
SSDEEP:	6144:S0MYxu9637SL3O2y1LRo7y7SrU2SSE8qUpgLM8Ij19iweKqiNebljiENlyR4BiCY:SNDI37sO2y1LRo7y2U2SSE8qUQM8e/iC
MD5:	F90A92BEBB436E19DA2E72400493FDA4
SHA1:	3DABB13E104F7168613DA2A766AF3D12886CDF43
SHA-256:	054BBE56161A924C1926D0D13D9F73584B2DE6F3986BA7649F1A8FB4D6580B54
SHA-512:	6FF9B520BF1A79840B1420619CF3D028214745BB982E7D5C80E1B9F89725CB60368FDE0B2A660E77531B5C108EA3F1545E2FAC33EB88E9D0EF9EC06738E1979F
Malicious:	false
Reputation:	low
IE Cache URL:	https://lowrybrenda714e.myportfolio.com/dist/js/main.js?cb=
Preview:	!function(t) {. function e(r) {. if (n[r]) return n[r].exports;. var i = n[r] = {. i: r,. l: !1,. exports: {}. };. return t[r].call(i.exports, i, i.exports, e), i.l = !0, i.exports;. }. var n = {};. e.m = t, e.c = n, e.d = function(t, n, r) {. e.o(t, n) \|\| Object.defineProperty(t, n, {. configurable: !1,. enumerable: !0,. get: r. });. }, e.n = function(t) {. var n = t && t.__esModule ? function() {. return t.default;. } : function() {. return t;. };. return e.d(n, "a", n), n;. }, e.o = function(t, e) {. return Object.prototype.hasOwnProperty.call(t, e);. }, e.p = "/js/", e(e.s = 54);.}([ function(t, e, n) {. var r, i;. /!. jQuery JavaScript Library v2.2.4. * http://jquery.com/. . Includes Sizzle.js. * http://sizzlejs.com/. . Copyright jQuery Foundation and other contributors. * Released u

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	756
Entropy (8bit):	4.879179443781471
Encrypted:	false
SSDEEP:	12:t4pb8WsQKvkBWSfYcW3ffBfYfomQO1a7aajR2F1hgWSnuCNSganii7v/NPujARqj:t4pb8WvKMTfY3ffBfYfomQO1eXjR2oug
MD5:	9DE70D1C5191D1852A0D5AAC28B44A6C
SHA1:	F4F64F5CBDBE6D1115C10A7F9CCB8828E6B67CAE
SHA-256:	5D3357BD875B7335ACE42E8EE3A64578E4253BED1A4E279109DE403EEDAE3A69
SHA-512:	CAC13FC2FE30E10772008F2AFF70FCA031EA9918E1F8C5C8B91CB9E79463383183406EFAADF89360DE3A08573FCDF2716C14DA6411E24B7E260B96AF84F00762
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_account_aad_9de70d1c5191d1852a0d5aac28b44a6c.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><title>assets</title><circle cx="24" cy="24" r="24" fill="#e6e6e6"/><path d="M34,35V14a2.938,2.938,0,0,0-3-3H27V8l2-1L27.948,5.638,24,8,20.07,5.648,19,7l2,1v3H17a2.938,2.938,0,0,0-3,3V35a2.938,2.938,0,0,0,3,3H31A2.938,2.938,0,0,0,34,35Zm-3,1H17a.979.979,0,0,1-1-1V14a.979.979,0,0,1,1-1h6V10h2v3h6a.979.979,0,0,1,1,1V35A.979.979,0,0,1,31,36Z" fill="#404040"/><path d="M26.766,25.42a4.432,4.432,0,1,0-5.533,0A6.237,6.237,0,0,0,17.765,31h1.653a4.582,4.582,0,1,1,9.165,0h1.653A6.237,6.237,0,0,0,26.766,25.42Zm-5.546-3.435A2.779,2.779,0,1,1,24,24.765,2.783,2.783,0,0,1,21.221,21.985Z" fill="#404040"/><rect x="21" y="14" width="6" height="2" rx="1" ry="1" fill="#404040"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\picker_more_7568a43cf440757c55d2e7f51557ae1f[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	899
Entropy (8bit):	3.8260330857236338
Encrypted:	false
SSDEEP:	24:t4CvnAVROLgCWbVHTVSRUyL3Fe09gCWbVHTVeUVh10UsSgCWbVHTVeUVh10Usb7:fncCWRH0JL3FECWRHQA10rCWRHQA10F
MD5:	7568A43CF440757C55D2E7F51557AE1F
SHA1:	55C22CA98B5CDCED134F6E24205C288845312A2D
SHA-256:	B7FCD37EAAFE3F08647ED072D5289EADFFF6C660A26CDEF31532B3FCFB4A0BB2
SHA-512:	F01DA2804594C3C78C0694FD6CC49B667663DA95AE7367EE3F0F5112B9957A3220389AAE4A5B750BCB3BC4F1092EA614266A4BFFD7E0FE16232E1CB57606E901
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/ests/2.1/content/images/picker_more_7568a43cf440757c55d2e7f51557ae1f.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path d="M9.143,1.143a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.107,1.107,0,0,1-.089-.446A1.107,1.107,0,0,1,6.946.7,1.164,1.164,0,0,1,7.554.089a1.161,1.161,0,0,1,.893,0A1.164,1.164,0,0,1,9.054.7a1.107,1.107,0,0,1,.089.446M9.143,8a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607,1.161,1.161,0,0,1,.893,0,1.164,1.164,0,0,1,.607.607A1.107,1.107,0,0,1,9.143,8m0,6.857a1.107,1.107,0,0,1-.089.446,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607,1.161,1.161,0,0,1,.893,0,1.164,1.164,0,0,1,.607.607A1.107,1.107,0,0,1,9.143,14.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\CBDX8KFB.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	13688
Entropy (8bit):	5.439427193387985
Encrypted:	false
SSDEEP:	384:kyPdCvSS/yNrbLXTkI4SRR1Y7O00T7VFxUzw3iyoFCH:kyPNwIh1Y7D0TzxawloFY
MD5:	99811322BB28262BDCB29B76E3914508
SHA1:	D0BC435ABF0F5CC0FEBB4A128A622A79911C82FC
SHA-256:	5CC5B38FE07D9262DC05CF002DCE7F0ABCD1D02C395204058C155FBA831A7178
SHA-512:	07833F3EA39BB3E3107AAEC0157DA37D113E7FABE956EED28EF6CA82DAD968C4DB54797A2E13A4607E1F249192837E0107A3FA94A66D3BD705027AE229B38DE5
Malicious:	false
Reputation:	low
IE Cache URL:	https://lowrybrenda714e.myportfolio.com/
Preview:	<!DOCTYPE HTML>.<html lang="en-US">.<head>. <meta charset="UTF-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"e7fb1b89a0",applicationID:"750147145"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(6),c=e(7),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCurrentRouteNa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\Secure[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	116336
Entropy (8bit):	5.3816220537602755
Encrypted:	false
SSDEEP:	1536:Yhuhw+ExmazA/PWrF7qvEAFiQcpmNtuhPyJRp7xvnXE1Esns8lR:Yt4wyJjZnXE1Esns8H
MD5:	3752C84E2D4118729A264E7629A62E88
SHA1:	22C6C7C155B63E6F566BF554406A5F0780C3F800
SHA-256:	94860511EBE34294BA25E9D70248BA9855B1743CF7CB88796605494C130582D5
SHA-512:	BFCBFC34FD403CD7CBE119C697E1D71AF7F83E83C2BAD190852502C2CEC0669D117AAFB824BB0422667DAEC66D819F7FC40205AFB94C09CB4376572972CAEE03
Malicious:	false
Reputation:	low
IE Cache URL:	https://nobledriving.co.uk/securefax/Secure/
Preview:	<html dir="ltr" lang="en">.. <meta charset="utf-8">.. <link href="https://aadcdn.msftauth.net/ests/2.1/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico" rel="shortcut icon">.. <link rel="stylesheet" href="https://cdnjs.cloudflare.com/ajax/libs/font-awesome/4.7.0/css/font-awesome.css" integrity="sha256-NuCn4IvuZXdBaFKJOAcsU2Q3ZpwbdFisd5dux4jkQ5w=" crossorigin="anonymous">.. <style>... html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:bold}dfn{font-style:italic}h1{font-size:2em;margin:.67em 0}mark{background:#ff0;color:#000}small{font-size:80%}sub,sup{font-size:75%

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\d42c286c3ea44af105d458437c0a646f1611744117[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	75980
Entropy (8bit):	4.872123162914471
Encrypted:	false
SSDEEP:	1536:Gfmvpy8flxKgCtzyhBq5gVywBYDiRIFF920FEmGPn36TVQ:Gob0FEm23/
MD5:	39A756BA9E9DB3CE9BCE8BFCA80A133E
SHA1:	A65A34378DEB21BA3ABAAA620A9B659B7F6F34A7
SHA-256:	FD62831268BD7554FA54978B7B023FCC3B70C97BE63D3DBE52062935D9ADB484
SHA-512:	A4C275C6627DA089C8D59D4CE338B882E8081A355E762764693A65684208DC3062D41D5B551E7343004F0F079C11E4346B7ECBA124AD167C127745DD0EFE907B
Malicious:	false
Reputation:	low
IE Cache URL:	https://pro2-bar-s3-cdn-cf2.myportfolio.com/92ba9c29-e151-43bb-9cb5-03e2bee5b76a/d42c286c3ea44af105d458437c0a646f1611744117.css?h=ccfceff1efed9a168dfac59e404cd76f
Preview:	.site-header:after, .logo-wrap:after {. clear: both;. content: '';. display: table; }../! normalize.css v3.0.1 \| MIT License \| git.io/normalize /./*. 1. Set default font family to sans-serif.. * 2. Prevent iOS text size adjust after orientation change, without disabling. * user zoom.. /.html {. font-family: sans-serif;. / 1 /. -ms-text-size-adjust: 100%;. / 2 /. -webkit-text-size-adjust: 100%;. / 2 / }../. Remove default margin.. /.body {. margin: 0; }../ HTML5 display definitions. ========================================================================== /./. Correct `block` display not defined for any HTML5 element in IE 8/9.. * Correct `block` display not defined for `details` or `summary` in IE 10/11 and Firefox.. * Correct `block` display not defined for `main` in IE 11.. /.article,.aside,.details,.figcaption,.figure,.footer,.header,.hgroup,.main,.nav,.section,.summary {. display: block; }../. 1. Correct `inline-b

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\e7fb1b89a0[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery-3.1.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86709
Entropy (8bit):	5.367391365596119
Encrypted:	false
SSDEEP:	1536:9NhEyjjTikEJO4edXXe9J578go6MWXqcVhrLyB4Lw13sh2bzrl1+iuH7U3gBORDT:jxcq0hrLZwpsYbmzORDU8Cu5
MD5:	E071ABDA8FE61194711CFC2AB99FE104
SHA1:	F647A6D37DC4CA055CED3CF64BBC1F490070ACBA
SHA-256:	85556761A8800D14CED8FCD41A6B8B26BF012D44A318866C0D81A62092EFD9BF
SHA-512:	53A2B560B20551672FBB0E6E72632D4FD1C7E2DD2ECF7337EBAAAB179CB8BE7C87E9D803CE7765706BC7FCBCF993C34587CD1237DE5A279AEA19911D69067B65
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.1.1.min.js
Preview:	/! jQuery v3.1.1 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.1.1",r=function(a,b){return new r.fn.init(a,b)},s=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,t=/^-ms-/,u=/-([a-z])/g,v=function(a,b){return b.toUpperCase()};r.fn=r.prototype={jquery:q,constructor:r,length:0,toArray:function(){return f.call(this)},get:function(a){return null==a?f.call(this):a<0?this[a+this.length]:this[a]},pushStack:function(a){var b=r.merge(this.con

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\nr-1194.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	27995
Entropy (8bit):	5.315843674152876
Encrypted:	false
SSDEEP:	384:yZevj5a0nX8RfzDfNdPs8tSmwUyAH77jx+zJThEUi2bikgHIvPbo8fAYDVFKEJtx:yZUIVi8tSA76AFIHboA/DdtPWE5
MD5:	4F5C23CBA20072EDE6A543EFB2F986C3
SHA1:	B1BD2B130983492A7FB0841360582777C34DBBEB
SHA-256:	04446C6509E4513C239C7803CF8A8C3727E8CEF843C8537E48D5E05E1FA723CD
SHA-512:	BBE58442A3BE0F720FD7ECE43D0F59796B9D57DEC59577C99D93A69ECC96F190643E5498800853BF2143B5B39B86105E274A4AD51DCFFF3E686B5C320FEC654F
Malicious:	false
Reputation:	low
IE Cache URL:	https://js-agent.newrelic.com/nr-1194.min.js
Preview:	!function(n,e,t){function r(t,i){if(!e[t]){if(!n[t]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(t,!0);if(o)return o(t,!0);throw new Error("Cannot find module '"+t+"'")}var u=e[t]={exports:{}};n[t][0].call(u.exports,function(e){var o=n[t][1][e];return r(o\|\|e)},u,u.exports)}return e[t].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<t.length;i++)r(t[i]);return r}({1:[function(n,e,t){e.exports=function(n,e){return"addEventListener"in window?window.addEventListener(n,e,!1):"attachEvent"in window?window.attachEvent("on"+n,e):void 0}},{}],2:[function(n,e,t){function r(n,e,t,r,i){l[n]\|\|(l[n]={});var a=l[n][e];return a\|\|(a=l[n][e]={params:t\|\|{}},i&&(a.custom=i)),a.metrics=o(r,a.metrics),a}function o(n,e){return e\|\|(e={count:0}),e.count+=1,f(n,function(n,t){e[n]=i(t,e[n])}),e}function i(n,e){return e?(e&&!e.c&&(e={t:e.t,min:e.t,max:e.t,sos:e.te.t,c:1}),e.c+=1,e.t+=n,e.sos+=nn,n>e.max&&(e.max=n),n<e.min&&(e.min=n),e):{t:n}}function a(n,e){return

C:\Users\user\AppData\Local\Temp\~DF69821264FC6EDB01.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.32318525851869206
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laALc:kBqoxxJhHWSVSEabo
MD5:	7EDBD46B5124C2F0D858CBDEA3EFFB6B
SHA1:	5189311B91914FDF6726262FD909BC125BA7908D
SHA-256:	EDADD0CE65F596B726F03F687F542AA468A90AD67EBDB1F272D0F6043C687CB6
SHA-512:	B87AECE6D195AF48533386BF8E938DA8F315B6268F6CF84C2517ED1A04D25AF3FC08854457B15D3B415F87D6B2BA390E17A61E84DC80D39E1269DDB6C29B9099
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFB052A6523F436CBD.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	58749
Entropy (8bit):	1.3440584727198808
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+8aAhK6qMtM6iEiM5++gNOyKx+yK2kO:weM5ba
MD5:	A217F577E0FEB7AED3D90EBE371381D9
SHA1:	107A31111C5D3D6B078BB2A16EF8AB27087F4259
SHA-256:	61F0FABE4E6D789AF830A1BDE3F052A89634CFAEE9BD5DCAC18C476619DEC9BD
SHA-512:	E6CD5F0898C8E19AAF4E18F42BF100B8DBC699FCC11811ECDD2D6F158F4B32D0DD2D1C095B3444A5609ED1BBF435221BED083B62BE97F39CE8582500D9CDE556
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBA9B5AC1B8981F21.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.47699608853957276
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loqF9lom9lWHrH3WMrqNrH8u:kBqoIx3LH3W8qpH8u
MD5:	BB244B240AA62E57F1530EF645776B5D
SHA1:	148476B7B48C69B2B189CD5FBEB9D90EAB5D2495
SHA-256:	F1A48F3467D4F18BE023199FBE1894FCD8BBFF513342CC916D3CEF9445D57FAD
SHA-512:	73213762CC17FDB9553282C3BFB99462754AAD5F15E3136907FDF2A3AEE92BBA0371DBBA014FB15DF1AA7B210D0DC6255F6F8880B4D450A1FF5F4ADDACAB2E5C
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 11:48:00.810179949 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.811075926 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.854623079 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.854794025 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.855739117 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.855880976 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.876343012 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.876588106 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.920944929 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.920977116 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.922456980 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.922496080 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.922528028 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.922542095 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.922569036 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.922574997 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.924015045 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.924056053 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.924108982 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:00.924128056 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.924185038 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.924190998 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.956836939 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.957084894 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.962641954 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.962784052 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.962874889 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:00.999933958 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.000113010 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.000480890 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.000643015 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.005357027 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.005484104 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.005544901 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.005589008 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.005856037 CET	49705	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006145000 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006167889 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006242990 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006289005 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006294966 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006333113 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006370068 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006371975 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006408930 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006453991 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006455898 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006499052 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006535053 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006547928 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006572962 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.006629944 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.006690025 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.008521080 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.008631945 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.084201097 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.089469910 CET	443	49705	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.092602968 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.095216990 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.095406055 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.127557039 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128083944 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128151894 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128186941 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128226042 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128293037 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.128348112 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.128948927 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.128990889 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.129045010 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.129072905 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.130723000 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.130808115 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.130851030 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.130920887 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.133470058 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.133564949 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.140059948 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.140091896 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.140221119 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.141360998 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.141474962 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.141556978 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.141637087 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.142294884 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.142338991 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.142388105 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.142400980 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.144097090 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.144138098 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.144197941 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.144224882 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.145973921 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.146022081 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.146078110 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.146102905 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.146136045 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.146197081 CET	49706	443	192.168.2.3	151.101.0.119
Jan 27, 2021 11:48:01.146207094 CET	443	49706	151.101.0.119	192.168.2.3
Jan 27, 2021 11:48:01.146269083 CET	49706	443	192.168.2.3	151.101.0.119

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 27, 2021 11:47:55.867979050 CET	51281	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:47:55.918852091 CET	53	51281	8.8.8.8	192.168.2.3
Jan 27, 2021 11:47:56.895215034 CET	49199	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:47:56.943011045 CET	53	49199	8.8.8.8	192.168.2.3
Jan 27, 2021 11:47:57.924432993 CET	50620	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:47:57.974046946 CET	53	50620	8.8.8.8	192.168.2.3
Jan 27, 2021 11:47:58.962490082 CET	64938	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:47:59.011101007 CET	53	64938	8.8.8.8	192.168.2.3
Jan 27, 2021 11:47:59.708719969 CET	60152	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:47:59.769117117 CET	53	60152	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:00.698071003 CET	57544	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:00.712254047 CET	55984	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:00.746206999 CET	53	57544	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:00.797631025 CET	53	55984	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.090482950 CET	64185	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:01.101286888 CET	65110	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:01.152512074 CET	53	64185	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.160778046 CET	53	65110	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.726402044 CET	58361	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:01.744724989 CET	63492	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:01.784136057 CET	53	58361	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.805047035 CET	53	63492	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.817591906 CET	60831	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:01.868870974 CET	53	60831	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:01.969645977 CET	60100	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:02.022387981 CET	53	60100	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:04.747669935 CET	53195	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:04.797147989 CET	53	53195	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:05.705487967 CET	50141	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:05.765608072 CET	53	50141	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:06.668565035 CET	53023	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:06.716593981 CET	53	53023	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:20.540149927 CET	49563	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:20.763545036 CET	53	49563	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:21.618679047 CET	51352	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:21.667982101 CET	53	51352	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:21.804743052 CET	59349	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:21.863105059 CET	53	59349	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:21.966468096 CET	57084	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:22.014595985 CET	53	57084	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:27.586834908 CET	58823	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:27.645076990 CET	53	58823	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:29.705040932 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:29.752844095 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:30.319091082 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:30.371786118 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:30.714730978 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:30.762671947 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:31.323328018 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:31.374367952 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:31.729468107 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:31.788050890 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:32.338860035 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:33.745232105 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:34.161802053 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:34.354602098 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:34.415577888 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:37.761271000 CET	57568	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:37.809494019 CET	53	57568	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:38.355005026 CET	50540	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:38.414278030 CET	53	50540	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:44.816149950 CET	54366	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:44.873927116 CET	53	54366	8.8.8.8	192.168.2.3
Jan 27, 2021 11:48:44.978945971 CET	53034	53	192.168.2.3	8.8.8.8
Jan 27, 2021 11:48:45.037033081 CET	53	53034	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 27, 2021 11:48:00.712254047 CET	192.168.2.3	8.8.8.8	0x4606	Standard query (0)	lowrybrenda714e.myportfolio.com	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.090482950 CET	192.168.2.3	8.8.8.8	0x299e	Standard query (0)	pro2-bar-s3-cdn-cf2.myportfolio.com	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.101286888 CET	192.168.2.3	8.8.8.8	0x769b	Standard query (0)	use.typekit.net	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.726402044 CET	192.168.2.3	8.8.8.8	0x410a	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.744724989 CET	192.168.2.3	8.8.8.8	0xe338	Standard query (0)	p.typekit.net	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.969645977 CET	192.168.2.3	8.8.8.8	0xa007	Standard query (0)	bam-cell.nr-data.net	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:20.540149927 CET	192.168.2.3	8.8.8.8	0x1055	Standard query (0)	nobledriving.co.uk	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.618679047 CET	192.168.2.3	8.8.8.8	0x638a	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.804743052 CET	192.168.2.3	8.8.8.8	0x78d2	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.966468096 CET	192.168.2.3	8.8.8.8	0x5d43	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 27, 2021 11:48:00.797631025 CET	8.8.8.8	192.168.2.3	0x4606	No error (0)	lowrybrenda714e.myportfolio.com	prod.adobe-prod-view.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:00.797631025 CET	8.8.8.8	192.168.2.3	0x4606	No error (0)	prod.adobe-prod-view.map.fastly.net		151.101.0.119	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:00.797631025 CET	8.8.8.8	192.168.2.3	0x4606	No error (0)	prod.adobe-prod-view.map.fastly.net		151.101.64.119	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:00.797631025 CET	8.8.8.8	192.168.2.3	0x4606	No error (0)	prod.adobe-prod-view.map.fastly.net		151.101.128.119	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:00.797631025 CET	8.8.8.8	192.168.2.3	0x4606	No error (0)	prod.adobe-prod-view.map.fastly.net		151.101.192.119	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.152512074 CET	8.8.8.8	192.168.2.3	0x299e	No error (0)	pro2-bar-s3-cdn-cf2.myportfolio.com		143.204.5.181	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:01.160778046 CET	8.8.8.8	192.168.2.3	0x769b	No error (0)	use.typekit.net	use-stls.adobe.com.edgesuite.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:01.784136057 CET	8.8.8.8	192.168.2.3	0x410a	No error (0)	js-agent.newrelic.com	f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:01.805047035 CET	8.8.8.8	192.168.2.3	0xe338	No error (0)	p.typekit.net	p.typekit.net-v3.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:02.022387981 CET	8.8.8.8	192.168.2.3	0xa007	No error (0)	bam-cell.nr-data.net	tls12.newrelic.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:20.763545036 CET	8.8.8.8	192.168.2.3	0x1055	No error (0)	nobledriving.co.uk		23.235.215.62	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.667982101 CET	8.8.8.8	192.168.2.3	0x638a	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.667982101 CET	8.8.8.8	192.168.2.3	0x638a	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:21.863105059 CET	8.8.8.8	192.168.2.3	0x78d2	No error (0)	aadcdn.msftauth.net	aadcdnoriginneu.azureedge.net		CNAME (Canonical name)	IN (0x0001)
Jan 27, 2021 11:48:21.863105059 CET	8.8.8.8	192.168.2.3	0x78d2	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
Jan 27, 2021 11:48:22.014595985 CET	8.8.8.8	192.168.2.3	0x5d43	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 27, 2021 11:48:00.922528028 CET	151.101.0.119	443	192.168.2.3	49705	CN=*.myportfolio.com, OU=Behance, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 06 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013	Wed Jun 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:00.922528028 CET	151.101.0.119	443	192.168.2.3	49705	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:00.924108982 CET	151.101.0.119	443	192.168.2.3	49706	CN=*.myportfolio.com, OU=Behance, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 06 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013	Wed Jun 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:00.924108982 CET	151.101.0.119	443	192.168.2.3	49706	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:01.249013901 CET	143.204.5.181	443	192.168.2.3	49708	CN=*.myportfolio.com, OU=Behance, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 06 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013	Wed Jun 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:01.249013901 CET	143.204.5.181	443	192.168.2.3	49708	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:01.258341074 CET	143.204.5.181	443	192.168.2.3	49707	CN=*.myportfolio.com, OU=Behance, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jun 06 02:00:00 CEST 2019 Fri Mar 08 13:00:00 CET 2013	Wed Jun 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:01.258341074 CET	143.204.5.181	443	192.168.2.3	49707	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:21.160022974 CET	23.235.215.62	443	192.168.2.3	49721	CN=nobledriving.co.uk CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Dec 17 01:00:00 CET 2020 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004	Thu Mar 18 00:59:59 CET 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon May 18 02:00:00 CEST 2015	Sun May 18 01:59:59 CEST 2025
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Jan 27, 2021 11:48:21.161235094 CET	23.235.215.62	443	192.168.2.3	49722	CN=nobledriving.co.uk CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Dec 17 01:00:00 CET 2020 Mon May 18 02:00:00 CEST 2015 Thu Jan 01 01:00:00 CET 2004	Thu Mar 18 00:59:59 CET 2021 Sun May 18 01:59:59 CEST 2025 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN="cPanel, Inc. Certification Authority", O="cPanel, Inc.", L=Houston, ST=TX, C=US	CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	Mon May 18 02:00:00 CEST 2015	Sun May 18 01:59:59 CEST 2025
					CN=COMODO RSA Certification Authority, O=COMODO CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
Jan 27, 2021 11:48:21.755372047 CET	104.16.19.94	443	192.168.2.3	49724	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:21.755372047 CET	104.16.19.94	443	192.168.2.3	49724	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:21.755625963 CET	104.16.19.94	443	192.168.2.3	49723	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:21.755625963 CET	104.16.19.94	443	192.168.2.3	49723	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 27, 2021 11:48:22.043992996 CET	152.199.23.37	443	192.168.2.3	49730	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jan 27, 2021 11:48:22.044745922 CET	152.199.23.37	443	192.168.2.3	49729	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jan 27, 2021 11:48:22.044902086 CET	152.199.23.37	443	192.168.2.3	49728	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jan 27, 2021 11:48:22.045003891 CET	152.199.23.37	443	192.168.2.3	49727	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jan 27, 2021 11:48:22.045600891 CET	152.199.23.37	443	192.168.2.3	49726	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jan 27, 2021 11:48:22.046135902 CET	152.199.23.37	443	192.168.2.3	49725	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 3892 Parent PID: 792

General

Start time:	11:47:58
Start date:	27/01/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6ad9a0000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 2416 Parent PID: 3892

General

Start time:	11:47:58
Start date:	27/01/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:3892 CREDAT:17410 /prefetch:2
Imagebase:	0xe70000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://lowrybrenda714e.myportfolio.com/

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Signature Overview

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 3892 Parent PID: 792

General

Analysis Process: iexplore.exe PID: 2416 Parent PID: 3892

General

Disassembly