Play interactive tour

Edit tour

Analysis Report http://msoffice506.weebly.com

Overview

General Information

Sample URL:	http://msoffice506.weebly.com
Analysis ID:	383629
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	64
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Yara detected HtmlPhish10

HTML body contains low number of good links

HTML title does not match URL

Suspicious form URL found

Classification

Startup

System is w10x64

iexplore.exe (PID: 5636 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5688 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5636 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\J3GPWO06.htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: http://msoffice506.weebly.com

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social Engineering

Antivirus detection for URL or domain

Show sources

Source: https://msoffice506.weebly.com/

SlashNext: Label: Fake Login Page type: Phishing & Social Engineering

Phishing:

Yara detected HtmlPhish10

Show sources

Source: Yara match

File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\J3GPWO06.htm, type: DROPPED

Source: https://msoffice506.weebly.com/	HTTP Parser: Number of links: 0
Source: https://msoffice506.weebly.com/	HTTP Parser: Number of links: 0

Source: https://msoffice506.weebly.com/	HTTP Parser: Title: Sign in to your microsoft does not match URL
Source: https://msoffice506.weebly.com/	HTTP Parser: Title: Sign in to your microsoft does not match URL

Source: https://msoffice506.weebly.com/	HTTP Parser: Form action: https://msoffice506.weebly.com/ajax/apps/formSubmitAjax.php
Source: https://msoffice506.weebly.com/	HTTP Parser: Form action: https://msoffice506.weebly.com/ajax/apps/formSubmitAjax.php

Source: https://msoffice506.weebly.com/	HTTP Parser: No <meta name="author".. found
Source: https://msoffice506.weebly.com/	HTTP Parser: No <meta name="author".. found

Source: https://msoffice506.weebly.com/	HTTP Parser: No <meta name="copyright".. found
Source: https://msoffice506.weebly.com/	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.241.55.43:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.241.55.43:443 -> 192.168.2.3:49709 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: msoffice506.weebly.comConnection: Keep-Alive

Source: unknown

DNS traffic detected: queries for: msoffice506.weebly.com

Source: plugins[1].js.2.dr	String found in binary or memory: http://hammerjs.github.io/
Source: jquery.revealer[1].js.2.dr, jquery.trend[1].js.2.dr	String found in binary or memory: http://pixelunion.net
Source: arrow-light[1].svg.2.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: ga[1].js.2.dr	String found in binary or memory: http://www.google-analytics.com
Source: J3GPWO06.htm.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://bugs.webkit.org/show_bug.cgi?id=85161
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=749920
Source: footerSignup[1].js.2.dr	String found in binary or memory: https://cdn2.editmysite.com/js/
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaE0lM.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaHUlM.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aE0lM.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aHUlM.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNlCV3lGb7U.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNmlUHlGb7U.woff)
Source: css[3].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs169vsUhiYw.woff)
Source: css[3].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUhiYw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUZiYw.woff)
Source: css[3].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUhiYw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnANW6Cp8.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrmAB9W6Cp8.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW-.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2_ROW-.woff)
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://gist.github.com/megawac/8201012
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://gist.github.com/megawac/8355978
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://github.com/WebKit/webkit/blob/master/Source/WebCore/dom/MutationObserver.cpp
Source: MutationObserver[1].js.2.dr	String found in binary or memory: https://github.com/megawac/MutationObserver.js
Source: ~DF319CEFDB770DE62E.TMP.1.dr, J3GPWO06.htm.2.dr	String found in binary or memory: https://msoffice506.weebly.com/
Source: msoffice506.weebly[1].xml.2.dr	String found in binary or memory: https://msoffice506.weebly.com/"
Source: ~DF319CEFDB770DE62E.TMP.1.dr	String found in binary or memory: https://msoffice506.weebly.com/2Sign
Source: {FDCCFF1C-9856-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://msoffice506.weebly.com/Root
Source: imagestore.dat.2.dr	String found in binary or memory: https://msoffice506.weebly.com/favicon.ico
Source: J3GPWO06.htm.2.dr	String found in binary or memory: https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hhhjfhdhjfhfjkvv-ll_orig.png
Source: J3GPWO06.htm.2.dr	String found in binary or memory: https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hjfhhjf_orig.png
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: ga[1].js.2.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: ga[1].js.2.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: ga[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: plugins[1].js.2.dr	String found in binary or memory: https://twitter.com/jacobrossi/status/480596438489890816
Source: ga[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: ga[1].js.2.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: J3GPWO06.htm.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js
Source: recaptcha__en[1].js.2.dr, api[1].js.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: api[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/5mNs27FP3uLBP3KBPib88r1g/recaptcha__en.js
Source: J3GPWO06.htm.2.dr	String found in binary or memory: https://www.weebly.com/signup?utm_source=internal&utm_medium=footer

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 49708 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49708

Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49683 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49684 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49685 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.46:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.34.228.54:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.241.55.43:443 -> 192.168.2.3:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 44.241.55.43:443 -> 192.168.2.3:49709 version: TLS 1.2

Source: classification engine

Classification label: mal64.phis.win@3/47@4/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF4850F0FA0D4B6F93.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5636 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5636 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information1	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://msoffice506.weebly.com	0%	Avira URL Cloud	safe
http://msoffice506.weebly.com	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
weebly.map.fastly.net	0%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
https://msoffice506.weebly.com/	100%	SlashNext	Fake Login Page type: Phishing & Social Engineering
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
http://hammerjs.github.io/	0%	Virustotal		Browse
http://hammerjs.github.io/	0%	Avira URL Cloud	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe
http://www.bohemiancoding.com/sketch	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pages-wildcard.weebly.com	199.34.228.54	true	false		high
sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com	44.241.55.43	true	false		high
weebly.map.fastly.net	151.101.1.46	true	false	0%, Virustotal, Browse	unknown
msoffice506.weebly.com	unknown	unknown	false		high
ec.editmysite.com	unknown	unknown	false		high
cdn2.editmysite.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://msoffice506.weebly.com/	false	SlashNext: Fake Login Page type: Phishing & Social Engineering	high
http://msoffice506.weebly.com/	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://msoffice506.weebly.com/"	msoffice506.weebly[1].xml.2.dr	false		high
https://www.google.%/ads/ga-audiences?	ga[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://twitter.com/jacobrossi/status/480596438489890816	plugins[1].js.2.dr	false		high
https://gist.github.com/megawac/8355978	MutationObserver[1].js.2.dr	false		high
https://msoffice506.weebly.com/favicon.ico	imagestore.dat.2.dr	false		high
https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hhhjfhdhjfhfjkvv-ll_orig.png	J3GPWO06.htm.2.dr	false		high
https://stats.g.doubleclick.net/j/collect?	ga[1].js.2.dr	false		high
https://www.weebly.com/signup?utm_source=internal&utm_medium=footer	J3GPWO06.htm.2.dr	false		high
https://bugzilla.mozilla.org/show_bug.cgi?id=749920	MutationObserver[1].js.2.dr	false		high
https://cdn2.editmysite.com/js/	footerSignup[1].js.2.dr	false		high
https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hjfhhjf_orig.png	J3GPWO06.htm.2.dr	false		high
http://hammerjs.github.io/	plugins[1].js.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
http://www.bohemiancoding.com/sketch	arrow-light[1].svg.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://github.com/megawac/MutationObserver.js	MutationObserver[1].js.2.dr	false		high
https://msoffice506.weebly.com/2Sign	~DF319CEFDB770DE62E.TMP.1.dr	false		high
https://github.com/WebKit/webkit/blob/master/Source/WebCore/dom/MutationObserver.cpp	MutationObserver[1].js.2.dr	false		high
https://gist.github.com/megawac/8201012	MutationObserver[1].js.2.dr	false		high
http://pixelunion.net	jquery.revealer[1].js.2.dr, jquery.trend[1].js.2.dr	false		high
https://msoffice506.weebly.com/	~DF319CEFDB770DE62E.TMP.1.dr, J3GPWO06.htm.2.dr	false	SlashNext: Fake Login Page type: Phishing & Social Engineering	high
https://msoffice506.weebly.com/Root	{FDCCFF1C-9856-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://bugs.webkit.org/show_bug.cgi?id=85161	MutationObserver[1].js.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
151.101.1.46	weebly.map.fastly.net	United States	54113	FASTLYUS	false
44.241.55.43	sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com	United States	16509	AMAZON-02US	false
199.34.228.54	pages-wildcard.weebly.com	United States	27647	WEEBLYUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	383629
Start date:	08.04.2021
Start time:	03:40:50
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 2m 36s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://msoffice506.weebly.com
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	5
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal64.phis.win@3/47@4/3
Cookbook Comments:	Adjust boot time Enable AMSI
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, ielowutil.exe, svchost.exe TCP Packets have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.83.120.32, 172.217.168.10, 172.217.168.74, 216.58.215.227, 216.58.215.232, 172.217.168.4, 172.217.168.35, 152.199.19.161, 23.54.113.104 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, fonts.googleapis.com, fs.microsoft.com, ajax.googleapis.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, e1723.g.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, e11290.dspg.akamaiedge.net, ssl.google-analytics.com, iecvlist.microsoft.com, go.microsoft.com, go.microsoft.com.edgekey.net, ssl-google-analytics.l.google.com, www.google.com, www.gstatic.com, prod.fs.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\GJKVX0LQ\msoffice506.weebly[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	2686
Entropy (8bit):	5.727070682652174
Encrypted:	false
SSDEEP:	48:0vkQqDe22Oo8TdlxGRenn4nL5SYXONV5dMXtM8qQm4hwxwVppWOTqpqrpETzk2pi:PQqDR2Oo8TdlxGRen4nL5SYXOT5SXtMi
MD5:	AA533694C167B5FBE655C15A8509BAED
SHA1:	0981D0666C11447C1F2BA0EEA76D3F557264BA17
SHA-256:	C709FD54F655A7E6F3A8126E27707FF8942CE602FD05C48537A1D9090D413AA0
SHA-512:	F8BCB5BD7A62BF5AE854B10E7FDA0EEB2BC2949521BCEB7E507BA4FAC9EF67960A8E2F142AF2C7DEC503F502CEAECCC599D7839E6CE92FC561D52FDE5770D32A
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root><item name="snowplowOutQueue_snowday__wn_post2" value="[{"evt":{"e":"pv","url":"https://msoffice506.weebly.com/","page":"136605011:603768642711456430","tv":"js-2.6.2","tna":"_wn","aid":"_wn","p":"web","tz":"America/Los_Angeles","lang":"en-US","cs":"utf-8","f_pdf":"0","f_qt":"0","f_realp":"0","f_wma":"0","f_dir":"0","f_fla":"1","f_java":"1","f_gears":"0","f_ag":"0","res":"1280x1024","cd":"24","cookie":"1","eid":"c7b9278d-3d95-4b0c-b595-a39e507329f7","dtm":"1617878501118",&qu

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{FDCCFF1A-9856-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8458255177153444
Encrypted:	false
SSDEEP:	192:rpZCZw2bVWbwtbz+fbzGDxMbiGUbUGqbUuwfbUuosX:rfenYIHUHG+eGUwGqwu+wux
MD5:	A8BB57AC92AE7E02F653D422DDD23149
SHA1:	16BA470CE858AEB83ACC4030C35FE142FF21CABF
SHA-256:	871976AC8B2DB7A090EF95C4F8E2D27F8E50A2BD4B8B04B9A592C3A268CCC5B5
SHA-512:	46696F58C18D89AD0005E8DEADFFE669E87524FDC6F2CA9D1D2914C88C45F1652BE85035AC403924AA5C33DF523CD5731713C2774EFFB37223AFEF4FBF2EEFC6
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{03FC83BC-9857-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5627921641075317
Encrypted:	false
SSDEEP:	48:IwKGcpr/GwpayG4pQahGrapbSgGQpK/WG7HpRMTGIpG:ruZJQC6MBSIA5TYA
MD5:	55A81C4E8C3871C180FFB00310B3B101
SHA1:	3DB62B787B75FCDC2F1BEACA783C68C9DF207F19
SHA-256:	D71D746E2944A3E3527EC318E662E3EF3B6AA2807341E8960911D274E2394D49
SHA-512:	CDA59E2FB2CFB8C516ABD27C0BCC6B4BF035FEAB3D5C56466F9F2B8204A396C9F9E7C44541C5DDCA42442FCD9F849EAC4562145438C5D9E34700861A0850FA8F
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{FDCCFF1C-9856-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	27630
Entropy (8bit):	1.7902584861038946
Encrypted:	false
SSDEEP:	96:rxZ2Q76BBSFjx2VWsMkwk/jwAQ5erwWY3r:rxZ2Q76BkFjx2VWsMkwOjwbr
MD5:	B55E5E6798E6A11440C2E21E00C19A6A
SHA1:	B458AC9D941A54E0301F5101D4CA3D079566676A
SHA-256:	FAC2D3CE86BEE1683A395ABF6C8482882BFD466CA43F5AF3DBAC514EFE07E6AC
SHA-512:	11FDD936FCBA58F7EC9DA5687985E2AD8FEB9AB3415FEE82F488191BDC62F31DA256F68812A56E19D87D2AE0F9F9C0667C77340BE814D30656F2F20F108C556A
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	modified
Size (bytes):	4408
Entropy (8bit):	4.231567211554997
Encrypted:	false
SSDEEP:	48:pWVPDoH8yAXQ8K5UvCUbpXtlhMVDBilhB7IODnNcynEJPMHErU8ACbtRKO7nheZ:gDlyAXQ8yUdduBiloycKeRg8xbtsOA
MD5:	BE11A8D505DB2F42E25F97D4DC986B14
SHA1:	7E09368EF553A20E93DA6CA442A3068DEEA5C530
SHA-256:	733761DAF93978E822BDCF0DF45412A357F6E461A27021CA5251DDDD016DB3FF
SHA-512:	D918D46A2BD97D60CEC41D0DD7DA59180C8DD8F422FAEBCCF9AD4DCACF75DF6B9279A5BD4AA94131B0BBA17E8C94EA5BB51AC38B5D4F49F520D77544FA8F7999
Malicious:	false
Reputation:	low
Preview:	*.h.t.t.p.s.:././.m.s.o.f.f.i.c.e.5.0.6...w.e.e.b.l.y...c.o.m./.f.a.v.i.c.o.n...i.c.o........... .... .........(... ...@..... .....................................................................................................................................................................................................................................................................................................................D;3.C;4.D;3.D<3.D<3.D<6.A2".Pc..........M>5.....E;4.D;3.D;3.D<3.F<5.E<4.................................................F?4.ID5.D<37C;3.C;2.C;2.C;2.C;3.D<3LE=3.E=2.D<3.D=3.C<2QC;2.C;2.C;2.C;2.D;3.D;46JB;.G>6.....................................E;4.H<5.D;3]C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<2.G<3.G<4.D<3.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<3[C=7.C<4.............................H<7.B;1.D<3CC;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<2nD<3sC;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<3@B:3.HA2.........................D<3.E<4.C;2.C;2.C;2.C;2.D<2.C;2bD<3pC<2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2_ROW-[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 15236, version 1.1
Category:	downloaded
Size (bytes):	15236
Entropy (8bit):	7.969203300169163
Encrypted:	false
SSDEEP:	384:LRpyXzNKZkpfrUcPlG9rmucpNaYVSzKQKwb:VADNnpfrtkpuQKwb
MD5:	9D793A8D492EE02DF891E473D9267325
SHA1:	90F7C3665DAD15564CBB01EF5B31BB909EE517CA
SHA-256:	8545FDDD567039B81C7224949B5D930212762BF7B93124EB86905D6F8B5299A2
SHA-512:	58EBE21FEE685D6A580AA2F233776D2A92CE726595DD76E575ACC1A327EE30CB493A2CCEEB307F0CA4B2C18AD0F66C203CE527376BD44D58FA0898B2D68D8F28
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_Of2_ROW-.woff
Preview:	wOFF......;.......V.........................GSUB...D...5...6....OS/2...\|...S...`u.QTSTAT.......9...D...,cmap.......y...68.<.gasp................glyf......3K..L..$..head..6....6...6.6..hhea..7........$...hmtx..74...0....LCF.loca..8d...........4maxp..:........ ...:name..:8...,...l;.\8post..;d....... .m.eprep..;\|........h...x.c`d``.b0b0a`qq..a.J.,.aPI/J.fP.I,.cPa`a...........:...x.c`a9......u..1...<.f...........A.Hy.........d........G......\|.F...+..`u..{....x......@...y...FG.b...K..p.`DL..........;..5..z1............x....XY.E..9.}...m.m.m....N..3...p#.q.0uc.?>.;.M.xo.........H..=.d..=.gb...Zx#\|.>._...O..!....o.....>JJN~....... ....hZ..#.....t....'Pv!...$o..YI...OJxp....Tt$:....D....Q.(c..~.X.B...b.(.9P...L./....6@1=.TK.M..Fy.U.UE.t.Qge..L7..U.~-...0.Q\.....`G....]\..a...]...4D..d..)y.W9..7..#...X..3...L6.T.L7..3.5K{s,4.\|.,RXQ.,...K-..Jk..........l..f[.U.......U..f6.............x.Z.x.W...I.1.F3..4b4.-...l..9M.&e.fSn.)37ef.6....r...]...X.wFv.9i.n:..p.....\.0.Q .}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	4286
Entropy (8bit):	4.191445610755576
Encrypted:	false
SSDEEP:	48:9DoH8yAXQ8K5UvCUbpXtlhMVDBilhB7IODnNcynEJPMHErU8ACbtRKO7nhe+:9DlyAXQ8yUdduBiloycKeRg8xbtsO7
MD5:	4D27526198AC873CCEC96935198E0FB9
SHA1:	B98D8B73AD6A0F7477C3397561B4AAB37BF262AA
SHA-256:	40A2146151863BCF46C786D596E81A308D1B0D26D74635BE441E92656F29B1B4
SHA-512:	1EE4B73F4DA9C2B237CD0B820FFAD8E192D9125CE7D75D8A45A8B9642CE5FE85736646CAF12D246A77364C576751C47919997D066587F17575442A9B9F7CC97F
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/favicon.ico
Preview:	...... .... .........(... ...@..... .....................................................................................................................................................................................................................................................................................................................D;3.C;4.D;3.D<3.D<3.D<6.A2".Pc..........M>5.....E;4.D;3.D;3.D<3.F<5.E<4.................................................F?4.ID5.D<37C;3.C;2.C;2.C;2.C;3.D<3LE=3.E=2.D<3.D=3.C<2QC;2.C;2.C;2.C;2.D;3.D;46JB;.G>6.....................................E;4.H<5.D;3]C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<2.G<3.G<4.D<3.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<3[C=7.C<4.............................H<7.B;1.D<3CC;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<2nD<3sC;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<3@B:3.HA2.........................D<3.E<4.C;2.C;2.C;2.C;2.D<2.C;2bD<3pC<2.C;2.C;2.C;2.C;2.C;2.C;2.C;2.D<3lD<3^D;2.C;2.C;2.C;2.C;2.E<3.D<3.........................C;2.D<3FC;2.C;2.C;2.D;2.F=3.E=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\footerSignup[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3600
Entropy (8bit):	5.0991703557984245
Encrypted:	false
SSDEEP:	48:kAvNhI9OKn/hQVBVan40yt00nzt/VRgj9o91PYczAz9AfK9TPBlVnIkKYeE5W:kAvOpZ+B8R0FVRjrTEzmfgmzPr
MD5:	40B81B2D52BA9D2E2C64C31FF6A24CD7
SHA1:	6B5689250661646ECBB841F2475F1556A113373C
SHA-256:	E06BACA13F25DF9C7D684FC1B1FDFBBBB95070A1D5A9CD648632DA7BCCC90B96
SHA-512:	5657EE166A1EFF5DEEA7A0125EDD6178541396DCCB035785F5790BC1C57DEE6B0E1C9D063D00333E95667F699D99172796CE301EDD1DF2C4BFF02D25536F0D0C
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/js/site/footerSignup.js?buildTime=1617731700
Preview:	(function(t){var e={};function r(n){if(e[n])return e[n].exports;var i=e[n]={exports:{},id:n,loaded:false};t[n].call(i.exports,i,i.exports,r);i.loaded=true;return i.exports}r.m=t;r.c=e;r.p="https://cdn2.editmysite.com/js/";r.p="https://"+window.ASSETS_BASE+"/js/"\|\|r.p;return r(0)})({0:function(t,e,r){t.exports=r(610)},610:function(t,e){(function(t,e){var r={height:62,mobileHeight:124,getHeight:function(){if(u()){return r.mobileHeight}return r.height}};function n(e,n){var u=t("#weebly-footer-signup-container-v3");if(!u.length){return}i(e,n);r.element=u;r.iframe=t("#weebly-footer-signup-iframe");if(!o()){r.element.remove();return}a();s();l();t(window).on({resize:p(l,500),scroll:p(l,500)})}function i(e,r){var n='<link href="//'+e+"/css/free-footer-v3.css?buildtime="+r+'" rel="stylesheet">';t(n).appendTo("head")}function o(){var e=t("body");var r=!!document.getElementById("kb-container");var n=e.hasClass("splash-page");return!(r\|\|n)}function a(){var e=t("body");e.css({minHeight:"100%",posit

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\hhhjfhdhjfhfjkvv-ll_orig[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 433 x 65, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	12818
Entropy (8bit):	7.971870786577492
Encrypted:	false
SSDEEP:	384:pBdN2moJfLp6SImmr4VupZU14dtrLT95NFP1EJ4nF:LdYpZLFImmrlp17HNFdEJm
MD5:	D42D52955A1117E9A4D83B654328DDBC
SHA1:	3D7F9A203486324B2E867E29FACA20C49F483AF3
SHA-256:	12E8BCC7E3095A83875C054E1B5C0A12C4FD848745468F6439EFE795582BABD8
SHA-512:	748557165085E355C8FA5A1B1329344B31C974B6D9AB3D7AE7F15E93AFE05E8F0B5B4845F4A0EE9A366A829105DEBA7E67522FB157EB7834D38ED60ACDA76581
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hhhjfhdhjfhfjkvv-ll_orig.png
Preview:	.PNG........IHDR.......A....._5....1.IDATx.....E..QQwftPt<.....>......o..Y.uvW].QPT.....D.D<8<Q@G..OT`...m.E..A.n.....#.j...$.....Y]U}....}._fG.]..."#..Qt.n.-.E...Io..[t.n.-.u^...q.%.`1.0......b..>5.H5....Q......c......}......-.w.....ef...F..\|.-...k.d...N..Dln'3...)....<?....x..G.o.x.:^".HMMM...L[........P#.K...G....E.y^./Ml..e.i1.fx.VX....7..$9..IP..i..L.a..>....n..\|}]-.v.,4.X{.iI.....}P.1.?..3 -.+$.~....Cd....D....pd&J.P.L.7yt....#+..W`n.mQl..v..D...."1]K9r....D..d.....g.[..U.>r.Y.....o.....k.<...WK,.d..T. .......A...x[.i.j.....}...].Yb.4"/..C.+1.@..!.T^R....3...i#,...... 1..=.7..z.R[u~J.$...pp..%.T.9q...l.,..Dt.-H..hy.m..V..C..\|.....U......b$...\|%..d...u8b...-.N`..2SO/B`:..v..,Xf.,3.i.D].Y..\.0".LGT@.`..@d.\...p.jk..Hd.]Vb..$...N2..e%Pf........r...B......Td..\..JK-0.m...L7g..c@`.U.....Ab.U."...!.........2....]Cb... ...D.K.9.@`....uDAH.j.9........,...L.....b.B...m. 35...... ,AZ.\..Z}^Lo...Hd.]KbLZ8.....-/...7...,.p.`!...,.?fT@....wN

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\main_style[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	45877
Entropy (8bit):	4.956224436141753
Encrypted:	false
SSDEEP:	768:lCBaz8/sEgxyG5abm0m1Nc46gbagZ9JezVXCQgAGCiTPFE/2:lCBaz8/svhEm00cGbagZ9J0CQgAGCiT3
MD5:	CF47EFCD84C5A866905BF2562552382E
SHA1:	82C0CE8AA978B09F94DFD974C603504B732326D4
SHA-256:	937F0EBCA1624BEF3B52099244BF5AEEDF541469379DB32DCA5B1B6AD9351118
SHA-512:	99B3C3047E51DD48B819C3C222486BF6585844A6FB837A00699D2671627979B5E2C32753B072ADACE485655F0E9F1E0300995A3F639AA501385B476D3D651F8E
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/main_style.css?1615304161
Preview:	ul, ol, li, h1, h2, h3, h4, h5, h6, pre, form, body, html, div.paragraph, blockquote, fieldset, input { margin: 0; padding: 0; }.ul, ol, li, h1, h2, h3, h4, h5, h6, pre, form, body, html, p, blockquote, fieldset, input { margin: 0; padding: 0; }. input[type="text"], input[type="email"], textarea { -webkit-box-shadow: none; -moz-box-shadow: none; box-shadow: none; -webkit-appearance: none; -moz-appearance: none; appearance: none; text-shadow: none; }. input[type="text"]:focus, input[type="email"]:focus, textarea:focus { border: 1px solid #777777; }. textarea { resize: none; }. select { -webkit-appearance: none; -moz-appearance: none; appearance: none; text-indent: 0.01px; text-overflow: ''; }. .wsite-form-field input[type="radio"], .wsite-form-field input[type="checkbox"], .wsite-form-field #wsite-search-sidebar .wsite-search-facet-availability input[type=checkbox], .wsite-form-field #wsite-search-sidebar .wsite-search-facet-checkbox input[type=checkbox], .wsite-com-product-option-group

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\plugins[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	67465
Entropy (8bit):	4.809594108927749
Encrypted:	false
SSDEEP:	1536:59rPpU1wHKYTpQ73CHJHDuYL/OHHeZF+YwLMC0ht/uJFO0815wZDk5/2M:59rPpl1NQ73CHJHDuYL/OHHeZF+pLM75
MD5:	2B8D85F1EA01D2C3E8B962EAC8D76A5C
SHA1:	936987A7E08DAA4A916C77D86937EDEE42D657DA
SHA-256:	B6353CA52760ABA4E7547AE9861DB68158DC2AF0F4FEBECE55E5C775EE4449F5
SHA-512:	F64D0E9FC7ED02F4C7B3CF7FD680DF3A6F8F4CEFADEEA63553D0F0A4BB5472ABF5EE754C0E056CD91272F0108910347BA6F3CF23C825FD89260CF0545DD0702A
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/plugins.js?1615300395
Preview:	./! Hammer.JS - v2.0.4 - 2014-09-28. http://hammerjs.github.io/. . Copyright (c) 2014 Jorik Tangelder;. * Licensed under the MIT license /.(function(window, document, exportName, undefined) {. 'use strict';..var VENDOR_PREFIXES = ['', 'webkit', 'moz', 'MS', 'ms', 'o'];.var TEST_ELEMENT = document.createElement('div');..var TYPE_FUNCTION = 'function';..var round = Math.round;.var abs = Math.abs;.var now = Date.now;../. set a timeout with a given scope. * @param {Function} fn. * @param {Number} timeout. * @param {Object} context. * @returns {number}. /.function setTimeoutContext(fn, timeout, context) {. return setTimeout(bindFn(fn, context), timeout);.}../. if the argument is an array, we want to execute the fn on each entry. * if it aint an array we don't want to do a thing.. * this is used by all the methods that accept a single and array argument.. * @param {\|Array} arg. @param {String} fn. * @param {Object} [context]. * @returns {Boolean}. */.function invokeArr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaE0lM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 14260, version 1.1
Category:	downloaded
Size (bytes):	14260
Entropy (8bit):	7.966217847401131
Encrypted:	false
SSDEEP:	384:H3P28k2W4TMcRXu2kE5+6mihFraeQMGS+JCVgyS:XP2Mzu2F+6mihFunZSrvS
MD5:	6EE84F63EF54DC2F82EAC18A81E18503
SHA1:	D2FE4F772BE85D76D50A4B6308FB2660879EC215
SHA-256:	1803E8587D79FB3755BE85803B10D2A642B67E7F547E75654B919F598AEC9461
SHA-512:	2F5BB2E91A8C0C61300BFD77CAD2ED6EC812CA524ED332CB8B8FC0E892D73DE37F1554B10FD63166F7982BA097B87E2548CFE48CE8154BB4B986AAE3C1B0DC82
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaE0lM.woff
Preview:	wOFF......7.......U.........................GDEF...l............GPOS.......d....N.'.GSUB...\........J.2 OS/2.......Y...`tE%xSTAT...\...=...L....cmap.......r........gasp................glyf......)5..@..7..head..1P...6...6.=.zhhea..1.... ...$....hmtx..1........X4.v.loca..4P............maxp..6l....... .(..name..6........"3[U.post..7........ ...2prep..7.........h...x.-............!.....FWH.A.....T.Q.B..P. .`.{...=D..'.IP.:....v..N.....dm7l.=p.g'.N\..q..'J.T.x.F\|..:..ok'%JlO9.K.S ....A.j... .C......x.}...\Q.E.}..3...Om..j..m....j{..v.",...+.......9.\.I.....f-ZuR...F(Y...n...3B.x6......D..F.tDa..{}.W.T.c...id.^f..e..m.9g.....qF93.y..g..6.(.KD79.Id.....P.2..,....\|Y*...\|9....U-.V...PS.m...).s/...A.d....^.h..(.'.MtH.J...^W:..l.[....0.\|..G......g...trA.C......#<.h.;.(...ak..N..v.. .Ag.$..y....yP.D...........g.~.:..}D.m.....H2..Mc7.A./.=..s.N.n..C..~2Aj0e5......x..?.\.6..es.6.......q........zh......t...........:D..E....p.S..U....h....J.zx./.,.. ..\l..\|..m."b......l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aE0lM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 14336, version 1.1
Category:	downloaded
Size (bytes):	14336
Entropy (8bit):	7.967095491114002
Encrypted:	false
SSDEEP:	384:E9L+8kuMz0xjYCayC+lJdjaOSMfdSiypqnABNIfTHG:4aAMcayllJFaNcZKqnABN8G
MD5:	B2CD4A140A2B39890DC726B9F96E4DE1
SHA1:	D0C6ACC7E507FDA049AE4A4FA7EF1E65C36AB94D
SHA-256:	78A5EB7E60B53AE1A8D9627BA251E8A8E281CC2ED955153A59A87CF7AC181C48
SHA-512:	8788A7C54F43B877864F5F7364FECA041807A76A007F2DC0555795FFDA7A6491EAC87ECCDAE801A4B6EB0E55B9EE9E6F8523C849F640CFA8D483EEC49E5E73E8
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aE0lM.woff
Preview:	wOFF......8.......U.........................GDEF...l............GPOS.......o....N ".GSUB...h........J.2 OS/2.......X...`uq%XSTAT...d...>...L.Q. cmap.......r........gasp................glyf... ..)...@..chead..1....6...6.>.zhhea..1.... ...$....hmtx..1........Xl.j.loca..4.............maxp..6........ .(..name..6.........0]R.post..7........ ...2prep..7.........h...x.-.!....D.w?..c...G.W{/.&F..{...X..fva...mbgu...C..p.......};`hG...1...v..n....{r....+7{w.tA..o....?..vR....#..9."(.........R<.....x.}....a...?....g..m.m...7..M..A..A._.....sq.dd$.([e..k.."...7B..K^........ID..!2.....5.c..^...xL..6.L-...2S.,...2...s.<6..N.g.3..,qV9/......._.(Jy..X.P.r...<....<...JR%UV.....QS..PU.K._5...!s..."...!..G.D.....V>.\1.T.Z...J......ly...+#/l..o...l,.}.{.....U4..GPt.L....w.o.....T.I.1..do...L~..?3.P;C...w.....G.G..~.. .Iy...\r.A.@......d........$/^..3..3....%...S.\|..H.....Dl2H'.Am&.Y.. .\.7T...Q...6....m%.a."6n.j......9....2.E...H1h....hi".........H>...Rl..Z....;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sites[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	214956
Entropy (8bit):	5.0535689910376265
Encrypted:	false
SSDEEP:	768:tEna6MVmtj++7bqoBtgmuHKBP/ksdB0UB5KUJ0GM5BUUQXE0Csoptr+pPPy7ki2B:tEnMVmtSSdBS5H5Vptr+prRG4w6xf
MD5:	9B0CEA89EFE53D91D78D11FFD47932D9
SHA1:	4923AB33295645E85508386F7B6B884BA671C25A
SHA-256:	004224D90390C7CD683C2B1911C8FF02DA3C2F1DD84DB133333F3D704ADB7355
SHA-512:	7C4A77D774D905F15BB3CBB1211849CED2F33992A77A246E20F7BC82AEA7B0CBA8AAC41C6D4F6BA67F0C38814404B227769F3BC637F6BA721598F72D6701A8D6
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/css/sites.css?buildTime=1615232570
Preview:	@keyframes spin{0%{transform:rotate(0deg)}100%{transform:rotate(360deg)}}/! Reflex v1.5.0 - https://github.com/leejordan/reflex /.grid{display:inline-block;display:-ms-flexbox;display:flex;display:inline;zoom:1;-ms-flex-wrap:wrap;flex-wrap:wrap;padding:0;margin:0;position:relative;width:100%;max-width:100%;letter-spacing:-0.31em !important;letter-spacing:normal !important;word-spacing:-0.43em !important;list-style-type:none}.grid:before,.grid:after{letter-spacing:normal;word-spacing:normal;white-space:normal;max-width:100%}.grid :before,.grid :after{letter-spacing:normal;word-spacing:normal;white-space:normal}.grid .grid{-ms-flex:1 1 auto;flex:1 1 auto}.grid {box-sizing:border-box}.grid :before,.grid :after{box-sizing:border-box}[class="grid__col-"]{display:inline-block;display:-ms-flexbox;display:flex;*display:inline;zoom:1;-ms-flex-direction:column;flex-direction:column;letter-spacing:normal;word-spacing:normal;white-space:normal;position:relative;width:100%;vertical-align:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\snowday262[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	75006
Entropy (8bit):	5.625174285042866
Encrypted:	false
SSDEEP:	768:YdDFSZ8JdMS1xGPlopXbk+KQZPKOf/py7pFw7N5o9qmse9fLrJIWzAfap34VEzH0:6FSZYdMS1xGNopX5LP16FuvqT7bmVF
MD5:	99BBE560926E583B8E99036251DEB783
SHA1:	8D81B73AE06F664F9D9E53DD5829A799BF434491
SHA-256:	648E766BF519673F9A90CC336CBECEDE80DCBE3419B43D36ECBB25D88F5584A3
SHA-512:	EE24915AA5C1C7C1DD571C07EFE46DFC173CB69D2DADC4C32891CE320EEF4FE1CFB614D9C212F16BFE2C83B29C6EEAB6C5A43F8E32D475DA8081B1E2D33869B4
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/js/wsnbn/snowday262.js
Preview:	(function e(b,g,d){function c(n,j){if(!g[n]){if(!b[n]){var i=typeof require=="function"&&require;if(!j&&i){return i(n,!0)}if(a){return a(n,!0)}var m=new Error("Cannot find module '"+n+"'");throw m.code="MODULE_NOT_FOUND",m}var h=g[n]={exports:{}};b[n][0].call(h.exports,function(l){var o=b[n][1][l];return c(o?o:l)},h,h.exports,e,b,g,d)}return g[n].exports}var a=typeof require=="function"&&require;for(var f=0;f<d.length;f++){c(d[f])}return c})({1:[function(require,module,exports){var JSON;if(!JSON){JSON={}}(function(){var global=Function("return this")(),JSON=global.JSON;if(!JSON){JSON={}}function f(n){return n<10?"0"+n:n}if(typeof Date.prototype.toJSON!=="function"){Date.prototype.toJSON=function(key){return isFinite(this.valueOf())?this.getUTCFullYear()+"-"+f(this.getUTCMonth()+1)+"-"+f(this.getUTCDate())+"T"+f(this.getUTCHours())+":"+f(this.getUTCMinutes())+":"+f(this.getUTCSeconds())+"Z":null.};String.prototype.toJSON=Number.prototype.toJSON=Boolean.prototype.toJSON=function(key){ret

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\MutationObserver[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	24573
Entropy (8bit):	4.180357727668446
Encrypted:	false
SSDEEP:	384:BRS9Bqoq/onyBpIeggNSNreqfBWddUJtTfw:BRS9BqoTnkSNakIAtTfw
MD5:	E52201E96AF18DD02C85EB627C843491
SHA1:	5BCDD1480B9BEBCDDB0D82083BDF03A7435D59A1
SHA-256:	397452D9F6A2EA6A2135B45C9E40139C68AC6661F3BAB4413E7299586CCB408A
SHA-512:	2DDEA7E1C2127A0B7A2F19764A1AC1CFD26E2D3C3189647FA3BB987FFD1107F30A9BF219D24726047FE84EE72802B515F6290CEFBA02DF1D854C70F0D3A37D8C
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/MutationObserver.js
Preview:	/!. Shim for MutationObserver interface. * Author: Graeme Yeates (github.com/megawac). * Repository: https://github.com/megawac/MutationObserver.js. * License: WTFPL V2, 2004 (wtfpl.net).. * Though credit and staring the repo will make me feel pretty, you can modify and redistribute as you please.. * Attempts to follow spec (http:// www.w3.org/TR/dom/#mutation-observers) as closely as possible for native javascript. * See https://github.com/WebKit/webkit/blob/master/Source/WebCore/dom/MutationObserver.cpp for current webkit source c++ implementation. /../. prefix bugs:. - https://bugs.webkit.org/show_bug.cgi?id=85161. - https://bugzilla.mozilla.org/show_bug.cgi?id=749920. * Don't use WebKitMutationObserver as Safari (6.0.5-6.1) use a buggy implementation./.window.MutationObserver = window.MutationObserver \|\| (function(undefined) {. "use strict";. /. @param {function(Array.<MutationRecord>, MutationObserver)} listener. * @constructor. */. function

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	850
Entropy (8bit):	5.527707926617847
Encrypted:	false
SSDEEP:	24:2jkm94/zKPccAv+KVCetdW1SN3KsLqo40RWUnYN:VKEctKoeXW1ILrwUnG
MD5:	D7734620B0481E6B18FD96A7656AE73A
SHA1:	EF2B44C41FAD07AAD5BAA67C73AA30ACB418B9C6
SHA-256:	2717DCC1DDD778F68223461EBD53610370E7617B6C74366BFC16A1E6E979CC58
SHA-512:	5C44D9326DF61B2FCBD9C493DF0EF53A49DE78DAF7301CAC5089325C0F0E29B7BABC9897A5A747A8700AB6F3BBF76480B53B3F8169CB1A6C8F25FA55170889FD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api.js?_=1617878500414
Preview:	/* PLEASE DO NOT COPY AND PASTE THIS CODE. */(function(){var w=window,C='___grecaptcha_cfg',cfg=w[C]=w[C]\|\|{},N='grecaptcha';var gr=w[N]=w[N]\|\|{};gr.ready=gr.ready\|\|function(f){(cfg['fns']=cfg['fns']\|\|[]).push(f);};w['__recaptcha_api']='https://www.google.com/recaptcha/api2/';(cfg['render']=cfg['render']\|\|[]).push('onload');w['__google_recaptcha_client']=true;var d=document,po=d.createElement('script');po.type='text/javascript';po.async=true;po.src='https://www.gstatic.com/recaptcha/releases/5mNs27FP3uLBP3KBPib88r1g/recaptcha__en.js';po.crossOrigin='anonymous';po.integrity='sha384-EybSWcHgiPeEiW8PyVFCqH8ltF5BJVYLCCHJpTp2QsYs58TZJuGZOUGfGAPF4IjR';var e=d.querySelector('script[nonce]'),n=e&&(e['nonce']\|\|e.getAttribute('nonce'));if(n){po.setAttribute('nonce',n);}var s=d.getElementsByTagName('script')[0];s.parentNode.insertBefore(po, s);})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\arrow-light[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	886
Entropy (8bit):	5.035010292982074
Encrypted:	false
SSDEEP:	12:TMHdt0ubqt7/KYslXXHlPeaxMwm5EIDXqBJVJ/hlIJi2y1dQ9/01klp0u:2dtjbqt7L8FPeaxMwm+ID63zbF+MOf0u
MD5:	552EB2E04260FC0733E5633D15C6AEAA
SHA1:	0A9EFCC3B0EBABB23A49A00061FD8200EDED1613
SHA-256:	705FF3240DE004523FF9D628B28AAD705AD3F0CEB046312495265A4042C67570
SHA-512:	16CD125A26B1604144D6A64F45D1064FF2A71DA412CF61C829914E00C2E4AA275A172D0872A9533F79D5FC2D2BE82A7DFE3FE5F12048C23AF927A7CB35D571CF
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/images/arrow-light.svg?1615304161
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="no"?>.<svg width="22px" height="11px" viewBox="0 0 22 11" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">. Generator: Sketch 39.1 (31720) - http://www.bohemiancoding.com/sketch -->. <title>Group</title>. <desc>Created with Sketch.</desc>. <defs></defs>. <g id="UI-Kit" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd" stroke-linecap="square">. <g id="Ui-Kit" transform="translate(-61.000000, -697.000000)" stroke="#FFFFFF" stroke-width="1.5">. <g id="Group" transform="translate(62.000000, 698.000000)">. <path d="M0,5 L19,5" id="Line"></path>. <path d="M16,0.5 L20,5.02" id="Line"></path>. <path d="M16,9.02493763 L20,5.02493763" id="Line"></path>. </g>. </g>. </g>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1409
Entropy (8bit):	5.419300835391617
Encrypted:	false
SSDEEP:	24:5XSOYs2XNXSOYN72Xe3OYN75/ZY3QYsNxaY19/ZY3QYN7NxaY1X/ZOYsNxaaY/ZV:EOL2YOC2MOCjY3QLNDFY3QCNDbOLNJaV
MD5:	4B7CC2B62FE3A473AF48EE3B40BC4C5A
SHA1:	8C0C6FD93B8DFA0E5B3397936FACCCD21CB8478B
SHA-256:	E59592D5CAE8BAF1D26083E8528BE34313750F6E6A2F2944B30337F8DA4C0C0E
SHA-512:	9184A012777C58D206EE2ED2AC0B91FD4C4EFF4649D10F7D47A282D5279119C60D8E488B366A4E07907A4421EBA387FE531BAECE53B7C7D1F7B4EE83C69DE73F
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Karla';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaE0lM.woff) format('woff');.}.@font-face {. font-family: 'Karla';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aE0lM.woff) format('woff');.}.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUZiYw.woff) format('woff');.}.@font-face {. font-family: 'Roboto Mono';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnANW6Cp8.woff) format('woff');.}.@font-face {. font-family: 'Roboto Mono';. font-style: italic;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrmAB9W6Cp8.woff) format('woff');.}.@font-f

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\css[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	762
Entropy (8bit):	5.410592776085871
Encrypted:	false
SSDEEP:	12:jFiwSY3Q6ZRoT6pthf6NLqFiwSY3Q6ZN76pthf6FBnqFiwSO6ZRoT6ptvnX6/Lqo:5XSY3QYsKXXSY3QYN7KsB+XSOYs2X/X2
MD5:	9202A5CB055AAECEA2C5608666B12A82
SHA1:	545D521A3D4A63D3F96E124392285D226AE4E712
SHA-256:	91BD47DF90E8B247DCB60360173C75BE1E825833B9454A6D35E5D8E6652B3C59
SHA-512:	E474B6705E984DCB36840B4F1CC92B61310FC204D3EE2DE85D66462637DC44F9E156C652C6A202F15861FC6A9B7E59AA17D37628C062FA2D9B445CA5F9807143
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Karla';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNlCV3lGb7U.woff) format('woff');.}.@font-face {. font-family: 'Karla';. font-style: italic;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNmlUHlGb7U.woff) format('woff');.}.@font-face {. font-family: 'Karla';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaHUlM.woff) format('woff');.}.@font-face {. font-family: 'Karla';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aHUlM.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\css[3].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	579
Entropy (8bit):	5.36499526631253
Encrypted:	false
SSDEEP:	12:jFF5O6ZN6pT4ALqFF5O6ZRoT6pTyjALqFF5O6ZN76pTTFLY:53OYNjAa3OYsXMa3OYN7O8
MD5:	936289D85DFC0C483C7FACBB4B5B4EF0
SHA1:	DE79428618D76536C0D021BC05778B9D971E9AC2
SHA-256:	089131070F90020BE376087C2AC2117A96057BFF81E87C3376202BF5E406C92D
SHA-512:	018A2DAA6D194F5181AEF93A0970FBBED590D990BBD223544675960BA1EDD05F7DEFFFAFEC89F51D9DA399D998AE3A8E50EA30BD726EDBDE34E50909291E8824
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs169vsUhiYw.woff) format('woff');.}.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1_FvsUhiYw.woff) format('woff');.}.@font-face {. font-family: 'Oswald';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/oswald/v36/TK3_WkUHHAIjg75cFRf3bXL8LICs1xZosUhiYw.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\ga[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://ssl.google-analytics.com/ga.js
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	93636
Entropy (8bit):	5.292860855150671
Encrypted:	false
SSDEEP:	1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:O+vIklosn/BLXjxzMhsSQ
MD5:	3576A6E73C9DCCDBBC4A2CF8FF544AD7
SHA1:	06E872300088B9BA8A08427D28ED0EFCDF9C6FF5
SHA-256:	61C6CAEBD23921741FB5FFE6603F16634FCA9840C2BF56AC8201E9264D6DACCF
SHA-512:	27D41F6CFB8596A183D8261509AEB39FCFFB3C48199C6A4CE6AB45381660C2E8E30E71B9C39163C78E98CEABC887F391B2D723EE5B92B6FBC81E48AC422E522B
Malicious:	false
Reputation:	low
IE Cache URL:	https://ajax.googleapis.com/ajax/libs/jquery/1.8.3/jquery.min.js
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /.(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\main-customer-accounts-site[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with LF, NEL line terminators
Category:	downloaded
Size (bytes):	532719
Entropy (8bit):	5.34131121337166
Encrypted:	false
SSDEEP:	6144:cod6iANBYxOZjTa351MvUn6fJdK0x650hqCsPiTw:BJxy7o8650hsn
MD5:	C9BBAAF891F7586E986B0D62704AC0C2
SHA1:	7BDB0B3EE4653276A286E0E2A9475EF244A9D9A3
SHA-256:	0BB9086A171438BC18C4F6EC5440D36F2F5EAF3664B086A3DCE24C7FF58EC375
SHA-512:	ABDCB7F72B915735A08EB27777DFC024246183715FBC4E1D37516CD37BAD6A7BE13EF77AE7B8B87C0B4C2D6206451B974CAB584AFDC1C4692D4396B49B93E86B
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/js/site/main-customer-accounts-site.js?buildTime=1615232570
Preview:	(function(e){var t={};function n(r){if(t[r])return t[r].exports;var i=t[r]={exports:{},id:r,loaded:false};e[r].call(i.exports,i,i.exports,n);i.loaded=true;return i.exports}n.m=e;n.c=t;n.p="https://cdn2.editmysite.com/js/";n.p="https://"+window.ASSETS_BASE+"/js/"\|\|n.p;return n(0)})([function(e,t,n){e.exports=n(321)},function(e,t,n){var r;!(r=function(){if(window.Weebly!==undefined&&window.Weebly.jQuery!==undefined){return window.Weebly.jQuery}return window.jQuery}.call(t,n,t,e),r!==undefined&&(e.exports=r))},function(e,t,n){var r,i;!(r=[n(1)],i=function(e){window.Weebly=window._W=window._W\|\|{};window._W.utl=window._W.utl\|\|function(e){window._W.failedTls=window._W.failedTls\|\|[];window._W.failedTls.push(e);return e};window._W.ftl=window._W.ftl\|\|function(e){window._W.failedFtls=window._W.failedFtls\|\|[];window._W.failedFtls.push(e);return""};window._W.utl=window._W.utl\|\|function(e){window._W.failedUtls=window._W.failedUtls\|\|[];window._W.failedUtls.push(e);return""};window._W.stl=window._W.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnANW6Cp8[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 16816, version 1.1
Category:	downloaded
Size (bytes):	16816
Entropy (8bit):	7.964169744371369
Encrypted:	false
SSDEEP:	384:9OWQ5QLa70Zbhxyj7fONxITWsc0PN5ojCMhcgD+DTXUjm:cvZ0Zdxyv23GN5ojCMa0m
MD5:	A1CC60361C99F033672F308F0398A6D0
SHA1:	7744101997EAA0C3A8A8CDBA518780FFAE662FA4
SHA-256:	6B7ECCAF20B191C69B769802BD09D73DE2D8133168C94EF482F6B0015946601A
SHA-512:	FE56D94D934DA78821F7256F7294CB5A988652D61500594F0449A4A368345FEF2AF6AFC689EF3A5054333BD762D5B60774203043DAB912429FF5D47BEBA630AF
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrlnANW6Cp8.woff
Preview:	wOFF......A.......].........................GSUB...D...5...6....OS/2...\|...P...`...CSTAT.......:...D.l..cmap.......y...68.<.gasp................glyf......9e..S&X...head..<....6...6.;..hhea..=,.......$....hmtx..=L...@....C.>.loca..>..........>.Emaxp..@H....... ...bname..@d...&...r<p].post..A........ .c.eprep..A.........h...x.c`d``.b0b0a`qq..a.J.,.aPI/J.fP.I,.cPa`a...........:...x.c`a..8.....u..1...<.f........0....@....T..302........G......\|.......:F.U}.ux......P.....BD..........@...I.)l.9..\}.3.Q3...>D.....K..x....XY.E..9.}...m.m.m....N..3...p#.q.0uc.?>.;.M.xo.........H..=.d..=.gb...Zx#\|.>._...O..!....o.....>JJN~....... ....hZ*..#.....t....'Pv!...$o..YI...OJxp....Tt$:....D....Q.(c..~.X.B...b.(.9P...L./....6@1=.TK.M..Fy.U.UE.t.Qge..L7..U.~-...0.Q\.....`G....]\..a...]...4D..d..)y.W9..7..#...X..3...L6.T.L7..3.5K{s,4.\|.,RXQ.,...K-..Jk..........l..f[.U.......U..f6.............x.{.\|.G.....mK.XZ13.%[...8`...v.aj.4i.&...`.r.i..).W....p.=.^.k....Wi...+......;.y".....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrmAB9W6Cp8[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 16904, version 1.1
Category:	downloaded
Size (bytes):	16904
Entropy (8bit):	7.973722875660465
Encrypted:	false
SSDEEP:	384:zu3nOt0wpvccn4u47Q8U8vUQAk57FsHzJ2japGj1FH3yW:zu3neHkc4uAQocQAUaJkzCW
MD5:	4F6A4879558CA07BF08F179B3C82B587
SHA1:	8543507404E4A03F5B5423497F7A5354E2F5CF39
SHA-256:	84C8F09BDEEF4788E949A78C576CED2BE9578CE238FB405D7CAFB03F4484D08B
SHA-512:	30818A225923521152890F85744E607610FD9166095CC6BA1DA307DBEFBE55E2765EFF71D043552E96FC197006CED3DD4D173B7366C71865C0447257B37BD01C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/robotomono/v13/L0xoDF4xlVMF-BfR8bXMIjhOsXG-q2oeuFoqFrmAB9W6Cp8.woff
Preview:	wOFF......B.......^.........................GSUB...D...5...6....OS/2...\|...P...`.&.cSTAT.......7...@...,cmap.......y...68.<.gasp................glyf......9...SN5.+.head..=P...6...6.<..hhea..=........$....hmtx..=....6....:.6.loca..>.............maxp..@........ ...bname..@....-....B.a.post..A........ .c.eprep..B.........h...x.c`d``.b0b0a`qq..a.J.,.aPI/J.fP.I,.cPa`a...........:...x.c`a.......u..1...<.f........0....@....T..3(2........G......\|.......:F.i...x.c`.B..&....0...T..Q..df.$.0r..Y...$.0.0..Q .. ........x....XY.E..9.}...m.m.m....N..3...p#.q.0uc.?>.;.M.xo.........H..=.d..=.gb...Zx#\|.>._...O..!....o.....>JJN~....... ....hZ..#.....t....'Pv!...$o..YI...OJxp....Tt$:....D....Q.(c..~.X.B...b.(.9P...L./....6@1=.TK.M..Fy.U.UE.t.Qge..L7..U.~-...0.Q\.....`G....]\..a...]...4D..d..)y.W9..7..#...X..3...L6.T.L7..3.5K{s,4.\|.,RXQ.,...K-..Jk..........l..f[.U.......U..f6.............x.{.\|\U..;..7o&....o.%...=M%M....[.*..].........wX7..(..,.-..o......O.L...{.{.....E.3.R,U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW-[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 15160, version 1.1
Category:	downloaded
Size (bytes):	15160
Entropy (8bit):	7.965195072524042
Encrypted:	false
SSDEEP:	384:DkyhipCPPEsQPqpfiEAAySk+Py0hdVBOVIr1cofXB2c+T8:D64nEnaeSLPfhPBX6ofXp28
MD5:	0F03F6F8FEDFDF7B895F8E633A76A511
SHA1:	3F1BDD2CB69992C6CBF901C013C80302F4F6D54E
SHA-256:	2DFC0E868CF7AE3A57FC6C7B5C87B0D5685EBF64548430AB41DE99904B01D9B6
SHA-512:	8D32F7C3BE449177008DA6920AA7443E3E68174F5F2222479032CA47A3467B342DDB6D8FBC3A849C3A94B3175C639FFFCA546C95D60F6246053AABEDD7507145
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/robotomono/v13/L0xuDF4xlVMF-BfR8bXMIhJHg45mwgGEFl0_3vq_ROW-.woff
Preview:	wOFF......;8......V.........................GSUB...D...5...6....OS/2...\|...U...`t.QtSTAT.......=...H.p..cmap.......y...68.<.gasp................glyf......2...L...y.head..6....6...6.5..hhea..6........$...hmtx..6....0....U.N.loca..8.............maxp..9........ ...:name..9..../....>._.post..;........ .m.eprep..;0........h...x.c`d``.b0b0a`qq..a.J.,.aPI/J.fP.I,.cPa`a...........:...x.c`a9.8.....u..1...<.f...........A.Hy............../G.....IL.........X.X7..1..o......x.....P.....BDD#.X."..5.....1(,......g.....P..P/:.?....0.O...x....XY.E..9.}...m.m.m....N..3...p#.q.0uc.?>.;.M.xo.........H..=.d..=.gb...Zx#\|.>._...O..!....o.....>JJN~....... ....hZ..#.....t....'Pv!...$o..YI...OJxp....Tt$:....D....Q.(c..~.X.B...b.(.9P...L./....6@1=.TK.M..Fy.U.UE.t.Qge..L7..U.~-...0.Q\.....`G....]\..a...]...4D..d..)y.W9..7..#...X..3...L6.T.L7..3.5K{s,4.\|.,RXQ.,...K-..Jk..........l..f[.U.......U..f6.............x.{.`.G....n....j.Umu7...B1...b.1%..Q..B..H.$...L.....w..{..k....C.w.+V.o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fancybox[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3911
Entropy (8bit):	5.0666543016860475
Encrypted:	false
SSDEEP:	48:MV4jWxgDa+AZ5TvUSoekrDSiqfcoj8cqL54QgP2nuwvn:AeLAjYS9sDCkoj8cq9Xn
MD5:	1DCEBBB5A1EB8B028310CEEB72A339B3
SHA1:	E254B7A35AC189FD1CE9CF8BD78593BEBFE27D7D
SHA-256:	865CB87DE9FC4D6530EDCE21F0103107ABAE6ABE45CABDFF2AD9AF067B3D8E0A
SHA-512:	1FE84409EC4FEAF49C31208668D29F215EA8136EA49134171F4A930963745031520068C0E17783EE557FAE24590B4079E8ECEEB010766466D7C8097AE97F1E53
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/css/old/fancybox.css?1615232570
Preview:	/! fancyBox v2.1.0 fancyapps.com \| fancyapps.com/fancybox/#license /.fancybox-wrap,.fancybox-skin,.fancybox-outer,.fancybox-inner,.fancybox-image,.fancybox-wrap iframe,.fancybox-wrap object,.fancybox-nav,.fancybox-nav span,.fancybox-tmp{padding:0;margin:0;border:0;outline:none;vertical-align:top}.fancybox-wrap{position:absolute;top:0;left:0;z-index:8020}.fancybox-skin{position:relative;background:#f9f9f9;color:#444;text-shadow:none;border-radius:4px}.fancybox-opened{z-index:8030}.fancybox-opened .fancybox-skin{box-shadow:0 10px 25px rgba(0,0,0,0.5)}.fancybox-outer,.fancybox-inner{position:relative}.fancybox-inner{overflow:hidden}.fancybox-type-iframe .fancybox-inner{-webkit-overflow-scrolling:touch}.fancybox-error{color:#444;font:14px/20px "Helvetica Neue",Helvetica,Arial,sans-serif;margin:0;padding:15px;white-space:nowrap}.fancybox-image,.fancybox-iframe{display:block;width:100%;height:100%}.fancybox-image{max-width:100%;max-height:100%}#fancybox-loading,.fancybox-close,.fancybox-pr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\free-footer-v3[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	2633
Entropy (8bit):	5.0358460999390555
Encrypted:	false
SSDEEP:	48:kIGDhDRSDDTUN5D8QSDmvQ53Q3fDTTvArx1qAOY:BUgmGsPTvArx1qAOY
MD5:	B09E83D2AEAC55C0D3B67186CD5009FF
SHA1:	FA87CEC84CC36FC2E70804867DA24578EA331999
SHA-256:	251A983A1B4B2CC76542AA398AE6B3499978A788860B54A8081D35D7A843303C
SHA-512:	3E98FC9895EAA5B9965329A428A9D5EDA04C442C984D1D6F18C8E608D1DD3C740E71CA38F108671CCC828981CF20DEC0FF9ED97E2890744B5C409688962D679A
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/css/free-footer-v3.css?buildtime=1617731700
Preview:	#weebly-footer-signup-container-v3{overflow-y:hidden;font-family:SQMarket-Medium,SQMarket,"Helvetica Neue","Helvetica","Arial",sans-serif;line-height:normal;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale;z-index:1}#weebly-footer-signup-container-v3 .signup-container-header{position:relative;display:block;font-size:14px;height:100%;font-weight:bold;cursor:pointer;text-transform:uppercase;color:white;text-decoration:none}#weebly-footer-signup-container-v3 .signup-container-header .powered-by{position:absolute;top:0;right:0;padding-top:15px;padding-right:30px;height:100%;opacity:1;left:2%}#weebly-footer-signup-container-v3 .signup-container-header .powered-by .link{vertical-align:middle}#weebly-footer-signup-container-v3 .signup-container-header .weebly-icon{display:inline-block;height:23px;width:76px;margin-left:5px;padding-bottom:3px;background-image:url("../images/landing-pages/global/logotype.svg");background-repeat:no-repeat;background-size:contain;filter:bright

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery.pxuMenu[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	3697
Entropy (8bit):	4.707743528907903
Encrypted:	false
SSDEEP:	96:r4QJODZATiN1C81vwuMymZgpqVf9oF2VdP5k6ya/e3Hgqj9DdZda1SO:XJ6ZATiq81vDtNh8dP5k6yAeXgqj9B7Y
MD5:	AC373D716AFE4270DF40F60417B0F418
SHA1:	ABA148148C771BB66B0B4AEAB6EAC8EB40352745
SHA-256:	F75570C56743E8C705CB06F5F1F9B1F8F2CC13119F5E2ACDA2F3BB8D987DE94A
SHA-512:	3FAF2FE9C98144F41A3AB614E23E1D488AAEB2C944A3C736C196C69175C96E4D78D2FD69C0B05A5DDCAAB819C0FCA2BE40DC2C178257E2D0AFA2523072CDA985
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/jquery.pxuMenu.js?1615300395
Preview:	/===================================================.= Weebly Horizontal Site Menu =.===================================================/..(function($) {.. /*. . * Generate a flexible responsive menu from the default navigation templates. . Groups overflowing nav items into a "more" menu item. . /.. var Menu = function(menu, settings) {. this.$menu = $(menu);. this.settings = settings;. this.$more = $('\. <li class="menu-more has-submenu ' + settings.parentClass + '"> \. <a href="#" class="more-link ' + settings.parentLinkClass + '">' + settings.moreLinkHtml + '</a> \. <div class="' + settings.containerClass + '" style="display:none"> \. <ul class="' + settings.listClass + '" data-menu-more /> \. </div> \. </li>');.. this.init();. };.. /*. . * Initialize the menu on load and on resize. . /.. Menu.prototype.init = function() {. var self = this;.. $('body').addClass("mor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery.revealer[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2828
Entropy (8bit):	4.536070396957773
Encrypted:	false
SSDEEP:	48:PTBE0ZpntMb0/6aYkuvll/JGd6vpYQ6Kq3hUyvKrcJcyd6GR4y0IB7KPa0TTM:77ZpntMgSaYDvll/YAvpYjKq31vKrcBH
MD5:	C22AB67199A33D876512504CDA4FF55B
SHA1:	36E96EAE4644B6028532974FE5186A072792CB37
SHA-256:	C4CD233D3D6B0F184E99D5017E521B4C6F9106D3E546864A8BA516189B934311
SHA-512:	9C11487F2A00B4DCA9C04294F4F422AE0DF00828DE989AD64F506446C72E91E64D0B47EC243AE75B3EB88CA5C882E65C9A8F6D99B0C8BED4541F767A3DC1C31B
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/jquery.revealer.js?1615300395
Preview:	/!. Revealer 2.0.0. . Copyright 2015, Pixel Union - http://pixelunion.net. * Released under the MIT license. */.(function($){. // check for trend event (make sure jquery.trend is included). if (typeof $.event.special.trend !== "object") {. console.warn("Please make sure jquery.trend is included! Otherwise revealer won't work.");. }.. // Simple requestAnimationFrame polyfill. var raf = window.requestAnimationFrame \|\|. window.mozRequestAnimationFrame \|\|. window.webkitRequestAnimationFrame \|\|. function(fn) { window.setTimeout(fn, 1000/60); }... // Public API. var methods = {. isVisible: function(el) {. return !!el.data("revealer-visible");. },.. show: function(el, force) {. // Check state. if (methods.isVisible(el)) {. el.removeClass("animating animating-in");. el.off("revealer-animating revealer-show");. return;. }.. // Remove previous event listeners. el.data("revealer-visible", true);. el.off("tre

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\recaptcha__en[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	340168
Entropy (8bit):	5.703235516870462
Encrypted:	false
SSDEEP:	6144:7ZRJlvjuNYVVtwIR5L0saD/hO1g9QLHCKpnsRDCEgd:VlaqVpR5L0d/U1wQLHCSggd
MD5:	990A78DDC8D4AF00B815B22B9FE6969B
SHA1:	2290719554831087C0F44ADD516F80164F76F929
SHA-256:	EC361BCE3349B6CBB5E414DF65C58151BF4AD12078C6FC15FFD9DFFCFBFA92D6
SHA-512:	9460983ABAE455AC0FA39986496A499346D66BC1565DD4B4A1B773DBDA9770D10A8DE65D55FF8A8AAE3ABACB8D398C764EFA8B4DDE30B7693AA1F9B47352706B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/5mNs27FP3uLBP3KBPib88r1g/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var g=function(){return[function(D,Q,n,J,M,O,x,G,z,T,t,l){if(4==(D>>2&((D^284)&(l=[19,3,15],l)[0]\|\|(M=["-checked","-active","-disabled"],O=J.Oj(),O.replace(/\xa0\|\s/g," "),J.S={1:O+M[2],2:O+n,4:O+M[1],8:O+"-selected",16:O+M[0],32:O+"-focused",64:O+Q}),14))){a:{if(1==((x=Q(n\|\|Do,J),T=L[2](l[1],(M\|\|m[29](42,9)).S,"DIV"),G=m[8](8,"error",x),g)[27](l[1],T,G),T.childNodes.length)&&(O=T.firstChild,1==O.nodeType)){z=O;break a}z=T}t=z}return 2==((D\|((D>>2)%l[0]\|\|(J=Q,n.B&&(J=n.B,n.B=J.next,J.next=Q),n.B\|\|.(n.G=Q),t=J),6))%l[2]\|\|(t=typeof J.className==Q?J.className:J.getAttribute&&J.getAttribute(n)\|\|""),D-1&11)&&(M=n.y-Q.y,J=Q.x-n.x,t=[M,J,MQ.x+JQ.y]),t},function(D,Q,n,J,M,O,x,G,z,T,t,l){if(4==(t=[11,1,(2==((D^978)&15)&&(l=/^https:\/\/www.gstatic.c..?\/recaptcha\/releases\/5mNs27FP3uLBP3KBPib88r1g\/recaptcha__.*/),33)],D>>t[1]&15))a:{if(O!=M)switch(O.ER){case J:l=J;break a;case Q:l=Q;break a;case n

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\social-icons[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	13081
Entropy (8bit):	4.750176437112242
Encrypted:	false
SSDEEP:	192:wgRWcfub2DJmUDmDrW4xH3gSJJbfebOQzamKy:q3gSJJbfebOQzamKy
MD5:	4A1BD7B9E8CEF7B84F832DD3420F184D
SHA1:	683A7742F6F80724CE46D8E60F0C0EE70C497B43
SHA-256:	946BEE26321BCE9FBED11A73E4B9B1F3E68249D88890FB2C8FCC96190F620DBA
SHA-512:	A655FCDB66178944C3327524DB4DC0C936C0F92322EC0E9BD0E8214473B9CEC3E96D7794D4388D1C2FEF2E62AA7EF182D9C01F9098DD058602B59BA5961380C7
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/css/social-icons.css?buildtime=1615232570
Preview:	@font-face{font-family:"wsocial";src:url(//cdn2.editmysite.com/fonts/wSocial/wsocial.eot?ts=1617136594311);src:url(//cdn2.editmysite.com/fonts/wSocial/wsocial.eot?ts=1617136594311#iefix) format("embedded-opentype"),url(//cdn2.editmysite.com/fonts/wSocial/wsocial.woff?ts=1617136594311) format("woff"),url(//cdn2.editmysite.com/fonts/wSocial/wsocial.ttf?ts=1617136594311) format("truetype"),url(//cdn2.editmysite.com/fonts/wSocial/wsocial.svg?ts=1617136594311#wsocial) format("svg");font-weight:normal;font-style:normal}.wsite-social-dribbble:before{content:"\e60c"}.wsite-com-product-social-dribbble:before{content:"\e60c"}.wsite-social-color .wsite-social-dribbble:before{content:"\e60c";color:#f077a0}.wsite-social-square .wsite-social-dribbble,.wsite-social-square.wsite-social-dribbble{background-color:#f077a0}.wsite-social-square .wsite-social-dribbble:after,.wsite-social-square.wsite-social-dribbble:after{content:"\e60c";color:#ffffff}.wsite-social-mail:before{content:"\e603"}.wsite-com-pro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\J3GPWO06.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	30514
Entropy (8bit):	5.369422349333862
Encrypted:	false
SSDEEP:	768:NIRIOITIwIgIiKZgNDfIwIGI5IVJ7SqIRIOITIwIgIiKZgNDfIwIGI5IVJ7SZHkD:NIRIOITIwIgIiKZgNDfIwIGI5IVJ7Sqn
MD5:	308B5AC086FDA521FC76DE21B6161B93
SHA1:	F7AF314C513A27F821755CDA53FC8FFB7BDA0F47
SHA-256:	5455B265B89D75207710DC2D451F5243148AC5772B564E455035184E1F6EAF41
SHA-512:	7960BBEAA28B17F155C11622F0AF531223CD295C882D8C1F7A7A2282CCEB7D5B3E58DC9B5470A9EC3D7E3EC9DBF9D4713401F7D3049631AB8F999F31CDF89AF8
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\J3GPWO06.htm, Author: Joe Security
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/
Preview:	<!DOCTYPE html>.<html lang="en">..<head>...<title>Sign in to your microsoft</title><meta property="og:site_name" content="" />.<meta property="og:title" content="Sign in to your microsoft" />.<meta property="og:description" content="" />.<meta property="og:image" content="https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hjfhhjf_orig.png" />.<meta property="og:image" content="https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hhhjfhdhjfhfjkvv-ll_orig.png" />.<meta property="og:url" content="https://msoffice506.weebly.com/" />....<meta http-equiv="Content-Type" content="text/html; charset=utf-8"/>. <meta name="viewport" content="width=device-width, initial-scale=1.0"/>.. <link href="//fonts.googleapis.com/css?family=Karla:400,700\|Oswald:700\|Roboto+Mono:400,400i,700,700i" rel="stylesheet">. <script src="/files/theme/MutationObserver.js"></script>. <style>. .navbar__logo .icon,. .navbar__center .navbar__logo:after {. color: #2990ea !important;. }.. .hea

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\custom-1[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	15719
Entropy (8bit):	4.6676143215770685
Encrypted:	false
SSDEEP:	384:W+1SbYbddF3bbO0ELZZRZpq0hPvF6b1yX:W+1SbYbddFLilTZpq0VF6b1M
MD5:	214DDE43CEBF15418CDCC76F9677EE46
SHA1:	6E93ACEBFA271D3FCE9626034D03F942D3B628A8
SHA-256:	CFBF67A85C039719090CFF2C4718DE99203B1CED78CFB8FAE5F7240D2F1570B7
SHA-512:	129ED41723FA08403F686DFCCABCF4F2AAB7DDABD0C1802CE52012EA88BF2CB1BC284019179749597A10ACDB4F02B154E89249A14421329EF28B30506A1A8EE8
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/custom-1.js?1615300395
Preview:	jQuery(function($) {.. // Mobile sidebars. $.fn.expandableSidebar = function(expandedClass) {. var $me = this;.. $me.on('click', function() {. if(!$me.hasClass(expandedClass)) {. $me.addClass(expandedClass);. } else {. $me.removeClass(expandedClass);. }. });. }.. // Interval loop. $.fn.intervalLoop = function(condition, action, duration, limit) {. var counter = 0;. var looper = setInterval(function(){. if (counter >= limit \|\| $.fn.checkIfElementExists(condition)) {. clearInterval(looper);. } else {. action();. counter++;. }. }, duration);.. if (!condition) action();. }.. // Check if element exists. $.fn.checkIfElementExists = function(selector) {. return $(selector).length;. }.. $.fn.hideDropdowns = function(dropdownClass) {. this. .removeClass(dropdownClass). .find('.wsite-menu-wrap'). .revealer('hide'). .find('.' + dropdownClass). .removeClass(dropdownClass);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\footer-toast-published-image-1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 199 x 97, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	9677
Entropy (8bit):	7.970815897911816
Encrypted:	false
SSDEEP:	192:GVd97ZFfQoDBbxIkFUD/QCEVlcTE85PlcBz6nH89KCCotHkXKp67mkz:KH7ZZDBbKYFHQcFca+x7Pz
MD5:	6E0F7AD31BF187E0D88FC5787573BA71
SHA1:	14E8B85CC32A01C8901E4AC0160582D29A45E9E6
SHA-256:	580EF6409E067A4EC4A427400C7D6216184869E2DA53343DF20753CC1F8A46CD
SHA-512:	A7078CAC9A5319904CB47E01A426EAE30A26D4AF5094438F41360396C280473B9C69748B7E7A603232DA9B6D0F7297FEFB04C434EB8098CC6F89F7183C44AB52
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/images/site/footer/footer-toast-published-image-1.png
Preview:	.PNG........IHDR.......a.....U.E.....PLTE................................."""..................$$$...&&&.......................................(((.....................................................................999...........}}}......222///......EEE.....Z6)...ooo.................ZZZ..........{.y[**......R<....................................mU3&....................IJIK+............sF3....Q0#............xrqr.o}M8........ttt^;.............tV.jLBBB.Z@,,,.~`OOO==<mB0..........s.}s666e=-B%....mN.fJxJ6..h..d.pd.qUSST..~aA4444......z.gX.VB.............xogffbbdXWWzcV??>............u^^^.......tfs\PrVG.aEkNA&..........U<K5+8..0.............~.k];;;.......lll.mX........{k_.^LS=3HI1!.(..........yxx][:D-$..............miA...xjrcZeI;5:......:( ~vL.......i.sh..].......j.........".IDATx..ml.q..uw......\......N...,-....(..[_0}AR...1..QZ.m:...TB......!C:.)...../....v5.o}.._....?....k'..?....s..e...&'.....(..#.$....(..x.i.X!..g....5<D\.lp..0.a.5...z.....t.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\hjfhhjf_orig[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 905 x 141, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	168310
Entropy (8bit):	7.993125246895629
Encrypted:	true
SSDEEP:	3072:3HK3beoWSLCC5mW9lzDyzIbAw8QLnvhk1XrTUXzTD59EP9:3HK3jLCcH2xYGNr0/5i9
MD5:	224A23F96BF556392B4C1F120A74ED88
SHA1:	B0097C5A161F480803C5841E5EE780730FA25B80
SHA-256:	9702A85CC3200BE40501D8A421BD7EED64E8484D1178C2DE1A9B8463BCE747A5
SHA-512:	4453D59D303D6E54F8089A98124BFA37BCADDD3F89AA15879070F1C03AD59E77B88E65F4B12F67DB27F79ADD42CB9BEF4A66CF9CE8CD733600B6613242AEBEFA
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/uploads/1/3/6/6/136605011/hjfhhjf_orig.png
Preview:	.PNG........IHDR..............W?.....gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD..............pHYs..........o.d....orNT..w.....IDATx...I.m.u&.}...Nu..W.\|,E...RH.....(...{.;.a.<...p.-..7l.p...TI..C.X....[.S...70+`a.K.c7.z.<....011.oNL..s..................................\|q}q}q}q}q}q}q}q}q}q}q}q}q.....vv2........9.9..H).9......;..K...s..ak.......U..9 gh.3..g....\|...c.....8...Q.@.....D.v..a.{.w.1...A..+..G.j.[..q..U.;..U....6x^R..@..)gx..3g.C.B.jn.C..p.t;..}.rO..)Q..r\|E...-.k>.$..H..(.di.R$^....<.\v..@.s.9'.. >,.\|5.g..,.3.[~.v...c.gl;...s..u.Px.....a@...R2..e..L)!.....R...w0L.]Y..gD^..........9e....+.MYy......{9g......0..0...>s.si.:.....R..k...8b6..?F3Vo.<..{._...2\|..d.'.K..Px^./.2....?....c9'x.x..z.9.D......7..F&z....x.h-:...I#.x..y.V...S".&,;2 ..@..V....o\|.w....u...=b*2..:c.L...t.../z.P.t.......O.u.@y.+.{.A..p.,g..Fv.......==..Y.7...{.g)q_Y.8.%.v.}.L.....Y.c....Z.Ya..1.L....>H...@..~M...pk.X....2..dG.\u...?..3._..+.af...g..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\jquery.trend[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3775
Entropy (8bit):	4.568691852261433
Encrypted:	false
SSDEEP:	96:UgGKAtQ3k/GNXl2a4GzkNGSmT6xJ5orONPv:zGKAtQ3Lh0FGzvTmJv
MD5:	4BECCEBE0A060B2B2C43DE5C2D4512EF
SHA1:	250A779DD017877B9F360B264CF072D9E87974FF
SHA-256:	446F48F512ECC0B771AF3C21A3036DE3A1C5740D1E6BDBB61448834326D0C738
SHA-512:	09CC7F6AC18777399DCFBC22EA9069779C0D8193A269F672B62D738B79B6EF72AE4A30BD85D111D0E03E9FBA29387B9A91AB6D925F0324D764A27C6416FC5288
Malicious:	false
Reputation:	low
IE Cache URL:	https://msoffice506.weebly.com/files/theme/jquery.trend.js?1615300395
Preview:	/!. Trend 0.2.0. . Fail-safe TransitionEnd event for jQuery.. . Adds a new "trend" event that can be used in browsers that don't. * support "transitionend".. . NOTE: Only supports being bound with "jQuery.one".. . Copyright 2014, Pixel Union - http://pixelunion.net. * Released under the MIT license. */.;(function($){.. // Prefixed transitionend event names. var transitionEndEvents =. "webkitTransitionEnd " +. "otransitionend " +. "oTransitionEnd " +. "msTransitionEnd " +. "transitionend";.. // Prefixed transition duration property names. var transitionDurationProperties = [. "transition-duration",. "-moz-transition-duration",. "-webkit-transition-duration",. "-ms-transition-duration",. "-o-transition-duration",. "-khtml-transition-duration". ];.. // Prefixed transition delay property names. var transitionDelayProperties = [. "transition-delay",. "-moz-transition-delay",. "-webkit-transition-delay",. "-ms-transition-dela

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\main[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	477188
Entropy (8bit):	5.418692299539293
Encrypted:	false
SSDEEP:	6144:wW8OfwjsL0W6FYEeiFzRNIHftOma4kbEamIia49AnbViWMXb9Mv:jfwja+yU49An5iWOq
MD5:	09D4CB03BE0267ECBEB4AE8DDD487B62
SHA1:	109EB8B9389CA7CE01DC4E2359202499FFC40CFE
SHA-256:	19B90311DBAD1482704DC6F2FBADA9D7511050FA296C5205CD8AB5D0D7F7CAC6
SHA-512:	7BE777A776170447A8495032F8B7AAC0C8A394E0DF5CC23A09A4385632CBE286A41DE6D053A5401A77C487528A2CC08347375924897E9345ED34590485B01ABD
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/js/site/main.js?buildTime=1615232570
Preview:	(function(e){var t=window["publishedWBJP"];window["publishedWBJP"]=function o(s,a){var l,u,c=0,d=[];for(;c<s.length;c++){u=s[c];if(n[u])d.push.apply(d,n[u]);n[u]=0}for(l in a){if(Object.prototype.hasOwnProperty.call(a,l)){e[l]=a[l]}}if(t)t(s,a);while(d.length)d.shift().call(null,r);if(a[0]){i[0]=0;return r(0)}};var i={};var n={2:0};function r(t){if(i[t])return i[t].exports;var n=i[t]={exports:{},id:t,loaded:false};e[t].call(n.exports,n,n.exports,r);n.loaded=true;return n.exports}r.e=function e(t,i){if(n[t]===0)return i.call(null,r);if(n[t]!==undefined){n[t].push(i)}else{n[t]=[i];var o=document.getElementsByTagName("head")[0];var s=document.createElement("script");s.type="text/javascript";s.charset="utf-8";s.async=true;s.src=r.p+""+{11:"5ab2b9565867ea666fb8",12:"60674f059d0596a99cd0",13:"5ee175e99179c4fffbe4",14:"7bade6d1e461dceb361e",15:"b6353cc0e423d7a50e8c",16:"054f225d281471b09455",17:"15d444be9354963ed484",18:"afaef63f10fcebc93d78"}[t]+".js";o.appendChild(s)}};r.m=e;r.c=i;r.p="http

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaHUlM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 16836, version 1.1
Category:	downloaded
Size (bytes):	16836
Entropy (8bit):	7.964358790587357
Encrypted:	false
SSDEEP:	384:EPfhRZeGrrC/TtyTrlHh42xMzYJ1sES+wNZvl1:EPfbgGvC/Ttol62xMcAj
MD5:	06D6D35949A50C1BF5422AA4D0673375
SHA1:	C69691EA2AC85EE808436FC94D3D50B48BD701D2
SHA-256:	6023B778EBBF9E20115974FBDEC5780D569829D3C3ED6229EE408A804F17D8C6
SHA-512:	735028D258739D34C71B0D2DA5E7D568CAC7A3669DA650AC3D6699A89B7E7466B5C6FCF5EB13CA8A486D37C369B3E8121B5EF72A91FF2074FFB0E245BFF5E719
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTD-JqaHUlM.woff
Preview:	wOFF......A.......iH........................GDEF...l.......&,.$.GPOS...0...d....N.'.GSUB.............8..OS/2...d...Y...`tMExSTAT.......=...L....cmap.......}.......gasp................glyf......0`..O..).head..9....6...6.=.zhhea..: ... ...$...)hmtx..:@...D...8...Bloca..=.........T.@.maxp..@\|....... ....name..@........"3[U.post..A........ ...2prep..A.........h...x.-.B.....s..-.vS..lOYs.1l.5...%.[..?.. .........8(....B..B.,G.lF......\.....<.<..V....Ox..J..?..iIk.HG....~ .. ....%c.+.. S....-s.'.X$KX.kX/..{.+.8..8...fp...3:....h6b.m..... ...D".x.}...\Q.E.}..3...Om..j..m....j{..v.",...+.......9.\.I.....f-ZuR...F(Y...n...3B.x6......D..F.tDa..{}.W.T.c...id.^f..e..m.9g.....qF93.y..g..6.(.KD79.Id.....P.2..,....\|Y*...\|9....U-.V...PS.m...).s/...A.d....^.h..(.'.MtH.J...^W:..l.[....0.\|..G......g...trA.C......#<.h.;.(...ak..N..v.. .Ag.$..y....yP.D...........g.~.:..}D.m.....H2..Mc7.A./.=..s.N.n..C..~2Aj0e5......x..?.\.6..es.6.......q........zh......t...........:D..E.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aHUlM[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 16908, version 1.1
Category:	downloaded
Size (bytes):	16908
Entropy (8bit):	7.974177301495417
Encrypted:	false
SSDEEP:	384:pmLjkSQ9NORNZ6I6icZU5KFUxm/1smC1z15dqRBM5RHG:ofnQ9QRjl6RTUxi1srz1/iBiZG
MD5:	ACC86FB2D8D0E9EE4E358D53DC9BFBB9
SHA1:	693BF5A230867D4258A6135E879A755F33CD92CE
SHA-256:	E321BC5A23D86675146B809421106E0EB21A1E374E6D1141FAA7C3386B5BD9D8
SHA-512:	2EDC6531084B7C0F674E3FBD091197C78CE6AF88C62A4ED56401D968F4E1579C08024AF40D88D7162B3F4E8688A2151FA8CEECEC853DCB36A62BDBB5B2D60CCF
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBIXvYC6trAT55ZBi1ueQVIjQTDH52aHUlM.woff
Preview:	wOFF......B.......i`........................GDEF...l.......&,w$.GPOS...0...o....N ".GSUB.............8..OS/2...p...X...`uyEXSTAT.......>...L.Q. cmap.......}.......gasp................glyf......0...O..{..head..:8...6...6.>.zhhea..:p... ...$...)hmtx..:....;...8p..Cloca..=.........`wL.maxp..@........ ....name..@.........0]R.post..A........ ...2prep..B.........h...x.-.3@.....{..-.vS...Zss....>.}.K......y.a.....=...NI....d..e).e#Ze......,........!........\|.\|S._..?.HsZJ{...t.^...G?..`.....h..8..T..L......Y.RY.Z..f..v..>9...V0...@... .@.].\......_..#@x.}....a...?....g..m.m...7..M..A..A._.....sq.dd$.([e..k.."...7B..K^........ID..!2.....5.c..^...xL..6.L-...2S.,...2...s.<6..N.g.3..,qV9/......._.(Jy..X.P.r...<....<...JR%UV.....QS..PU.K._5...!s..."...!..G.D.....V>.\1.T.Z...J......ly...+#/l..o...l,.}.{.....U4..GPt.L....w.o.....T.I.1..do...L~..?3.P;C...w.....G.G..~.. .Iy...\r.A.@......d........$/^..3..*3....%...S.\|..H.....Dl2H'.Am&.Y.. .\.7T...Q...6....m%.a."6

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\qkBKXvYC6trAT7RQNNK2EG7SIwPWMNlCV3lGb7U[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 17380, version 1.1
Category:	downloaded
Size (bytes):	17380
Entropy (8bit):	7.967431465079427
Encrypted:	false
SSDEEP:	384:ULIgsw6kfhCXlGWcTFao44zXaDwnDhKcQ0svQi/aIWPCWa+M06MJh:Spsw6IYlmTFaNc6uDhK8svQuaX6boJh
MD5:	47242894FDCE6238F8C9A86F1253BF8E
SHA1:	EB47032AF64B6735C115B6CEC9D296EA650BBFE9
SHA-256:	2B0C28A0FA7CD0B83ACEB02E12D8607BF045C4B06D734C06BC0D4F5F1B215540
SHA-512:	B0D662E820E04772644D44230F8A6BCFCD0313EA2C60CD00ACEA93FD700FB2909A9FC76A743ECF70AD7F146D568A0CF347942C05981645726F1D246C31551FB8
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNlCV3lGb7U.woff
Preview:	wOFF......C.......hX........................GDEF...l........#.&6GPOS...$...q.....h.QGSUB...............-OS/2.......]...`tPE?STAT.......=...H....cmap...T...}.......gasp................glyf......2...N...E^head..;....6...6....hhea..<$...#...$.+.jhmtx..<H...g...8...ploca..?..........[.lmaxp..B........ ....name..B........./3Ospost..C........ ...2prep..C.........h...x...1.A........y.ldT."..dOY....d6.-..(.>.nP2I......~.. .R.....#A..o...]..k6v...9.#g{.joN.y.'/.v...O E..I%....e........-.l+..j...m.e...zv...hbgZ .... .o.......J...>..c.....!....x.}....A....}....}....5..m.EP...v..oXn.l.5..?s...Y.I1..z.M.nJ.?u.....;a.R.&I.Sf..q..%..5.f.....Vh...n.B.j<.d.L..1.L...L23."...0..M..c>{..A..o.7.[.=/.V.].......IIJV..M..PP....\|....Z..l6..<5T........jb7...s.R.K.V...k..}..E(.....U*1.5H.......2G..!N....>f..3.h."U{I.r.!.9Gs......,s.Md..~+`3`.`~.V..P...........F...7e......R..xE].....D9.rCM....;>R.........P.\|....%@.>......+.J.,..D.sg.1....rc.....P...qC.)!5...8y..=l....aC.5rn.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\qkBKXvYC6trAT7RQNNK2EG7SIwPWMNmlUHlGb7U[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 17652, version 1.1
Category:	downloaded
Size (bytes):	17652
Entropy (8bit):	7.968434231204158
Encrypted:	false
SSDEEP:	384:+Ngsw3AALigI3iywXYPYSP69b2D9OTT12uyNR:+OswQ+irivYPYSYGQ+X
MD5:	43E4351B978AC9A34431E049161EFC37
SHA1:	5CF5B1069188B228AB94DE4EBC947C9F41376187
SHA-256:	76710356049BECC409C017835AB6E8B4E4A33C7BEDE1E72EBF02C0FE53E8E291
SHA-512:	1306906AF5F2280C2B3A93E4E3AE81E2F3D0D4AC018AA2425BA6892CDC6F98ABC31921AF1228A8FFB09CF28BF8B83BFCC0A951867527358CD65EF98F69A8E72A
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/karla/v15/qkBKXvYC6trAT7RQNNK2EG7SIwPWMNmlUHlGb7U.woff
Preview:	wOFF......D.......h\|........................GDEF...l........#.&.GPOS...$...q.....h.QGSUB...............-OS/2.......\...`u\|E_STAT.......=...H.I.!cmap...P...}.......gasp................glyf......3...N...B.head..<....6...6....hhea..=(...#...$.+.jhmtx..=L...j...8...loca..@..........\|..maxp..C........ ....name..C........04BS.post..D........ ...2prep..D.........h...x...1.A........y.ldT."..dOY....d6.-..(.>.nP2I......~.. .R.....#A..o...]..k6v...9.#g{.joN.y.'/.v...O E..I%....e........-.l+..j...m.e...zv...hbgZ .... .o.......JG..>..c...61!r...x.}....A....}....}....5..m.EP...v..oXn.l.5..?s...Y.I1..z.M.nJ.?u.....;a.R.&I.Sf..q..%..5.f.....Vh...n.B.j<.d.L..1.L...L23."...0..M..c>{..A..o.7.[.=/.V.].......IIJV..M..PP....\|....Z..l6..<5T........jb7...s.R.K.V...k..}..E(.....U*1.5H.......2G..!N....>f..3.h."U{I.r.!.9Gs......,s.Md..~+`3`.`~.V..P...........F...7e......R..xE].....D9.rCM....;>R.........P.\|....%@.>......+.J.,..D.sg.1....rc.....P...qC.)!5...8y..=l....aC.5rn.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\WJ8I2OL4\stl[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	168734
Entropy (8bit):	5.0629526940132665
Encrypted:	false
SSDEEP:	3072:b658IV7udvsVWO97/ZoIdrvrgc5/f2XP4mTieamfKqz0/pvlU+571iiNbAylRXrf:084qvRG
MD5:	F6966E6E2BBFC8F13AE3646A7DC08AB8
SHA1:	5998F72D5A74820F67A99F7B6A8BAB7FB5D95F9A
SHA-256:	95B22A3AFA640CA60372A7B0D9318F3F4E66FDD83DFC62150EB6992C05E9B570
SHA-512:	C8987FA44376C4085D4046D36C78CBC2A62569995DF7D4F622E3C906FA0B842C54DD6DCF480FB320622857FEA25ACFBCFAFB2889DE0BB0DBFFB1B3D5BA8CBCFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn2.editmysite.com/js/lang/en/stl.js?buildTime=1615232570&
Preview:	.window._W = window.Weebly = window.Weebly \|\| {};._W.getSiteLanguageURL = function(lang){..return '//cdn2.editmysite.com/js/lang/%lang%/stl.js?buildTime=1234&'.replace('%lang%', lang);.}._W.tli=function(s){return s;}._W.siteLang = 'en';._W.ftl=_W.stl=(function() {..var f = function(s) {...var t = tls[s] \|\| s;...var a = Array.prototype.slice.call(arguments, 1);...for (var i = 0; i < a.length; i++) {....t = t.split('{{'+i+'}}').join(a[i]);...}......return t ? t.replace(/^\\s(.+?)\\s$/, '$1') : s;..},..tls = JSON.parse('{\"theme.details\":\"Details\",\"theme.subtotal\":\"Subtotal\",\"theme.checkout\":\"Checkout\",\"theme.readNow\":\"Read Now\",\"theme.backToBlog\":\"Back to Blog\",\"theme.share\":\"Share\",\"theme.description\":\"Description\",\"theme.qty\":\"Qty\",\"templates.elements.cookie-opt-out.disclaimer\":\"This website uses marketing and tracking technologies. Opting out of this will opt you out of all cookies, except for those needed to run the website. Note that some products

C:\Users\user\AppData\Local\Temp\~DF319CEFDB770DE62E.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	35391
Entropy (8bit):	0.4930825056975906
Encrypted:	false
SSDEEP:	48:kBqoxKAuvScS+ub5uLupuYuUIuUkkUWWZWwWNFWwWVWLWIWK0Q5erwH2:kBqoxKAuvScS+S0e3EowAQ5erwW
MD5:	EA9CE530AC66116F6E2DC25E4BF50F23
SHA1:	AE393B7E964D72211A5A9559CEA38D3D55662024
SHA-256:	C63FBC9105113FD5F0916C2F1DC0B898B114D379AAD7AA23A72B994DFC885133
SHA-512:	CC9837F668ED599329267E7F6998A62BDC6F52535A31326E6889BA928B1DDE8B7724173840A290A8865EA2A11E4308412D7E1AB3343F9925A0A1F477E06E9A78
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF4850F0FA0D4B6F93.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.4825699776892908
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lo2F9lo69lWbPj4Wt:kBqoIVDbPj46
MD5:	92BE8E59C2B8F91EA7EB56C9CC995613
SHA1:	7A5721F74FAD190501A3F7065BAED7AE62FE39E9
SHA-256:	1CB743C9FA9F85AE6CA29B335770FF749254DFEBC2297510B90F714D4A225E32
SHA-512:	675B2C6BF4497CBAF36BAB9018A62B80BC71ECAF2008B1D8E29CD20B02DC3371889D7EE135EFDCE0A819C1BD6090805182C0AA42C479EDDF51132C5632E6E736
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFE6847D51F5B54A46.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.27918767598683664
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA:kBqoxxJhHWSVSEab
MD5:	AB889A32AB9ACD33E816C2422337C69A
SHA1:	1190C6B34DED2D295827C2A88310D10A8B90B59B
SHA-256:	4D6EC54B8D244E63B0F04FBE2B97402A3DF722560AD12F218665BA440F4CEFDA
SHA-512:	BD250855747BB4CEC61814D0E44F810156D390E3E9F120A12935EFDF80ACA33C4777AD66257CCA4E4003FEF0741692894980B9298F01C4CDD2D8A9C7BB522FB6
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 03:41:38.075198889 CEST	49681	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.075787067 CEST	49682	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.244446039 CEST	80	49681	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.244575977 CEST	49681	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.245099068 CEST	49681	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.246160984 CEST	80	49682	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.246258974 CEST	49682	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.412767887 CEST	80	49681	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.424474955 CEST	80	49681	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.424750090 CEST	49681	80	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.435415983 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.606342077 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.606570005 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.618825912 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.789958000 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.797904968 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.797949076 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.797996998 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.798027039 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.798051119 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:38.798151016 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.798203945 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.838263035 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:38.844000101 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.009366035 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.015021086 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.017755032 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.017914057 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036153078 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036189079 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036299944 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036355972 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036552906 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036593914 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036632061 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036637068 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036659002 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036664009 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036704063 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036704063 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036720991 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036730051 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036767006 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036786079 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036793947 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036808014 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036830902 CEST	443	49683	199.34.228.54	192.168.2.3
Apr 8, 2021 03:41:39.036850929 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.036892891 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.090008020 CEST	49683	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.114470959 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.115101099 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.116473913 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.116498947 CEST	49687	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.126650095 CEST	49688	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.130178928 CEST	443	49684	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.130270958 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.130723953 CEST	49689	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.130902052 CEST	443	49685	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.130984068 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.131278992 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.131865978 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.132046938 CEST	443	49686	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.132194996 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.132909060 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.136610985 CEST	49693	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.137517929 CEST	49694	443	192.168.2.3	199.34.228.54
Apr 8, 2021 03:41:39.141019106 CEST	49695	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.142934084 CEST	443	49688	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.143085957 CEST	49688	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.146321058 CEST	443	49689	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.146431923 CEST	49689	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.146985054 CEST	443	49684	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.147485971 CEST	443	49685	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148365021 CEST	49688	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148468018 CEST	443	49684	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148540974 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148552895 CEST	443	49684	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148595095 CEST	443	49684	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148617983 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148633957 CEST	443	49685	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148652077 CEST	49684	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148674965 CEST	443	49685	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148705006 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148709059 CEST	443	49685	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.148734093 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148758888 CEST	49685	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.148794889 CEST	443	49686	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.149101973 CEST	49689	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.149494886 CEST	443	49686	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.149584055 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.149667025 CEST	443	49686	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.149698973 CEST	443	49686	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.149733067 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.149745941 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.156728029 CEST	443	49695	151.101.1.46	192.168.2.3
Apr 8, 2021 03:41:39.156883955 CEST	49695	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.157993078 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.158576012 CEST	49686	443	192.168.2.3	151.101.1.46
Apr 8, 2021 03:41:39.158654928 CEST	49686	443	192.168.2.3	151.101.1.46

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 8, 2021 03:41:37.017906904 CEST	54260	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:37.035890102 CEST	53	54260	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:38.028613091 CEST	51904	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:38.046602964 CEST	53	51904	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:39.093512058 CEST	61328	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:39.097233057 CEST	54130	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:39.110682964 CEST	53	54130	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:39.130095005 CEST	56961	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:39.132358074 CEST	53	61328	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:39.156352997 CEST	53	56961	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:39.864137888 CEST	59353	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:39.877500057 CEST	53	59353	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:40.484689951 CEST	52238	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:40.510266066 CEST	53	52238	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:40.618218899 CEST	49873	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:40.630610943 CEST	53	49873	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:41.289988995 CEST	53196	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:41.295608997 CEST	56777	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:41.303016901 CEST	53	53196	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:41.321353912 CEST	53	56777	8.8.8.8	192.168.2.3
Apr 8, 2021 03:41:57.361506939 CEST	58643	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:41:57.376612902 CEST	53	58643	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:07.014714003 CEST	60985	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:07.024045944 CEST	50200	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:07.027715921 CEST	53	60985	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:07.063182116 CEST	53	50200	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:07.672159910 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:07.685080051 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:08.018984079 CEST	60985	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:08.032037973 CEST	53	60985	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:08.675615072 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:08.689028978 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:09.034805059 CEST	60985	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:09.047734976 CEST	53	60985	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:09.727957010 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:09.740789890 CEST	53	51281	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:11.067420959 CEST	60985	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:11.081619024 CEST	53	60985	8.8.8.8	192.168.2.3
Apr 8, 2021 03:42:11.738076925 CEST	51281	53	192.168.2.3	8.8.8.8
Apr 8, 2021 03:42:11.750973940 CEST	53	51281	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 8, 2021 03:41:38.028613091 CEST	192.168.2.3	8.8.8.8	0xea01	Standard query (0)	msoffice506.weebly.com	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:39.097233057 CEST	192.168.2.3	8.8.8.8	0x120	Standard query (0)	cdn2.editmysite.com	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:41.289988995 CEST	192.168.2.3	8.8.8.8	0xb6c6	Standard query (0)	ec.editmysite.com	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:57.361506939 CEST	192.168.2.3	8.8.8.8	0xa172	Standard query (0)	msoffice506.weebly.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 8, 2021 03:41:38.046602964 CEST	8.8.8.8	192.168.2.3	0xea01	No error (0)	msoffice506.weebly.com	pages-wildcard.weebly.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 03:41:38.046602964 CEST	8.8.8.8	192.168.2.3	0xea01	No error (0)	pages-wildcard.weebly.com		199.34.228.54	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:38.046602964 CEST	8.8.8.8	192.168.2.3	0xea01	No error (0)	pages-wildcard.weebly.com		199.34.228.53	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:39.110682964 CEST	8.8.8.8	192.168.2.3	0x120	No error (0)	cdn2.editmysite.com	weebly.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 03:41:39.110682964 CEST	8.8.8.8	192.168.2.3	0x120	No error (0)	weebly.map.fastly.net		151.101.1.46	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:39.110682964 CEST	8.8.8.8	192.168.2.3	0x120	No error (0)	weebly.map.fastly.net		151.101.65.46	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:39.110682964 CEST	8.8.8.8	192.168.2.3	0x120	No error (0)	weebly.map.fastly.net		151.101.129.46	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:39.110682964 CEST	8.8.8.8	192.168.2.3	0x120	No error (0)	weebly.map.fastly.net		151.101.193.46	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:41.303016901 CEST	8.8.8.8	192.168.2.3	0xb6c6	No error (0)	ec.editmysite.com	sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 03:41:41.303016901 CEST	8.8.8.8	192.168.2.3	0xb6c6	No error (0)	sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com		44.241.55.43	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:41.303016901 CEST	8.8.8.8	192.168.2.3	0xb6c6	No error (0)	sp-2020021412301152490000000a-1069308460.us-west-2.elb.amazonaws.com		52.11.37.142	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:57.376612902 CEST	8.8.8.8	192.168.2.3	0xa172	No error (0)	msoffice506.weebly.com	pages-wildcard.weebly.com		CNAME (Canonical name)	IN (0x0001)
Apr 8, 2021 03:41:57.376612902 CEST	8.8.8.8	192.168.2.3	0xa172	No error (0)	pages-wildcard.weebly.com		199.34.228.53	A (IP address)	IN (0x0001)
Apr 8, 2021 03:41:57.376612902 CEST	8.8.8.8	192.168.2.3	0xa172	No error (0)	pages-wildcard.weebly.com		199.34.228.54	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

msoffice506.weebly.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.3	49681	199.34.228.54	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Apr 8, 2021 03:41:38.245099068 CEST	179	OUT	GET / HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: msoffice506.weebly.com Connection: Keep-Alive
Apr 8, 2021 03:41:38.424474955 CEST	180	IN	HTTP/1.1 301 Moved Permanently Date: Thu, 08 Apr 2021 01:41:38 GMT Server: Apache Set-Cookie: is_mobile=0; path=/; domain=msoffice506.weebly.com Vary: X-W-SSL,User-Agent Cache-Control: no-cache Location: https://msoffice506.weebly.com/ X-Host: pages31.sf2p.intern.weebly.net X-UA-Compatible: IE=edge,chrome=1 Content-Length: 368 Keep-Alive: timeout=10, max=73 Connection: Keep-Alive Content-Type: text/html; charset=UTF-8 Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 20 20 20 20 3c 68 65 61 64 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 55 54 46 2d 38 22 20 2f 3e 0a 20 20 20 20 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 72 65 66 72 65 73 68 22 20 63 6f 6e 74 65 6e 74 3d 22 31 3b 75 72 6c 3d 68 74 74 70 73 3a 2f 2f 6d 73 6f 66 66 69 63 65 35 30 36 2e 77 65 65 62 6c 79 2e 63 6f 6d 2f 22 20 2f 3e 0a 0a 20 20 20 20 20 20 20 20 3c 74 69 74 6c 65 3e 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 68 74 74 70 73 3a 2f 2f 6d 73 6f 66 66 69 63 65 35 30 36 2e 77 65 65 62 6c 79 2e 63 6f 6d 2f 3c 2f 74 69 74 6c 65 3e 0a 20 20 20 20 3c 2f 68 65 61 64 3e 0a 20 20 20 20 3c 62 6f 64 79 3e 0a 20 20 20 20 20 20 20 20 52 65 64 69 72 65 63 74 69 6e 67 20 74 6f 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 6d 73 6f 66 66 69 63 65 35 30 36 2e 77 65 65 62 6c 79 2e 63 6f 6d 2f 22 3e 68 74 74 70 73 3a 2f 2f 6d 73 6f 66 66 69 63 65 35 30 36 2e 77 65 65 62 6c 79 2e 63 6f 6d 2f 3c 2f 61 3e 2e 0a 20 20 20 20 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e Data Ascii: <!DOCTYPE html><html> <head> <meta charset="UTF-8" /> <meta http-equiv="refresh" content="1;url=https://msoffice506.weebly.com/" /> <title>Redirecting to https://msoffice506.weebly.com/</title> </head> <body> Redirecting to <a href="https://msoffice506.weebly.com/">https://msoffice506.weebly.com/</a>. </body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 8, 2021 03:41:38.798051119 CEST	199.34.228.54	443	192.168.2.3	49683	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:38.798051119 CEST	199.34.228.54	443	192.168.2.3	49683	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.148595095 CEST	151.101.1.46	443	192.168.2.3	49684	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.148595095 CEST	151.101.1.46	443	192.168.2.3	49684	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.148709059 CEST	151.101.1.46	443	192.168.2.3	49685	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.148709059 CEST	151.101.1.46	443	192.168.2.3	49685	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.149698973 CEST	151.101.1.46	443	192.168.2.3	49686	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.149698973 CEST	151.101.1.46	443	192.168.2.3	49686	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.165231943 CEST	151.101.1.46	443	192.168.2.3	49688	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.165231943 CEST	151.101.1.46	443	192.168.2.3	49688	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.165956020 CEST	151.101.1.46	443	192.168.2.3	49689	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.165956020 CEST	151.101.1.46	443	192.168.2.3	49689	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.178586006 CEST	151.101.1.46	443	192.168.2.3	49695	CN=editmysite.com, O="Weebly, Inc.", L=San Francisco, ST=California, C=US CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Tue Apr 21 20:34:09 CEST 2020 Wed Aug 19 02:00:00 CEST 2015	Thu Apr 22 20:34:09 CEST 2021 Tue Aug 19 02:00:00 CEST 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.178586006 CEST	151.101.1.46	443	192.168.2.3	49695	CN=GlobalSign CloudSSL CA - SHA256 - G3, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Wed Aug 19 02:00:00 CEST 2015	Tue Aug 19 02:00:00 CEST 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.479177952 CEST	199.34.228.54	443	192.168.2.3	49687	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.479177952 CEST	199.34.228.54	443	192.168.2.3	49687	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.480053902 CEST	199.34.228.54	443	192.168.2.3	49693	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.480053902 CEST	199.34.228.54	443	192.168.2.3	49693	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.490217924 CEST	199.34.228.54	443	192.168.2.3	49694	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.490217924 CEST	199.34.228.54	443	192.168.2.3	49694	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.509110928 CEST	199.34.228.54	443	192.168.2.3	49699	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.509110928 CEST	199.34.228.54	443	192.168.2.3	49699	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.517230034 CEST	199.34.228.54	443	192.168.2.3	49698	CN=*.weebly.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 04 02:00:00 CEST 2019 Mon Nov 06 13:23:33 CET 2017	Thu Dec 02 13:00:00 CET 2021 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:39.517230034 CEST	199.34.228.54	443	192.168.2.3	49698	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Apr 8, 2021 03:41:41.687354088 CEST	44.241.55.43	443	192.168.2.3	49708	CN=ec.editmysite.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 09 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 09 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Apr 8, 2021 03:41:41.689306021 CEST	44.241.55.43	443	192.168.2.3	49709	CN=ec.editmysite.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 09 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 09 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5636 Parent PID: 792

General

Start time:	03:41:36
Start date:	08/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff6db110000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 5688 Parent PID: 5636

General

Start time:	03:41:37
Start date:	08/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5636 CREDAT:17410 /prefetch:2
Imagebase:	0xf0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://msoffice506.weebly.com

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Signature Overview

AV Detection:

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5636 Parent PID: 792

General

Analysis Process: iexplore.exe PID: 5688 Parent PID: 5636

General

Disassembly