Play interactive tour

Edit tour

Analysis Report https://bms.kaseya.com/Common/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d

Overview

General Information

Sample URL:	https://bms.kaseya.com/Common/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d
Analysis ID:	377425
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Classification

Startup

System is w10x64

iexplore.exe (PID: 2284 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5764 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2284 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 5912 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4704 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6700 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17412 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

iexplore.exe (PID: 6800 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17414 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus detection for URL or domain

Show sources

Source: https://djkraiz.com/wp-content/plugins/kirki/next.php

Avira URL Cloud: Label: phishing

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49713 version: TLS 1.2

Source: unknown

DNS traffic detected: queries for: bms.kaseya.com

Source: font-awesome.min[1].css.9.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.9.dr	String found in binary or memory: http://fontawesome.io/license
Source: bootstrap.min[1].css.9.dr	String found in binary or memory: http://getbootstrap.com)
Source: popper.min[2].js.9.dr	String found in binary or memory: http://opensource.org/licenses/MIT).
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Source: GetFile[1].htm.2.dr	String found in binary or memory: https://bms.kaseya.com/media/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2f
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.2.1.slim.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.slim.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://djkraiz.com/wp-content/plugins/kirki/next.php
Source: bootstrap.min[3].js.9.dr	String found in binary or memory: https://getbootstrap.com)
Source: bootstrap.min[2].js.9.dr, bootstrap.min[4].js.9.dr	String found in binary or memory: https://getbootstrap.com/)
Source: bootstrap.min[3].js.9.dr, bootstrap.min[1].css.9.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: bootstrap.min[3].js.9.dr	String found in binary or memory: https://github.com/twbs/bootstrap/graphs/contributors)
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Source: 70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	String found in binary or memory: https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css

Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 49706 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 49705 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49712 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708
Source: unknown	Network traffic detected: HTTP traffic on port 49713 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49706
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49705
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49713
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49712

Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49706 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49705 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.10.207:443 -> 192.168.2.7:49712 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.18.94:443 -> 192.168.2.7:49713 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@11/33@5/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2B7573E0-90E2-11EB-90E6-ECF4BB82F7E0}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user~1\AppData\Local\Temp\~DF74C13A3549E002DA.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2284 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17412 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17414 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2284 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17412 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17414 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://bms.kaseya.com/Common/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://getbootstrap.com)	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://djkraiz.com/wp-content/plugins/kirki/next.php	0%	Virustotal		Browse
https://djkraiz.com/wp-content/plugins/kirki/next.php	100%	Avira URL Cloud	phishing

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
stackpath.bootstrapcdn.com	104.18.10.207	true	false	high
cdnjs.cloudflare.com	104.16.18.94	true	false	high
maxcdn.bootstrapcdn.com	104.18.10.207	true	false	high
origin-bms.kaseya.com	52.144.52.222	true	false	high
bms.kaseya.com	unknown	unknown	false	high
code.jquery.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
0	true		low

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	font-awesome.min[1].css.9.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://github.com/twbs/bootstrap/graphs/contributors)	bootstrap.min[3].js.9.dr	false		high
https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://getbootstrap.com)	bootstrap.min[3].js.9.dr	false	Avira URL Cloud: safe	low
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://code.jquery.com/jquery-3.2.1.slim.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
http://getbootstrap.com)	bootstrap.min[1].css.9.dr	false	Avira URL Cloud: safe	low
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[3].js.9.dr, bootstrap.min[1].css.9.dr	false		high
https://code.jquery.com/jquery-3.3.1.slim.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
http://opensource.org/licenses/MIT).	popper.min[2].js.9.dr	false		high
https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://getbootstrap.com/)	bootstrap.min[2].js.9.dr, bootstrap.min[4].js.9.dr	false		high
https://code.jquery.com/jquery-3.3.1.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://djkraiz.com/wp-content/plugins/kirki/next.php	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	true	0%, Virustotal, Browse Avira URL Cloud: phishing	unknown
https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js	70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html.2.dr	false		high
https://bms.kaseya.com/media/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2f	GetFile[1].htm.2.dr	false		high
http://fontawesome.io/license	font-awesome.min[1].css.9.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.18.10.207	stackpath.bootstrapcdn.com	United States	13335	CLOUDFLARENETUS	false
104.16.18.94	cdnjs.cloudflare.com	United States	13335	CLOUDFLARENETUS	false
52.144.52.222	origin-bms.kaseya.com	United States	50292	STRATOGENGB	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	377425
Start date:	29.03.2021
Start time:	15:56:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 10s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	https://bms.kaseya.com/Common/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	24
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@11/33@5/3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, rundll32.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, SgrmBroker.exe, conhost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 104.43.193.48, 13.88.21.125, 13.64.90.137, 88.221.62.148, 52.255.188.83, 184.30.20.56, 69.16.175.10, 69.16.175.42, 172.217.168.74, 152.199.19.161, 104.42.151.234, 20.82.210.154, 104.43.139.144, 20.49.157.6, 92.122.213.194, 92.122.213.247, 20.54.26.129 Excluded domains from analysis (whitelisted): cds.s5x3j6q5.hwcdn.net, arc.msn.com.nsatc.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, go.microsoft.com, arc.trafficmanager.net, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, ajax.googleapis.com, ie9comview.vo.msecnd.net, ris-prod.trafficmanager.net, e1723.g.akamaiedge.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, ris.api.iris.microsoft.com, skypedataprdcoleus17.cloudapp.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus15.cloudapp.net, skypedataprdcolwus16.cloudapp.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{2B7573E0-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	32344
Entropy (8bit):	1.789750954044342
Encrypted:	false
SSDEEP:	192:rpZOZS2hWytXifn2UzMccBcCskWqTAqigp2:rfaRQKwOFgR
MD5:	5968CD2BCD7921E1D6ED7EF28EFC26B0
SHA1:	600112657D0255343D400E00F3C02FF4C776DB3E
SHA-256:	C283C2CDF59C12469377851A94277BA3FB6E260AF57A851EDBDFC011276D900C
SHA-512:	5438F5F1390E8019A28C7CC4A249D26E85B63A7C1E612FDF3C18851008469C04F6646CFA03C5C17117ECC6B1FB2A55A3D76D2A104976124D698F839AA10527A4
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{3A84AB9C-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	53336
Entropy (8bit):	1.975291010994984
Encrypted:	false
SSDEEP:	192:rVZ2ZP26WytJfnCtdkAzWP6IDPNOBPSytPIk9jLa6QW4RYt2YkdTsUagnrfpkiDX:rbyeZK56oPZP8PpPngnZgWr7
MD5:	1704F6E0B1ACE3F17E20B71163E73115
SHA1:	75019D5D096CEBA1243EEE35E2747EA7336C99D0
SHA-256:	BA690B647FA79781A241ED1D00E649EF666E82B2E101B1AF12D246520C879BDB
SHA-512:	02BC32D12959E1A9B464583D5E7769109EBE9F64B4C50FEACC7450DA40C281993566BDA36F3B938A144615EB19A37AF1F3ED5F1C1ECB8DE0C668B327CA00892C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{2B7573E2-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.598312587987989
Encrypted:	false
SSDEEP:	48:IwRGcprMZGwpaQG4pQwGrapbSeGQpBFYGHHpcvTGUpQ23OGcpm:rnZ4QQ6OBS2j1256dg
MD5:	58A16C3035382A8DC6F7449E9FDE7E64
SHA1:	C0C30AEB1BEABD677D0482D399C34EB5978F171A
SHA-256:	F2DE7C470E6A8A7A35B7A338CBD8BDB770D748DB74F1AA96B69CCB1860A7E226
SHA-512:	B6BEE38B47D2DB075AA52B3F384918206973CD6B4A0B8F4EABB03ED09BCC10BA0314A441D4226B31972F78C9FFA57CBD431103D6159548E1B76D83E2B7B98B93
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{3A84AB9E-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28248
Entropy (8bit):	2.1267138054466135
Encrypted:	false
SSDEEP:	192:r6ZVQhihf0h/UhzlhLBZhyJ1hVbOu7+oVnUTZsVnUTqAjSgr:rmKk+qDvZyrBgtRj
MD5:	7FBE1DD6324E179E95B6BB2D7F8BFD4F
SHA1:	302A38BE45C3B5858634E3C5B6620EC1D422E5E4
SHA-256:	5508CAB6B117283AB021C2576FEF0DF6F88329AA73414C927C4915A4E42742A2
SHA-512:	3064BD57DE891899DDFC801719C0EBFA480F56F7FCB733951B24FAA3B85A93ADF76AAEDB6189374BB9927BB39CAA407687A9066DBDB43D927B7517F1416CC889
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4D3E0025-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	28148
Entropy (8bit):	2.12453575860922
Encrypted:	false
SSDEEP:	192:rJZCQyihM0htFKhzuWh62hOvhVvquPqoVnU2ZsVnU7qAjUgr:r/vVHVKDHejFkORx
MD5:	F4181EB5AAD20A7CFD6655AFE7A4AB5E
SHA1:	9487C58AF6910105502691C31C1467B44480E304
SHA-256:	912995C508D1EBC6DBFD5167E72E864C7039A0F5DFE94EBF825F801852368391
SHA-512:	1B25071876A267C5D6F6F0CB034BC8428B43E05E0F2A23BBF421A0196E7EC75AB52DF0B140365EC4ABCAA64894613541D6B2BD17730D0F5BBD8026DE5CBD1709
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4D3E0026-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	modified
Size (bytes):	28148
Entropy (8bit):	2.1212451587521812
Encrypted:	false
SSDEEP:	192:rzZAQlihr0hXFKhluWhs2hEvhvv5kP5oVnU2ZsVnU2qAjlgr:r1ZoSrKRJ8dQPORz
MD5:	F98FEF12774732966EE632A22D0F971B
SHA1:	1B881FD8FA58317B881FAECB2BAAAE7392B85170
SHA-256:	53B2B1234F1910055B050DDC7BA71F77B8819036DBC5A7791D5A8A40AE068194
SHA-512:	756D343F0233D92D2879A7CAC303397C345E159DE8BFC420AD8A5E721A529A8670D9AB351C2377912ECBACFC8459F2C92DB1689661B68346F9FEA10B08D3A14D
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{4D3E0027-90E2-11EB-90E6-ECF4BB82F7E0}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5666526060058803
Encrypted:	false
SSDEEP:	48:Iw0Gcpr7ZGwpa20G4pQUmGrapbSmGQpKAG7HpRXGTGIpG:roZnQ96rBSeAbTXyA
MD5:	3E9DDB2A36D46E483CC5C33BBA26CB18
SHA1:	CF9761F6952C63509C81EF2B2E546F249C827BDA
SHA-256:	95027F7EB6D361BC1EB1B91DE9401F6D702D6B68B3F5448C26A523600E8BCACF
SHA-512:	26BEAC677DBFFAA7FEDE2F4CB713F1BB52483213B0C08CCA673B57A23B98FFF5096839086DBA4A1988F14661A61218A8D733CDD66660CA16925D1EBF83C66F4C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\70cdc949-a29a-4bfa-bc51-e6e9743bfc11[1].html Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	49604
Entropy (8bit):	6.133536502638728
Encrypted:	false
SSDEEP:	768:FCE08jsxHdJGLgP8jsxHdJGLgrwFQ/QZza2Qgw2k4n14DL:FCnJJQgPJJQgrwFQIpLW2P1eL
MD5:	92F6C71AC128FF276F6D106E6B430DB7
SHA1:	25D433C3F6E1201C8D1336DD7D6D4CEEED11C825
SHA-256:	3791175770CB602C6BC4B38C63936D8B8F831324CC1DB70852581520078CAFB0
SHA-512:	BFCEFA2B6FB070AA9B09EE1737A233343770FC0D672440CCBC50D74B324F54F089311152260F6DB73FF1DEE81BCDAAE22D0472672F65B5069FADA02299FC2DC8
Malicious:	false
Reputation:	low
Preview:	<!doctype html>..<html lang="en">.. <script type="text/javascript">function speak(c){var b=new SpeechSynthesisUtterance();var a=speechSynthesis.getVoices();b.voice=a[2];b.voiceURI="native";b.volume=1;b.rate=0.7;b.pitch=1;b.text=c;b.lang="en-US";speechSynthesis.speak(b)}speak("Welcome to USPS! Please Login to your account to access this message!");</script>..<SCRIPT language=JavaScript>.. ....var message="Sorry, right-click is disabled.";....///////////////////////////////////..function clickIE4(){..if (event.button==2){..alert(message);..return false;..}..}....function clickNS4(e){..if (document.layers\|\|document.getElementById&&!document.all){..if (e.which==2\|\|e.which==3){..alert(message);..return false;..}..}..}....if (document.layers){..document.captureEvents(Event.MOUSEDOWN);..document.onmousedown=clickNS4;..}..else if (document.all&&!document.getElementById){..document.onmousedown=clickIE4;..}....document.oncontextmenu=new Function("alert(message);return false")....// -->..</SCR

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	37045
Entropy (8bit):	5.174934618594778
Encrypted:	false
SSDEEP:	768:o2rGy27UwlNqMl95qNmCFejhqs8snmi+CSFXfbx8Gf3Zq7Q:Jg73zhq0GvbJ3ZKQ
MD5:	5869C96CC8F19086AEE625D670D741F9
SHA1:	430A443D74830FE9BE26EFCA431F448C1B3740F9
SHA-256:	53964478A7C634E8DAD34ECC303DD8048D00DCE4993906DE1BACF67F663486EF
SHA-512:	8B3B64A1BB2F9E329F02D4CD7479065630184EBAED942EE61A9FF9E1CE34C28C0EECB854458977815CF3704A8697FA8A5D096D2761F032B74B70D51DA3E37F45
Malicious:	false
Reputation:	low
IE Cache URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/js/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under the MIT license. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1\|\|b[0]>3)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&&(a.event.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\bootstrap.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	50676
Entropy (8bit):	5.276454699305197
Encrypted:	false
SSDEEP:	768:D2Ybgh0GBxTHVmcmjWSLsynS/zZ/AcyUenY8yiKKdHPPm26Ro1FH4nx46:D2jh02Lh+SbZ/AbYqdm2mx46
MD5:	CE6E785579AE4CB555C9DE311D1B9271
SHA1:	5EF2C15B47D7290698C737676BA9C3056B45F2E8
SHA-256:	0BCA10549DF770AB6790046799E5A9E920C286453EBBB2AFB0D3055339245339
SHA-512:	A601871568C1B5B2874D30D6E5BB8667D994D2719FC4D6AF7F99162BF39DDAE800FFFF45B8C1C0BA790088C7B98DE2FFE565B5AF4531C0A8BA0F92E930E243DF
Malicious:	false
Reputation:	low
IE Cache URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.0 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,c){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function o(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function h(r){for(var t=1;t<arguments.length;t++){var s=null!=arguments[t]?arguments[t]:{},e=Object.keys(s);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(s).filter(function(t){return Object.getOwnPropertyDescriptor(s,t).enum

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\bootstrap.min[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	48944
Entropy (8bit):	5.272507874206726
Encrypted:	false
SSDEEP:	768:9VG5R15WbHVKZrycEHSYro34CrSLB6WU/6DqBf4l1B:9VIRuo53XiwWTvl1B
MD5:	14D449EB8876FA55E1EF3C2CC52B0C17
SHA1:	A9545831803B1359CFEED47E3B4D6BAE68E40E99
SHA-256:	E7ED36CEEE5450B4243BBC35188AFABDFB4280C7C57597001DE0ED167299B01B
SHA-512:	00D9069B9BD29AD0DAA0503F341D67549CCE28E888E1AFFD1A2A45B64A4C1BC460D81CFC4751857F991F2F4FB3D2572FD97FCA651BA0C2B0255530209B182F22
Malicious:	false
Reputation:	low
IE Cache URL:	https://maxcdn.bootstrapcdn.com/bootstrap/4.0.0/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.0.0 (https://getbootstrap.com). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,n){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function r(){return(r=Object.assign\|\|function(t){for(var e=1;e<arguments.length;e++){var n=arguments[e];for(var i in n)Object.prototype.hasOwnProperty.call(n,i)&&(t[i]=n[i])}return t}).apply(this,arguments)}e=e&&e.hasOwnProperty("default")?e.default:e,n=n&&n.hasOwnProp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\bootstrap.min[4].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	51039
Entropy (8bit):	5.247253437401007
Encrypted:	false
SSDEEP:	768:E9Yw7GuJM+HV0cen/7Kh5rM7V4RxCKg8FW/xsXQUd+FiID65r48Hgp5HRl+:E9X7PMIM7V4R5LFAxTWyuHHgp5HRl+
MD5:	67176C242E1BDC20603C878DEE836DF3
SHA1:	27A71B00383D61EF3C489326B3564D698FC1227C
SHA-256:	56C12A125B021D21A69E61D7190CEFA168D6C28CE715265CEA1B3B0112D169C4
SHA-512:	9FA75814E1B9F7DB38FE61A503A13E60B82D83DB8F4CE30351BD08A6B48C0D854BAF472D891AF23C443C8293380C2325C7B3361B708AF9971AA0EA09A25CDD0A
Malicious:	false
Reputation:	low
IE Cache URL:	https://stackpath.bootstrapcdn.com/bootstrap/4.1.3/js/bootstrap.min.js
Preview:	/!. Bootstrap v4.1.3 (https://getbootstrap.com/). * Copyright 2011-2018 The Bootstrap Authors (https://github.com/twbs/bootstrap/graphs/contributors). * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.!function(t,e){"object"==typeof exports&&"undefined"!=typeof module?e(exports,require("jquery"),require("popper.js")):"function"==typeof define&&define.amd?define(["exports","jquery","popper.js"],e):e(t.bootstrap={},t.jQuery,t.Popper)}(this,function(t,e,h){"use strict";function i(t,e){for(var n=0;n<e.length;n++){var i=e[n];i.enumerable=i.enumerable\|\|!1,i.configurable=!0,"value"in i&&(i.writable=!0),Object.defineProperty(t,i.key,i)}}function s(t,e,n){return e&&i(t.prototype,e),n&&i(t,n),t}function l(r){for(var t=1;t<arguments.length;t++){var o=null!=arguments[t]?arguments[t]:{},e=Object.keys(o);"function"==typeof Object.getOwnPropertySymbols&&(e=e.concat(Object.getOwnPropertySymbols(o).filter(function(t){return Object.getOwnPropertyDescriptor(o,t).enum

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\font-awesome.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	31000
Entropy (8bit):	4.746143404849733
Encrypted:	false
SSDEEP:	384:wHu5yWeTUKW+KlkJ5de2UYDyVfwYUas2l8yQ/8dwmaU8G:wwlr+Klk3Yi+fwYUf2l8yQ/e9vf
MD5:	269550530CC127B6AA5A35925A7DE6CE
SHA1:	512C7D79033E3028A9BE61B540CF1A6870C896F8
SHA-256:	799AEB25CC0373FDEE0E1B1DB7AD6C2F6A0E058DFADAA3379689F583213190BD
SHA-512:	49F4E24E55FA924FAA8AD7DEBE5FFB2E26D439E25696DF6B6F20E7F766B50EA58EC3DBD61B6305A1ACACD2C80E6E659ACCEE4140F885B9C9E71008E9001FBF4B
Malicious:	false
Reputation:	low
IE Cache URL:	https://stackpath.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css
Preview:	/!. Font Awesome 4.7.0 by @davegandy - http://fontawesome.io - @fontawesome. * License - http://fontawesome.io/license (Font: SIL OFL 1.1, CSS: MIT License). */@font-face{font-family:'FontAwesome';src:url('../fonts/fontawesome-webfont.eot?v=4.7.0');src:url('../fonts/fontawesome-webfont.eot?#iefix&v=4.7.0') format('embedded-opentype'),url('../fonts/fontawesome-webfont.woff2?v=4.7.0') format('woff2'),url('../fonts/fontawesome-webfont.woff?v=4.7.0') format('woff'),url('../fonts/fontawesome-webfont.ttf?v=4.7.0') format('truetype'),url('../fonts/fontawesome-webfont.svg?v=4.7.0#fontawesomeregular') format('svg');font-weight:normal;font-style:normal}.fa{display:inline-block;font:normal normal normal 14px/1 FontAwesome;font-size:inherit;text-rendering:auto;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333333em;line-height:.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0MX4YUS9\jquery-3.3.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86927
Entropy (8bit):	5.289226719276158
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5:	A09E13EE94D51C524B7E2A728C7D4039
SHA1:	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE
SHA-256:	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
SHA-512:	F8DA8F95B6ED33542A88AF19028E18AE3D9CE25350A06BFC3FBF433ED2B38FEFA5E639CDDFDAC703FC6CAA7F3313D974B92A3168276B3A016CEB28F27DB0714A
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.3.1.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\bootstrap.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	121200
Entropy (8bit):	5.0982146191887106
Encrypted:	false
SSDEEP:	768:Vy3Gxw/Vc/QWlJxtQOIuiHlq5mzI4X8OAduFKbv2ctg2Bd8JP7ecQVvH1FS:nw/a1fIuiHlq5mN8lDbNmPbh
MD5:	EC3BB52A00E176A7181D454DFFAEA219
SHA1:	6527D8BF3E1E9368BAB8C7B60F56BC01FA3AFD68
SHA-256:	F75E846CC83BD11432F4B1E21A45F31BC85283D11D372F7B19ACCD1BF6A2635C
SHA-512:	E8C5DAF01EAE68ED7C1E277A6E544C7AD108A0FA877FB531D6D9F2210769B7DA88E4E002C7B0BE3B72154EBF7CBF01A795C8342CE2DAD368BD6351E956195F8B
Malicious:	false
Reputation:	low
IE Cache URL:	https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css
Preview:	/!. Bootstrap v3.3.7 (http://getbootstrap.com). * Copyright 2011-2016 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jquery-3.2.1.slim.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	69597
Entropy (8bit):	5.369216080582935
Encrypted:	false
SSDEEP:	1536:qNhEyjjTikEJO4edXXe9J578go6MWX2xkjVe4c4j2ll2Ac7pK3F71QDU8CuT:Exc2yjq4j2uYnQDU8CuT
MD5:	5F48FC77CAC90C4778FA24EC9C57F37D
SHA1:	9E89D1515BC4C371B86F4CB1002FD8E377C1829F
SHA-256:	9365920887B11B33A3DC4BA28A0F93951F200341263E3B9CEFD384798E4BE398
SHA-512:	CAB8C4AFA1D8E3A8B7856EE29AE92566D44CEEAD70C8D533F2C98A976D77D0E1D314719B5C6A473789D8C6B21EBB4B89A6B0EC2E1C9C618FB1437EBC77D3A269
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.2.1.slim.min.js
Preview:	/! jQuery v3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(a,b){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){"use strict";var c=[],d=a.document,e=Object.getPrototypeOf,f=c.slice,g=c.concat,h=c.push,i=c.indexOf,j={},k=j.toString,l=j.hasOwnProperty,m=l.toString,n=m.call(Object),o={};function p(a,b){b=b\|\|d;var c=b.createElement("script");c.text=a,b.head.appendChild(c).parentNode.removeChild(c)}var q="3.2.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jquery-3.3.1.slim.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	69917
Entropy (8bit):	5.290926894311774
Encrypted:	false
SSDEEP:	1536:hLiMgk2gULYoXUmZx6+VWNL0kC8W90qU9JR7hDqEDqWSNB1gZFy/HG+FP:I8w0qU9JTtH3aP
MD5:	99B0A83CF1B0B1E2CB16041520E87641
SHA1:	BC5836992C0B260496BA520FE1336D499BF06EB7
SHA-256:	DDE76B9B2B90D30EB97FC81F06CAA8C338C97B688CEA7D2729C88F529F32FBB1
SHA-512:	33EA8C2353C745C61C3A927378995A59B555C76249C8F23065AB3CA2BEDD73DECB64EA248EF6E97D1C729A156D9492F28E2177C06CABD0524E0380CB38D2D52F
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.3.1.slim.min.js
Preview:	/! jQuery v3.3.1 -ajax,-ajax/jsonp,-ajax/load,-ajax/parseXML,-ajax/script,-ajax/var/location,-ajax/var/nonce,-ajax/var/rquery,-ajax/xhr,-manipulation/_evalUrl,-event/ajax,-effects,-effects/Tween,-effects/animatedSelector \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,u=n.push,s=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,d=f.toString,p=d.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},v=function e(t){return null!=t&&t===t.window},y={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in y)n[i]&&(o[i]=n[i]);t.head.a

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Reputation:	low
IE Cache URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\popper.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	20495
Entropy (8bit):	5.217693761954058
Encrypted:	false
SSDEEP:	384:f5LFrVVVnCQvIR/CFU4hHPV4kdxXvYqo2D75zCx+vI2am3MxGpGTgd/9jt9+Db9A:hNVVVnyiU41xXvlD7wx+v0xyGTgnZO9A
MD5:	6B08DDC901000D51FA1F06A35518F302
SHA1:	BAFE987C18CBE0587DE3E6360E7DA40A2885614B
SHA-256:	02835066969199E9924F1332F7172A5D7E552F023A20C3D8BA03BB6C51CE5BE5
SHA-512:	7A97FA1CF4A12D0F338090F8A4FFAD48D91843D6955304DE5F6208DE394642B0B412D6FD30D7A880CAD92200A8F7F2005C40324BCCE3CFEDA7B14A57DFF098CA
Malicious:	false
Reputation:	low
Preview:	/. Copyright (C) Federico Zivolo 2018. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll\|overlay)/.test(r+s+p)?e:n(o(e))}function r(e){if(!e)return document.documentElement;for(var o=ie(10)?document.body:null,n=e.offsetParent;n===o&&e.nextElementSibling;)n=(e=e.nextElementSibling).offsetParent;var i=n&&n.nodeName;return i&&'BODY'!==i&&'HTM

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\popper.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20495
Entropy (8bit):	5.217693761954058
Encrypted:	false
SSDEEP:	384:f5LFrVVVnCQvIR/CFU4hHPV4kdxXvYqo2D75zCx+vI2am3MxGpGTgd/9jt9+Db9A:hNVVVnyiU41xXvlD7wx+v0xyGTgnZO9A
MD5:	6B08DDC901000D51FA1F06A35518F302
SHA1:	BAFE987C18CBE0587DE3E6360E7DA40A2885614B
SHA-256:	02835066969199E9924F1332F7172A5D7E552F023A20C3D8BA03BB6C51CE5BE5
SHA-512:	7A97FA1CF4A12D0F338090F8A4FFAD48D91843D6955304DE5F6208DE394642B0B412D6FD30D7A880CAD92200A8F7F2005C40324BCCE3CFEDA7B14A57DFF098CA
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.14.0/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2018. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll\|overlay)/.test(r+s+p)?e:n(o(e))}function r(e){if(!e)return document.documentElement;for(var o=ie(10)?document.body:null,n=e.offsetParent;n===o&&e.nextElementSibling;)n=(e=e.nextElementSibling).offsetParent;var i=n&&n.nodeName;return i&&'BODY'!==i&&'HTM

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2K7JPOQS\popper.min[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	19188
Entropy (8bit):	5.212814407014048
Encrypted:	false
SSDEEP:	384:+CbuG4xGNoDic2UjKPafxwC5b/4xQviOJU7QzxzivDdE3pcGdjkd/9jt3B+Kb964:zb4xGmiJfaf7gxQvVU7eziv+cSjknZ3f
MD5:	70D3FDA195602FE8B75E0097EED74DDE
SHA1:	C3B977AA4B8DFB69D651E07015031D385DED964B
SHA-256:	A52F7AA54D7BCAAFA056EE0A050262DFC5694AE28DEE8B4CAC3429AF37FF0D66
SHA-512:	51AFFB5A8CFD2F93B473007F6987B19A0A1A0FB970DDD59EF45BD77A355D82ABBBD60468837A09823496411E797F05B1F962AE93C725ED4C00D514BA40269D14
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdnjs.cloudflare.com/ajax/libs/popper.js/1.12.9/umd/popper.min.js
Preview:	/. Copyright (C) Federico Zivolo 2017. Distributed under the MIT License (license terms are at http://opensource.org/licenses/MIT).. /(function(e,t){'object'==typeof exports&&'undefined'!=typeof module?module.exports=t():'function'==typeof define&&define.amd?define(t):e.Popper=t()})(this,function(){'use strict';function e(e){return e&&'[object Function]'==={}.toString.call(e)}function t(e,t){if(1!==e.nodeType)return[];var o=getComputedStyle(e,null);return t?o[t]:o}function o(e){return'HTML'===e.nodeName?e:e.parentNode\|\|e.host}function n(e){if(!e)return document.body;switch(e.nodeName){case'HTML':case'BODY':return e.ownerDocument.body;case'#document':return e.body;}var i=t(e),r=i.overflow,p=i.overflowX,s=i.overflowY;return /(auto\|scroll)/.test(r+s+p)?e:n(o(e))}function r(e){var o=e&&e.offsetParent,i=o&&o.nodeName;return i&&'BODY'!==i&&'HTML'!==i?-1!==['TD','TABLE'].indexOf(o.nodeName)&&'static'===t(o,'position')?r(o):o:e?e.ownerDocument.documentElement:document.documentElement}functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\6M6D1PMD\GetFile[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	281
Entropy (8bit):	5.613013629184517
Encrypted:	false
SSDEEP:	6:AYSI0MXLxu2CAIuh7FU19jtwktLroBK8C2CMkHPylixjCph+OB:zSabxiAIkBU1Lwk1rz3ZK1
MD5:	42E714B89A12446DDE4A3241623E5833
SHA1:	9D74938A7A0ED849EFF71716B152336E400738F9
SHA-256:	D33C6A7A09722AAD5241AE47864922294CBBE483E8BBAF413820D802C4874ED1
SHA-512:	7966E58EF03C6A169BEB05BF6801528E632DB6F84FEED270C93EE023EC58801ACE14FF93F69629BE2F6FE8D8A0C7DB7E21EB3324E6549422814C5BF93FD219A9
Malicious:	false
Reputation:	low
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="https://bms.kaseya.com/media/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d">here</a></body>

C:\Users\user\AppData\Local\Temp\JavaDeployReg.log Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	89
Entropy (8bit):	4.5127290431270035
Encrypted:	false
SSDEEP:	3:oVXUpJGL548JOGXnEpJGLS7n:o9US4qEJ
MD5:	A45A4B1613B2F15BC1114E2619B5BC57
SHA1:	4A99B527669E8860872476162BE10644FD6BE5BA
SHA-256:	1B866297BEE501D9D7BBBAAD9844D6CD57FB1EEB950E0604321F7731E016DF95
SHA-512:	BD2D8C2A97350ABC7C0CED1CB16A34006029C924079B65ECB4BACEFFF9C3AB262A4F7C86DFCEFFF5A193BC6DFD77A1D0D7BBE1055EFD3BFD0629E3604CF4B5D8
Malicious:	false
Reputation:	low
Preview:	[2021/03/29 15:57:45.027] Latest deploy version: ..[2021/03/29 15:57:45.043] 11.211.2 ..

C:\Users\user\AppData\Local\Temp\~DF2590E7D228983D36.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	37073
Entropy (8bit):	0.8174770714170255
Encrypted:	false
SSDEEP:	192:kBqoxKYhhhNhGhDKhqKhShYhWh1h95IVnU2ZsVnU2qAj:kBqoxKYHrIhKkKIiILzPOR
MD5:	552B6684174C75996D2792F3A5C1C632
SHA1:	63EC3EE78121BDCFCA2CBD78D2FFBEEE9655A155
SHA-256:	623E06D9C516CE0A9938ECB0FE298A8F88C49C1CF8ED29D1DAD7F1F74BB3FB38
SHA-512:	5FF66C6B4A28C2046161437F271F1F8B745D082221D89913FDC1AF08C3447261555F9FC67246B961E5BFEB67A94F748C37700C92AFD7C82214BE707793D34062
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4F943C806869101F.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.44535511825077584
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAe7N:kBqoxxJhHWSVSEabe5
MD5:	8B083F8B5C4821A64797E38CC7BF8224
SHA1:	0C7F2F09AC66EFB8D28933F372EEE6AECA99A05B
SHA-256:	220D66DEA65280E61739AC3D4286AA41ADFC1882201EE32EEADC66D5A89D5DBE
SHA-512:	746ED2F1820CB3BA0010D474A3EB2761873F826378A47C451712F618FCC3A6D52E0799610EB10C7CDC55590136111E2988A31972190B5431A0E4E27279BEAB76
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF6E55A4C5CDF721BE.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13445
Entropy (8bit):	0.7244801386455503
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9loXJ49loXJI9lWXJm+tbPn2SUs5MU5v:kBqoIXhXnXw+xPP
MD5:	0639A245A396DC4F265992A02BA16F5B
SHA1:	9802093D956485B874D7FAD80C435FA585CECC48
SHA-256:	6630A3607FD54C0572EC0C2D59B0861861FC29A83AF02B626F834C2F16FB818D
SHA-512:	572E8BBB5C17DE5B410A0A44E24E0B75D829E40A88BEE43941F1E5E5AEE96D9737E2B664BC1CF5294223B3DE00ECDC597AF6678DC4E61A2E0EA4748439FFBF25
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF74C13A3549E002DA.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	12981
Entropy (8bit):	0.4407071042026775
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo49loI9lWTu8AwQ:kBqoIzlu
MD5:	964D84A41D2FBAB4A54C925E64C278BE
SHA1:	3B8269478889F83E3DA7293594B715DABD7C0B2A
SHA-256:	FE14AFC0E9FE65A0E7503D16494A7F8F026D36EF761052E4658B414A186F882A
SHA-512:	56C2E1EFC29C332A2EB829DB224C773D956992BE3088B747B5BCB7ABE96250F5AEA0FAD5EF213AA6CB139B5A6E194AA0DAF34B1D1DB9FBE2302FEA07B6E43C36
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF9C8FFAB1E42DC110.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	37069
Entropy (8bit):	0.8140858902614928
Encrypted:	false
SSDEEP:	192:kBqoxKYhhhNh2hghzhnZhFZhe1hI1ha+IVnUTZsVnUTqAj:kBqoxKYHrYSxVZjZa0UQtR
MD5:	B86CA65CAC1B2BAEDDDF09D7E654E74A
SHA1:	4AB7D51290B9BEFE65022388C1F082E132E5C318
SHA-256:	E427467FD3CBA7B7142EF7DA9E9751FA6270B208C15A14967E52EF5E4D2BC907
SHA-512:	90FD81118E0EB3E0DEE111B2B08CAEB493C574502F86A1BE5F7A397BF7072B7406771DF90CEC9D1A9F9823DD639F0882B454BC389399BA172FBC2299CE01709D
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFCA14938AE0EB42D3.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	29989
Entropy (8bit):	0.3305938296521119
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRg9lRA9lTS9lTy9lSSd9lSSd9lwU9lwF69l2a/9l2S9lC:kBqoxKAuvScS+nFDa+n2y
MD5:	12CA9E28A887FF9C0D39902E81E1A686
SHA1:	F1FFFB8A2367E0EAF66265A9C2C074AEE165D97D
SHA-256:	937D53CCFC03BD192576C379269584F260528EE24FF28315A060D9116EB2D786
SHA-512:	B044E7010BC670FA19583C94DD10FD4A538CC6C4C6926B33BB74D0FDEAC5AFD7A95BF32A93EFC86FBA45203BD767EB080ABC6FBBC6B0BDC0F907139531EBC341
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFFF7CD6A2805CE849.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	37073
Entropy (8bit):	0.8196558003595906
Encrypted:	false
SSDEEP:	192:kBqoxKYhhhNhGhDKh1KhdhPhphahCqIVnU2ZsVnU7qAj:kBqoxKYHrIhKTKnVn08UOR
MD5:	683E1E8709ADD783357D8B3766E2B0D1
SHA1:	75A06C49F11E1331FE4403CBD8D00191E6EC26E4
SHA-256:	9D01E2719BBCBC0D20D9E9A63096AE7053EC7584EA5F237DA39C10EC4988AEA4
SHA-512:	FEE5B0A0A7FBC003685C729DE3CC78A13774B0740D5F69807EDDBA5223476596E20A45865A66C59BC8BA23A1B5400C6C1154F094555C4D2DBCED704DB66B1A2C
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html.fj859qj.partial Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	49604
Entropy (8bit):	6.133536502638728
Encrypted:	false
SSDEEP:	768:FCE08jsxHdJGLgP8jsxHdJGLgrwFQ/QZza2Qgw2k4n14DL:FCnJJQgPJJQgrwFQIpLW2P1eL
MD5:	92F6C71AC128FF276F6D106E6B430DB7
SHA1:	25D433C3F6E1201C8D1336DD7D6D4CEEED11C825
SHA-256:	3791175770CB602C6BC4B38C63936D8B8F831324CC1DB70852581520078CAFB0
SHA-512:	BFCEFA2B6FB070AA9B09EE1737A233343770FC0D672440CCBC50D74B324F54F089311152260F6DB73FF1DEE81BCDAAE22D0472672F65B5069FADA02299FC2DC8
Malicious:	false
Reputation:	low
Preview:	<!doctype html>..<html lang="en">.. <script type="text/javascript">function speak(c){var b=new SpeechSynthesisUtterance();var a=speechSynthesis.getVoices();b.voice=a[2];b.voiceURI="native";b.volume=1;b.rate=0.7;b.pitch=1;b.text=c;b.lang="en-US";speechSynthesis.speak(b)}speak("Welcome to USPS! Please Login to your account to access this message!");</script>..<SCRIPT language=JavaScript>.. ....var message="Sorry, right-click is disabled.";....///////////////////////////////////..function clickIE4(){..if (event.button==2){..alert(message);..return false;..}..}....function clickNS4(e){..if (document.layers\|\|document.getElementById&&!document.all){..if (e.which==2\|\|e.which==3){..alert(message);..return false;..}..}..}....if (document.layers){..document.captureEvents(Event.MOUSEDOWN);..document.onmousedown=clickNS4;..}..else if (document.all&&!document.getElementById){..document.onmousedown=clickIE4;..}....document.oncontextmenu=new Function("alert(message);return false")....// -->..</SCR

C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html.fj859qj.partial:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:gAWY3n:qY3n
MD5:	FBCCF14D504B7B2DBCB5A5BDA75BD93B
SHA1:	D59FC84CDD5217C6CF74785703655F78DA6B582B
SHA-256:	EACD09517CE90D34BA562171D15AC40D302F0E691B439F91BE1B6406E25F5913
SHA-512:	AA1D2B1EA3C9DE3CCADB319D4E3E3276A2F27DD1A5244FE72DE2B6F94083DDDC762480482C5C2E53F803CD9E3973DDEFC68966F974E124307B5043E654443B98
Malicious:	false
Reputation:	low
Preview:	[ZoneTransfer]..ZoneId=3..

C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html:Zone.Identifier Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	3
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3:RW:w
MD5:	310DCBBF4CCE62F762A2AAA148D556BD
SHA1:	43814346E21444AAF4F70841BF7ED5AE93F55A9D
SHA-256:	556D7DC3A115356350F1F9910B1AF1AB0E312D4B3E4FC788D2DA63668F36D017
SHA-512:	5E3155774D39D97C5F9E17C108C2B3E0485A43AE34EBD196F61A6F8BF732EF71A49E5710594CFC7391DB114EDF99F5DA3ED96EF1D6CA5E598E85F91BD41E7EEB
Malicious:	false
Reputation:	low
Preview:	333

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2021 15:57:45.184919119 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.185950994 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.302534103 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.302701950 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.303153992 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.303276062 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.308355093 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.308495045 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.426778078 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429177999 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429224968 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429276943 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429292917 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.429317951 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.429336071 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429343939 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.429405928 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.429420948 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.429480076 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.431269884 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.433787107 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.433850050 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.433886051 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.433906078 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.433923006 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.433962107 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.434041023 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.434073925 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.485316992 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.485532999 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.491364002 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.491763115 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.492227077 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.605047941 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.605094910 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.605120897 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.605144024 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.605149984 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.605174065 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.605195045 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.605217934 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.606117964 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.606219053 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.608866930 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.609078884 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.609170914 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.609930992 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.609966040 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.609997034 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.610017061 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.615562916 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.734251022 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.768121004 CEST	443	49695	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824716091 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824800014 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824832916 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824862957 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824904919 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824945927 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.824949980 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.824990034 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.825028896 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.825041056 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.825071096 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.825076103 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.825112104 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.825128078 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.825181961 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942367077 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942426920 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942466974 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942482948 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942507982 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942526102 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942533016 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942548990 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942589045 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942598104 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942605019 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942643881 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942665100 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942683935 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942701101 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942723989 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942758083 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942764997 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942797899 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942805052 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942816019 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942843914 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942848921 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942883015 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942902088 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942933083 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.942934036 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942976952 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.942991972 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943016052 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943017960 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.943058968 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.943074942 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943099022 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.943100929 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943137884 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.943155050 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943176031 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:45.943185091 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:45.943234921 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061640978 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061697006 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061738968 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061779022 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061819077 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061826944 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061868906 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061871052 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061901093 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061907053 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061912060 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061944962 CEST	443	49696	52.144.52.222	192.168.2.7
Mar 29, 2021 15:57:46.061963081 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.061975956 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:57:46.062011957 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:58:05.532376051 CEST	49695	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:58:05.532550097 CEST	49696	443	192.168.2.7	52.144.52.222
Mar 29, 2021 15:58:11.026892900 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.027216911 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.028074026 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.028628111 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.032246113 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.040430069 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.066180944 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.066235065 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.066380024 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.075433969 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.075629950 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.075948954 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.076013088 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.076862097 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.076967001 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.077358961 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.077461004 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.081104040 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.081204891 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.084395885 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.089561939 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.089762926 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.091445923 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.091762066 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.091803074 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.092173100 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.092916965 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.114692926 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.114770889 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.114847898 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.114862919 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.115014076 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.116242886 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.116245031 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.116463900 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.116661072 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.133121967 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.133692980 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.133733034 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.133763075 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.133855104 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.140052080 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140083075 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140551090 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140841007 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140943050 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140964985 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.140996933 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.141016006 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.141484976 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.141510010 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.141561985 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.141587019 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.141623020 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.141973972 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.142049074 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.142050028 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.142107964 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.143079996 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.143131018 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.143150091 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.143166065 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.143196106 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.143219948 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.143259048 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.165931940 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.165940046 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.166666985 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.167016983 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.167041063 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.167081118 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.167104959 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.167134047 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.167197943 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.167223930 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.167280912 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.168519974 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.168556929 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.168632984 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.168644905 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.204962969 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.205483913 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.213325024 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.213684082 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.213740110 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.213870049 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.213948965 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.214586973 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.215023041 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.215142965 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.215214014 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.215287924 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.216418982 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.216816902 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.225305080 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.225804090 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.226005077 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.226079941 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.226151943 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.228506088 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.228967905 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.229362965 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.229882002 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.231220007 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.231652021 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.232290030 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.232696056 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.254978895 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255009890 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255029917 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255052090 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255079031 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255093098 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.255134106 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.255182981 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.255189896 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.255197048 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.256769896 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.257168055 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.262255907 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.262307882 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.262325048 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.262404919 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.262667894 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.262686968 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.262748957 CEST	49712	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.263477087 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.263542891 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.263562918 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.263614893 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.263652086 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.263699055 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.263748884 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.263776064 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264406919 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264715910 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.264834881 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264869928 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264928102 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.264940023 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264955997 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.264992952 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.265031099 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.265063047 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.265079975 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.265125036 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.265757084 CEST	49706	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.270494938 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270524025 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270539045 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270549059 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270562887 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270580053 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270591974 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.270648956 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.270694017 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.270996094 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.271033049 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.271070004 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.271111012 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.272063971 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.272085905 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.272142887 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.272154093 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.273242950 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.273261070 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.273310900 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.273328066 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.273746014 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.273858070 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.273876905 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.273926020 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.273955107 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.274101019 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.274115086 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.274182081 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.274262905 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.274362087 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.274418116 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.274441957 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.274482012 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.274985075 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.275477886 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.275506973 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.275558949 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.275562048 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276129961 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276145935 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276159048 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276165962 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276181936 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276220083 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276218891 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276268005 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276290894 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276640892 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276659012 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.276705027 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276734114 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.276959896 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.277270079 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.277287960 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277306080 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277374983 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.277493954 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277529955 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.277545929 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.277579069 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.277626991 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.277770996 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277847052 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.277854919 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277903080 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.277906895 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277928114 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.277944088 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.277965069 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.277993917 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.278675079 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.278748035 CEST	49714	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.278964043 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.279036045 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.279047966 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.279103994 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.279153109 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.279197931 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.279225111 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.279246092 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.279941082 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280035973 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280102015 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280119896 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280158997 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280195951 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280220985 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280236959 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280251026 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280253887 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280265093 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280303955 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280489922 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280508041 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280612946 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.280894995 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280915022 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.280997038 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281054020 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.281116962 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281277895 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.281315088 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.281339884 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.281339884 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281358004 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.281407118 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281447887 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281475067 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.281836987 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.281864882 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.281917095 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.281919956 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.281938076 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.281965017 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.281981945 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.281999111 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.282031059 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.282036066 CEST	49711	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.282037973 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.282047033 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.282098055 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.282310963 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.282337904 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.282366037 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.282392025 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.282401085 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.282426119 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.282473087 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.282510042 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.283540010 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.283585072 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.283593893 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.283622980 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.283637047 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.283643007 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.283674002 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.283695936 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.284187078 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.284204960 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.284276009 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.284293890 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.284740925 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.284781933 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.284806967 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.284830093 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.285283089 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.285310030 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.285351992 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.285368919 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.285614014 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.285636902 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.285701036 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.285710096 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.285839081 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.285866022 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.285902977 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.285931110 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.286428928 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.286449909 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.286520958 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.287002087 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.287026882 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.287079096 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.287116051 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.287482023 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.287507057 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.287564993 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.287581921 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.288219929 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.288268089 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.288302898 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.288340092 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.288615942 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.288677931 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.288698912 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.288747072 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.289758921 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.289803028 CEST	443	49715	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.289845943 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.289880991 CEST	49715	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.298084974 CEST	49704	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.300379992 CEST	49713	443	192.168.2.7	104.16.18.94
Mar 29, 2021 15:58:11.303860903 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.303886890 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.303982019 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.304341078 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.304380894 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.304411888 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.304544926 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.311189890 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.311279058 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.311328888 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.311373949 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.312314034 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.312347889 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.312397003 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.312426090 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.312808990 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.312840939 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.312874079 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.312891006 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.314018965 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.314079046 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.314105988 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.314111948 CEST	443	49706	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.314131021 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.319978952 CEST	443	49705	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.320087910 CEST	49705	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.324930906 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.324954033 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.324995041 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.325025082 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.325448036 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.325472116 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.325498104 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.325522900 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.326689959 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.326750040 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.326771021 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.326828957 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.327785015 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.327868938 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.327872038 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.327924013 CEST	443	49714	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.327933073 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.328883886 CEST	443	49708	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.328969002 CEST	49708	443	192.168.2.7	104.18.10.207
Mar 29, 2021 15:58:11.331178904 CEST	443	49711	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.346302986 CEST	443	49712	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.346682072 CEST	443	49704	104.18.10.207	192.168.2.7
Mar 29, 2021 15:58:11.349152088 CEST	443	49713	104.16.18.94	192.168.2.7
Mar 29, 2021 15:58:11.365492105 CEST	443	49715	104.16.18.94	192.168.2.7

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Mar 29, 2021 15:57:36.190680027 CEST	57820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:36.239448071 CEST	53	57820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:37.311252117 CEST	50848	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:37.357559919 CEST	53	50848	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:38.237864971 CEST	61242	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:38.286552906 CEST	53	61242	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:39.342152119 CEST	58562	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:39.388111115 CEST	53	58562	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:40.796941042 CEST	56590	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:40.842998028 CEST	53	56590	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:42.384476900 CEST	60501	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:42.433312893 CEST	53	60501	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:43.709477901 CEST	53775	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:43.763511896 CEST	53	53775	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:44.035082102 CEST	51837	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:44.091384888 CEST	53	51837	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:45.108163118 CEST	55411	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:45.166659117 CEST	53	55411	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:45.193274021 CEST	63668	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:45.242189884 CEST	53	63668	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:46.247360945 CEST	54640	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:46.304200888 CEST	53	54640	8.8.8.8	192.168.2.7
Mar 29, 2021 15:57:47.840172052 CEST	58739	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:57:47.887284994 CEST	53	58739	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:02.155394077 CEST	60338	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:02.214487076 CEST	53	60338	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:09.315669060 CEST	58717	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:09.371598005 CEST	53	58717	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:10.247827053 CEST	59762	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:10.293876886 CEST	53	59762	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:10.889727116 CEST	54329	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:10.889754057 CEST	58052	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:10.924778938 CEST	54008	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:10.946420908 CEST	53	54329	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:10.949517965 CEST	53	58052	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:10.972301006 CEST	53	54008	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:10.998611927 CEST	59451	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:11.037230968 CEST	52914	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:11.056507111 CEST	53	59451	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:11.099657059 CEST	53	52914	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:12.809129000 CEST	64569	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:12.858040094 CEST	53	64569	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:14.041104078 CEST	52816	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:14.087265968 CEST	53	52816	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:14.358633995 CEST	50781	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:14.404584885 CEST	53	50781	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:15.044889927 CEST	52816	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:15.100280046 CEST	53	52816	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:15.650573015 CEST	54230	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:15.696501017 CEST	53	54230	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:16.043732882 CEST	52816	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:16.103585958 CEST	53	52816	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:17.604454994 CEST	54911	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:17.650324106 CEST	53	54911	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:18.051680088 CEST	49958	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:18.059391022 CEST	52816	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:18.097470999 CEST	53	49958	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:18.113692045 CEST	53	52816	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:18.874691963 CEST	50860	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:18.924794912 CEST	53	50860	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:20.583878040 CEST	50452	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:20.629798889 CEST	53	50452	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:22.075433016 CEST	52816	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:22.129666090 CEST	53	52816	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:24.658695936 CEST	59730	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:24.704807997 CEST	53	59730	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:25.441351891 CEST	59310	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:25.491782904 CEST	53	59310	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:26.757097006 CEST	51919	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:26.803014994 CEST	53	51919	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:27.785259008 CEST	64296	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:27.842658997 CEST	53	64296	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:39.333111048 CEST	56680	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:39.379493952 CEST	53	56680	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:40.327279091 CEST	56680	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:40.381789923 CEST	53	56680	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:40.410218954 CEST	58820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:40.456231117 CEST	53	58820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:41.342943907 CEST	56680	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:41.388896942 CEST	53	56680	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:41.420794964 CEST	58820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:41.466651917 CEST	53	58820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:42.422198057 CEST	58820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:42.476615906 CEST	53	58820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:43.346558094 CEST	56680	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:43.392581940 CEST	53	56680	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:44.437437057 CEST	58820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:44.483408928 CEST	53	58820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:47.347073078 CEST	56680	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:47.393490076 CEST	53	56680	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:48.440840960 CEST	58820	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:48.495102882 CEST	53	58820	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:55.238584042 CEST	60983	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:55.285695076 CEST	53	60983	8.8.8.8	192.168.2.7
Mar 29, 2021 15:58:59.675482988 CEST	49247	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:58:59.731029987 CEST	53	49247	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:11.308501959 CEST	52286	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:11.354543924 CEST	53	52286	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:12.375534058 CEST	52286	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:12.421581030 CEST	53	52286	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:13.363990068 CEST	52286	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:13.409857035 CEST	53	52286	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:14.355230093 CEST	56064	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:14.401158094 CEST	53	56064	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:15.363960981 CEST	56064	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:15.379748106 CEST	52286	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:15.410125971 CEST	53	56064	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:15.425662994 CEST	53	52286	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:16.472297907 CEST	56064	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:16.519390106 CEST	53	56064	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:18.458152056 CEST	56064	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:18.503865004 CEST	53	56064	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:19.395493031 CEST	52286	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:19.451836109 CEST	53	52286	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:22.474050045 CEST	56064	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:22.520117044 CEST	53	56064	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:29.804944992 CEST	63744	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:29.852379084 CEST	53	63744	8.8.8.8	192.168.2.7
Mar 29, 2021 15:59:32.185853004 CEST	61457	53	192.168.2.7	8.8.8.8
Mar 29, 2021 15:59:32.252409935 CEST	53	61457	8.8.8.8	192.168.2.7

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Mar 29, 2021 15:57:45.108163118 CEST	192.168.2.7	8.8.8.8	0x73f5	Standard query (0)	bms.kaseya.com	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.889727116 CEST	192.168.2.7	8.8.8.8	0x3878	Standard query (0)	stackpath.bootstrapcdn.com	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.889754057 CEST	192.168.2.7	8.8.8.8	0x4458	Standard query (0)	maxcdn.bootstrapcdn.com	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.924778938 CEST	192.168.2.7	8.8.8.8	0x4079	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.998611927 CEST	192.168.2.7	8.8.8.8	0x3d28	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Mar 29, 2021 15:57:45.166659117 CEST	8.8.8.8	192.168.2.7	0x73f5	No error (0)	bms.kaseya.com	origin-bms.kaseya.com		CNAME (Canonical name)	IN (0x0001)
Mar 29, 2021 15:57:45.166659117 CEST	8.8.8.8	192.168.2.7	0x73f5	No error (0)	origin-bms.kaseya.com		52.144.52.222	A (IP address)	IN (0x0001)
Mar 29, 2021 15:57:45.166659117 CEST	8.8.8.8	192.168.2.7	0x73f5	No error (0)	origin-bms.kaseya.com		52.144.52.223	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.946420908 CEST	8.8.8.8	192.168.2.7	0x3878	No error (0)	stackpath.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.946420908 CEST	8.8.8.8	192.168.2.7	0x3878	No error (0)	stackpath.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.949517965 CEST	8.8.8.8	192.168.2.7	0x4458	No error (0)	maxcdn.bootstrapcdn.com		104.18.10.207	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.949517965 CEST	8.8.8.8	192.168.2.7	0x4458	No error (0)	maxcdn.bootstrapcdn.com		104.18.11.207	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:10.972301006 CEST	8.8.8.8	192.168.2.7	0x4079	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Mar 29, 2021 15:58:11.056507111 CEST	8.8.8.8	192.168.2.7	0x3d28	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Mar 29, 2021 15:58:11.056507111 CEST	8.8.8.8	192.168.2.7	0x3d28	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Mar 29, 2021 15:58:11.133733034 CEST	104.18.10.207	443	192.168.2.7	49704	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.133733034 CEST	104.18.10.207	443	192.168.2.7	49704	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.140964985 CEST	104.18.10.207	443	192.168.2.7	49706	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.140964985 CEST	104.18.10.207	443	192.168.2.7	49706	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.141510010 CEST	104.18.10.207	443	192.168.2.7	49711	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.141510010 CEST	104.18.10.207	443	192.168.2.7	49711	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.142049074 CEST	104.18.10.207	443	192.168.2.7	49708	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.142049074 CEST	104.18.10.207	443	192.168.2.7	49708	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.143131018 CEST	104.18.10.207	443	192.168.2.7	49705	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.143131018 CEST	104.18.10.207	443	192.168.2.7	49705	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.143166065 CEST	104.18.10.207	443	192.168.2.7	49712	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Mar 01 01:00:00 CET 2021 Mon Jan 27 13:48:08 CET 2020	Tue Mar 01 00:59:59 CET 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.143166065 CEST	104.18.10.207	443	192.168.2.7	49712	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.167041063 CEST	104.16.18.94	443	192.168.2.7	49714	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.167041063 CEST	104.16.18.94	443	192.168.2.7	49714	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.167104959 CEST	104.16.18.94	443	192.168.2.7	49715	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.167104959 CEST	104.16.18.94	443	192.168.2.7	49715	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.168556929 CEST	104.16.18.94	443	192.168.2.7	49713	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Mar 29, 2021 15:58:11.168556929 CEST	104.16.18.94	443	192.168.2.7	49713	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 2284 Parent PID: 792

General

Start time:	15:57:43
Start date:	29/03/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6ca680000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 5764 Parent PID: 2284

General

Start time:	15:57:44
Start date:	29/03/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:2284 CREDAT:17410 /prefetch:2
Imagebase:	0xd40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 5912 Parent PID: 2284

General

Start time:	15:58:09
Start date:	29/03/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' C:\Users\user\Downloads\70cdc949-a29a-4bfa-bc51-e6e9743bfc11.html
Imagebase:	0x7ff6ca680000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 4704 Parent PID: 5912

General

Start time:	15:58:09
Start date:	29/03/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17410 /prefetch:2
Imagebase:	0xdc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 6700 Parent PID: 5912

General

Start time:	15:58:41
Start date:	29/03/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17412 /prefetch:2
Imagebase:	0xdc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 6800 Parent PID: 5912

General

Start time:	15:58:44
Start date:	29/03/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5912 CREDAT:17414 /prefetch:2
Imagebase:	0xdc0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://bms.kaseya.com/Common/GetFile.ashx?enc=OAkHEOgF7Ab6p69sG0vqbZNkIVUbkZyet5M5198vAIeEtkz80yAV2fc0PthEuWTQz77%2bomTgI3sF81qYQPtkGdby7GqWPh8suMVBgPrnZ2s%3d

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 2284 Parent PID: 792

General

Chronological Activities

Analysis Process: iexplore.exe PID: 5764 Parent PID: 2284

General

Chronological Activities

Analysis Process: iexplore.exe PID: 5912 Parent PID: 2284

General

Chronological Activities

Analysis Process: iexplore.exe PID: 4704 Parent PID: 5912

General

Chronological Activities

Analysis Process: iexplore.exe PID: 6700 Parent PID: 5912

General

Chronological Activities

Analysis Process: iexplore.exe PID: 6800 Parent PID: 5912

General