Play interactive tour

Edit tour

Analysis Report http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance

Overview

General Information

Sample URL:	http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Analysis ID:	389168
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Startup

System is w10x64

iexplore.exe (PID: 5964 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 2896 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49779 version: TLS 1.2

Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.facebook.com/FEMA/?ref=bookmarks"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/facebook_white.svg" alt="Facebook Logo" /></a> equals www.facebook.com (Facebook)
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.linkedin.com/company/fema/"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/linkedin_white.svg" alt="LinkedIn Logo" /></a> equals www.linkedin.com (Linkedin)
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.youtube.com/fema"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/youtube_white.svg" alt="YouTube Logo" /></a> equals www.youtube.com (Youtube)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b9898aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: <p><a href="https://www.youtube.com/watch?v=DgvN_9m58Z0">VIDEO: Providing Financial Assistance for COVID-19-Related Funeral Expenses</a></p> equals www.youtube.com (Youtube)
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: <p><a href="https://www.youtube.com/watch?v=NGaWq_Hg87I">Proporcionando asistencia econ equals www.youtube.com (Youtube)
Source: Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: if(oCONFIG.YOUTUBE){var videoArray_fed=[],playerArray_fed=[],_f33=!1,_f66=!1,_f90=!1,tag=document.createElement("script");tag.src="https://www.youtube.com/iframe_api";var firstScriptTag=document.getElementsByTagName("script")[0];firstScriptTag.parentNode.insertBefore(tag,firstScriptTag);var youtube_parser_fed=function(a){if((a=a.match(/^(https?:)?(\/\/)?(www\.)?(youtu\.be\/\|youtube(\-nocookie)?\.([A-Za-z]{2,4}\|[A-Za-z]{2,3}\.[A-Za-z]{2})\/)(watch\|embed\/\|vi?\/)?(\?vi?=)?([^#&\?\/]{11}).*$/))&&11=== equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.fema.gov

Source: json3.min[1].js.2.dr	String found in binary or memory: http://bestiejs.github.io/json3
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/license
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/license/mit
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/tn/
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://github.com/robloach/jquery-once
Source: stacktable[1].js.2.dr	String found in binary or memory: http://johnpolacek.github.com/stacktable.js
Source: effect-min[1].js.2.dr	String found in binary or memory: http://jqueryui.com
Source: json3.min[1].js.2.dr	String found in binary or memory: http://kit.mit-license.org
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: wcm_survey[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/questions/2308134/trim-in-javascript-not-working-in-ie
Source: query_string.min[1].js.2.dr	String found in binary or memory: http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://www.datatables.net
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: jquery.colorbox-min[1].js.2.dr	String found in binary or memory: http://www.jacklmoore.com/colorbox
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DHS&subagency=FEMA&pu
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/download
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/download/#dt/dt-1.10.20/af-2.3.4/sp-1.0.1
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/tn/11
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://dhs.gov
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://edit.fema.gov/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://edit.fema.gov/sites/default/files/documents/fema_policy_covid-19_funeral_assistance-updated.
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://edit.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance
Source: css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg[1].css.2.dr, css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:300
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfedA.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff)
Source: jquery.cookie[1].js.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chosen.jquery.min[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/blob/master/LICENSE.md
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515#issuecomment-104602031
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515#issuecomment-33214050
Source: stacktable[1].js.2.dr	String found in binary or memory: https://github.com/johnpolacek/stacktable.js/
Source: google_analytics[1].js.2.dr	String found in binary or memory: https://mydomain.com/node/1
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: fema_search[1].js.2.dr	String found in binary or memory: https://search.usa.gov/search
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://twitter.com/fema
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://usa.gov
Source: SQ22SSVH.htm.2.dr, coronavirus[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/index.html
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.disasterassistance.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.drupal.org)
Source: drupalSettingsLoader[1].js.2.dr	String found in binary or memory: https://www.drupal.org/node/2815083
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.Root
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/about/newsletters
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ar/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/bn/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/d
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responses
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesJCurrent
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesad8_gov/themes/fema_uswds/images/favicon.ico
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesvirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/corRoot
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus
Source: funeral-assistance[1].htm.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance(
Source: funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, funeral-assistance[1].htm.2.dr, funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq#scams
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceLCOVID-19
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceRoot
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeancece
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusTCoronavirus
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusemad8_gov/themes/fema_uswds/images/favicon.ico
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusv
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/e
Source: disaster-responses[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/es/disaster-responses
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq#scams
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistanceance#main-content
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistanceance#main-contents://www.fema.gov/di
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistancenAsistencia
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/f
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/fRoot
Source: funeral-assistance[2].htm0.2.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistanceTCOVID-19
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistanceance
Source: funeral-assistance[2].htm0.2.dr	String found in binary or memory: https://www.fema.gov/fr/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/h
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/hi/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistanceFAsistans
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ht/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/k
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COV
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COVID-19
Source: funeral-assistance[3].htm.2.dr	String found in binary or memory: https://www.fema.gov/ko/node/613038
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/481051
Source: disaster-responses[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/575622
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/613038
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/o/disasters/coronavirus/economic/funeral-assistance
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico~
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/pt-br/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ru/disasters/coronavirus/economic/funeral-assistance
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/sites/default/files/2020-07/illustration_hero_disasters_corona_2.png
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/sites/default/files/email_white.svg
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/v
Source: funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceDH
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceance
Source: funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.fema.gov/vi/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/z
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/eRoot
Source: funeral-assistance[1].htm1.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance0COVID-19
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistanceent
Source: funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://www.fema.gov/zh-hans/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.h-hans/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isaster-responsesRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirusRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.s/disasters/coronavirus/funeral-assistanceance#main-contentRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.ttps://www.fema.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.floodsmart.gov/
Source: funeral-assistance[1].htm2.2.dr, Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PNFPGG3
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.instagram.com/fema
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.linkedin.com/company/fema/
Source: funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, disaster-responses[1].htm.2.dr, funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.oig.dhs.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/cert
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/preparedness-research
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.youtube.com/fema
Source: Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=DgvN_9m58Z0
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=NGaWq_Hg87I

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49779 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/159@7/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7139B2BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFEF6F7E374662853A.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	0%	Virustotal		Browse
http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot	0%	Avira URL Cloud	safe
https://www.floodsmart.gov/	0%	Virustotal		Browse
https://www.floodsmart.gov/	0%	Avira URL Cloud	safe
https://www.fema.	0%	Avira URL Cloud	safe
https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot	0%	Avira URL Cloud	safe
https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.drupal.org)	0%	Avira URL Cloud	safe
https://www.fema.Root	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.fema.isasters/coronavirusRoot	0%	Avira URL Cloud	safe
https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.fema.ttps://www.fema.gov/	0%	Avira URL Cloud	safe
https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.de	172.217.19.99	true	false	high
stats.l.doubleclick.net	74.125.140.154	true	false	high
d27f3qgc9anoq2.cloudfront.net	13.32.25.62	true	false	high
bam.nr-data.net	162.247.242.19	true	false	unknown
dap.digitalgov.gov	unknown	unknown	false	high
www.fema.gov	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.fema.gov/disasters/coronavirus	false	high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content	false	high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/es/disasters/coronavirus/funeral-assistance	false	high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/harvesthq/chosen/issues/515	chosen[1].js.2.dr	false		high
https://www.fema.gov/disaster-responsesJCurrent	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/o/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.drupal.org/node/2815083	drupalSettingsLoader[1].js.2.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq#scams	funeral-assistance[1].htm0.2.dr	false		high
https://github.com/carhartl/jquery-cookie	jquery.cookie[1].js.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance0COVID-19	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.floodsmart.gov/	funeral-assistance[1].htm2.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico~	imagestore.dat.2.dr	false		high
http://johnpolacek.github.com/stacktable.js	stacktable[1].js.2.dr	false		high
https://www.fema.gov/vi/node/613038	funeral-assistance[2].htm.2.dr	false		high
https://edit.fema.gov/sites/default/files/documents/fema_policy_covid-19_funeral_assistance-updated.	funeral-assistance[1].htm1.2.dr	false		high
http://jqueryui.com	effect-min[1].js.2.dr	false		high
https://usa.gov	funeral-assistance[1].htm2.2.dr	false		high
https://www.youtube.com/watch?v=DgvN_9m58Z0	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.gov/es/node/613038	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/zh-hans/node/613038	funeral-assistance[1].htm1.2.dr	false		high
https://www.fema.	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.youtube.com/iframe_api	Universal-Federated-Analytics-Min[1].js.2.dr	false		high
https://search.usa.gov/search	fema_search[1].js.2.dr	false		high
https://www.fema.gov/disasters/coronavirusemad8_gov/themes/fema_uswds/images/favicon.ico	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/es/disasters/coronavirus	coronavirus[1].htm.2.dr	false		high
https://edit.fema.gov/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/disasters/corRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.oig.dhs.gov/	funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, disaster-responses[1].htm.2.dr, funeral-assistance[2].htm.2.dr	false		high
https://dhs.gov	funeral-assistance[1].htm2.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
http://www.datatables.net	datatables.min[1].js.2.dr	false		high
https://datatables.net/download	datatables.min[1].js.2.dr	false		high
https://www.drupal.org)	funeral-assistance[1].htm2.2.dr	false	Avira URL Cloud: safe	low
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/funeral-assistance	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm1.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq	funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, funeral-assistance[1].htm.2.dr, funeral-assistance[1].htm1.2.dr	false		high
https://www.fema.gov/node/575622	disaster-responses[1].htm.2.dr	false		high
https://www.fema.Root	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/fema	funeral-assistance[1].htm2.2.dr	false		high
https://datatables.net/tn/11	datatables.min[1].js.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistanceent	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/d	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/fRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/e	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/pt-br/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/h	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/f	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirusTCoronavirus	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.youtube.com/watch?v=NGaWq_Hg87I	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/k	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/about/newsletters	funeral-assistance[1].htm2.2.dr	false		high
http://opensource.org/licenses/GPL-2.0	jquery.once.min[1].js.2.dr	false		high
https://cct.google/taggy/agent.js	gtm[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.fema.isasters/coronavirusRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq#scams	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/ko/node/613038	funeral-assistance[3].htm.2.dr	false		high
https://www.fema.gov/v	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COVID-19	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/z	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://stackoverflow.com/questions/2308134/trim-in-javascript-not-working-in-ie	wcm_survey[1].js.2.dr	false		high
http://www.youtube.com/	msapplication.xml7.1.dr	false		high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistanceFAsistans	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.disasterassistance.gov/	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters	query_string.min[1].js.2.dr	false		high
https://github.com/harvesthq/chosen/issues/515#issuecomment-33214050	chosen[1].js.2.dr	false		high
https://www.ready.gov/	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/disasters/coronavirusv	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/hi/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/eRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.youtube.com/fema	funeral-assistance[1].htm2.2.dr	false		high
https://mydomain.com/node/1	google_analytics[1].js.2.dr	false		high
https://www.fema.gov/disaster-responses	~DF8C0B9062984F8D35.TMP.1.dr	false		high
http://www.amazon.com/	msapplication.xml.1.dr	false		high
https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
https://www.fema.ttps://www.fema.gov/	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://datatables.net/license	datatables.min[1].js.2.dr	false		high
https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/es/disaster-responses	disaster-responses[1].htm.2.dr	false		high
https://www.cdc.gov/coronavirus/2019-ncov/index.html	SQ22SSVH.htm.2.dr, coronavirus[1].htm.2.dr	false		high
https://www.fema.gov/disaster-responsesvirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/sites/default/files/email_white.svg	funeral-assistance[1].htm2.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.140.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
162.247.242.19	bam.nr-data.net	United States	23467	NEWRELIC-AS-1US	false
13.32.25.62	d27f3qgc9anoq2.cloudfront.net	United States	7018	ATT-INTERNET4US	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	389168
Start date:	16.04.2021
Start time:	12:48:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/159@7/3
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content Browsing link: https://www.fema.gov/es/disasters/coronavirus/funeral-assistance Browsing link: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ Browsing link: https://www.fema.gov/disaster-responses Browsing link: https://www.fema.gov/disasters/coronavirus
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, svchost.exe Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 168.61.161.212, 104.42.151.234, 13.64.90.137, 104.43.193.48, 88.221.62.148, 88.221.229.79, 172.217.16.106, 142.250.185.78, 172.217.19.104, 172.217.19.99, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 216.58.214.228, 20.50.102.62, 152.199.19.161, 104.43.139.144, 13.88.21.125, 23.32.238.177, 23.32.238.234, 52.155.217.156 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, go.microsoft.com, www.googletagmanager.com, www-bing-com.dual-a-0001.a-msedge.net, www.google.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.fema.gov.edgekey.net, www.google-analytics.com, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fonts.googleapis.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, www-googletagmanager.l.google.com, f4.shared.global.fastly.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, e6485.dsca.akamaiedge.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7139B2BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.851651258053571
Encrypted:	false
SSDEEP:	192:rwZ7Zl2OWmt2if5XpzMKRBRLDhsfYXEjX:rgt8lmHI4BER
MD5:	DAC8D98ED39117FA23F556D5C5E87817
SHA1:	4D49DC5CE6BA9AA6FEC5CDC3802C20919DE615E6
SHA-256:	B6B8C9E8A683D56118FDB19414301075324EAF09CF751FAE0BD2538B6A46AD94
SHA-512:	97FE08177077D1E51D72F9A138F40CB712EE1F3B65963AE0ECA2288C454388BBD7AB88B554C3DE7E88067093E77BC988D7AD69BDDEA9373B7B53905B8B155B7A
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	179302
Entropy (8bit):	2.540448062016137
Encrypted:	false
SSDEEP:	384:r+82qhg8dXmotRV7j7bG7WqUmR9KDhT91YYpcsdWZgyh2/ewGMmsEupcMxeGIxy8:bPIT
MD5:	68BDD48563BDB2FCE98EDFE7C97D5DA9
SHA1:	3912E1C91078D1F1B645D851B7296CB4ADE1E963
SHA-256:	D56F030F228A671F457D489BA4B1AD9DDE5DFBFFB14EFBF550B0A4CE36E9A0B1
SHA-512:	C4F14981F2DB12D0A2D24F97B5900FFAB7F6155AD65D559D1DAFF34B51D27395FB13D014F134E78BE8FF67E4A1F0DCB3FF463402E537F8AB3B793D7B52F96654
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{779371BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5632820297221415
Encrypted:	false
SSDEEP:	48:Iw6Gcpr8GwpalG4pQRGrapbSMGQpK2G7HpRicTGIpG:r+Z0Q36hBSEAhTzA
MD5:	7BA7825847627698960CC75BD1BD10F1
SHA1:	5124788A8814051C4EDD56464F0DED3483B814B5
SHA-256:	1DFB2CD39FF81EBCBF08C6ED7FCABBEFD057632DF8B71BFD02D96BDFBB7E5D9C
SHA-512:	BF8D47CC91B1A6A389B9E2287B11CDA11507409507B1FCD87C3E58375E7E7B412D465689E8107FABFDE8A271C3CD0A7F798EF0CAA7103A23E6CA7D0DCEFF0C6C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1095645895801605
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEVsoWzsoW5nWimI002EtM3MHdNMNxOEVsoWzsoW5nWimI00OYGVbkEs:2d6NxOsWXW5SZHKd6NxOsWXW5SZ7YLb
MD5:	011E613941AA8EE2D096CC472A1F3421
SHA1:	4502405E71CF90AE2C8372FE31ED379215DA04DF
SHA-256:	5D0BF867ED48C49C09716D1ED38F9CC63CD120DAE2D6BD09F5073152C739B638
SHA-512:	67B8B93A5DB2106C39E5E86FDF7CBCF0B42A0C2403BEC04B76D1037C452FD0090795182C2B7BF213936D418A4919028B2496767E79D1CE5658E59846B277CAE2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.130261332279621
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kIWmW5nWimI002EtM3MHdNMNxe2kIWsYW5nWimI00OYGkak6EtMb:2d6NxrRWmW5SZHKd6NxrRWLW5SZ7Yzan
MD5:	F15BEE81708A8C4A1EE8E87457ADD0A8
SHA1:	C46AE2FE824C1588A3C838D72C9844EDE18EEB84
SHA-256:	C0EFCCEF71A3716747A7157ACA670E24BABBC1686BEF84056C430294E642CDAD
SHA-512:	E655D9D824BCE5EFE282EA19350762C0B1D20C9BA5AEAAFBFF352933BDBCC09FA9F0C9385BB08A469570515A51FF68E4CA3AA0AD7FABC25C56254D0636646883
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5b8585f4,0x01d732ae</date><accdate>0x5b8585f4,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5b8585f4,0x01d732ae</date><accdate>0x5b87e85d,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.1340204602927315
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLPaVa5nWimI002EtM3MHdNMNxvLPaVa5nWimI00OYGmZEtMb:2d6NxveY5SZHKd6NxveY5SZ7Yjb
MD5:	94FD5CE361B6B1D1E8F07608608BC5FA
SHA1:	DB6149AF7908DF224BE7935B923D92CB789BEE89
SHA-256:	4B3B1A1C5A9F9BC65CCC748DCDA9E0CFC2F77407A00FB39799731181C1A68B97
SHA-512:	66DDD4D5839DF6B160995BEAC9968A3200F8347C601632CE6C6690071F28E66571F7389DECA704963F4926D38BF6C75FF4AD7FCE47794E928754EDB5A1809704
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.104902424874061
Encrypted:	false
SSDEEP:	12:TMHdNMNxiQW+W5nWimI002EtM3MHdNMNxiQWR5nWimI00OYGd5EtMb:2d6Nxqb5SZHKd6NxqR5SZ7YEjb
MD5:	005B5A1F5438EEF7F4559DE746FDDD39
SHA1:	4EB674B03DFF4F3DEC22BCAA32CEFD54CAE38282
SHA-256:	F3384253818584FF32BA3F34C7307520850F2323659FDA002587CE577ABCB075
SHA-512:	91F5E82760DB8A970C4803F2BE5F04E305F9951179237E60C797E6B1CA55D7622172AA460A541B90B09E72DC01BEA5CE2828F3E85244B1CEFE259A7489EC55B4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1497701360762145
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwPaVa5nWimI002EtM3MHdNMNxhGwPaAIb5nWimI00OYG8K075EtMb:2d6NxQHY5SZHKd6NxQHj5SZ7YrKajb
MD5:	7C918827FD9D662DF3D3B8BEA2310D0B
SHA1:	CB39E414FC58FDF22FDA53324667FA2C11BD124A
SHA-256:	DFB6D4120B5FFC09B2370BA1D1BCF733704B86558DEDD9FF21357BA30B55F3A2
SHA-512:	63BEAD4454DF9703624308DCA23952998128D77B6B84784286CF955206DB4F5CF8B64AB1258FDAB26368A1E27B10A695787EFAC3C56DBFA144DC6C2F74579F75
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b9898aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.11084830353492
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nVsoWzsoW5nWimI002EtM3MHdNMNx0nVsoWzsoW5nWimI00OYGxEtMb:2d6Nx0pWXW5SZHKd6Nx0pWXW5SZ7Ygb
MD5:	508207BC5945EE02C731B48F4F81663A
SHA1:	5FA0A7D297AA17D629CB1C363676E04DAE23729B
SHA-256:	602B9A22629166D1DAE9CDB2A4B1BF344C5B715636FE5A8B3883587B455AC3F8
SHA-512:	64F792A6B9124FA5DADD251083566460E63B5C588486BA55B2634608C5E9AB44450411F3DB274EEB8B499A05EEA419020D28404EC944C3136A943576975AAA3E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.106881769246928
Encrypted:	false
SSDEEP:	12:TMHdNMNxxnR5nWimI002EtM3MHdNMNxxnR5nWimI00OYG6Kq5EtMb:2d6Nx1R5SZHKd6Nx1R5SZ7Yhb
MD5:	98718560F9B4B820CB919E111675A65F
SHA1:	8C28BBE129AEAE621E4EA0CCC85CE647ACDBED73
SHA-256:	361FB7B096EA7CC4C2F5CFEEBF89924D1EC3D31B973FC80C7F3D73ED59090639
SHA-512:	DF8297406FF1169DF3E7686ECA3893F78859C50E666BEA678E2852847EFE3F2562E21A0924B4AB09B20D34D5F01B602A435A3931C60A5A1D2C65173ECEEFFB86
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x5b9171aa,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x5b9171aa,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.079266666359399
Encrypted:	false
SSDEEP:	12:TMHdNMNxc+BWABW5nWimI002EtM3MHdNMNxc+BWABW5nWimI00OYGVEtMb:2d6NxQL5SZHKd6NxQL5SZ7Ykb
MD5:	849F41C6B50116ACE123DF373C195A6B
SHA1:	B2C0C26664A901B30961925E16E10A0E876A1CD5
SHA-256:	2EAE7E4AC932FBA2BB7884A5691008A1064FA8767FEE886895C9042B3672DA89
SHA-512:	7FDB44A0EDBA9C008ADF8E452ACF5CE9C87713DFC8E662EBBBCE0C672B0C8399D773D4448524CF1400EBF77D0CE7A42DFA9882146F5C9ACDEB7848255BE2B5FB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.085609648608946
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnQW+W5nWimI002EtM3MHdNMNxfnQW+W5nWimI00OYGe5EtMb:2d6Nxpb5SZHKd6Nxpb5SZ7YLjb
MD5:	778F1E9FBA4CC94C266D8025ED4345ED
SHA1:	0FE97DBDB471927C93B96E1A4CB7D5F4D5E5FE4B
SHA-256:	7954909253C1190FFE09561E27E5E5B8C364E100741EE04A00CB784499D83AAB
SHA-512:	D65C00E598F3B966F786FD06969AF5157BB56C33CB04163D2753AA9C0BFE1BF4113FE49469E4A8540D68BF25054333EAECC6519BC622813CC808F1A1B9442246
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	48190
Entropy (8bit):	3.6485027060946345
Encrypted:	false
SSDEEP:	384:SUP1rUUmpmH5B+uTdrFiJAVQJJJJJJJjJJTIJSJJCWJJJ8mJJJJvs0JJJJJJJJdY:SUP1AUOKNCTY
MD5:	D45B47EF8E79ECAFC3E02CEE8B3BC0EB
SHA1:	613B52ECB23C4ED06EFBFB692C61D22B1A20DE2D
SHA-256:	FCA4C24DE7AB70CE1568363FBD820F76053080D89725CF5E74666A6E92AC68CF
SHA-512:	FBCD0BA0B34DBBDA4D2EF28C9F403DECAE72E0517FFD74B90B1DFEE7C0E0F59CCAEF2CBE574E46BD8A0C5107EE64F81450ACD6BB7B919589045730CD51A47E7E
Malicious:	false
Reputation:	low
Preview:	M.h.t.t.p.s.:././.w.w.w...f.e.m.a...g.o.v./.p.r.o.f.i.l.e.s./.f.e.m.a.d.8._.g.o.v./.t.h.e.m.e.s./.f.e.m.a._.u.s.w.d.s./.i.m.a.g.e.s./.f.a.v.i.c.o.n...i.c.o.~.........lk.... .h.......(...l......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20180, version 1.1
Category:	downloaded
Size (bytes):	20180
Entropy (8bit):	7.97320012816743
Encrypted:	false
SSDEEP:	384:S3ECNC9EU5uXBx/d17jzOBmhUXQOTF3IHrYZEFeWXU5ebGLtCjUdtjVOTg:S3EC2rMXBdjzOBRx3IHrYOFeWLotCYL7
MD5:	5CC3AAE674EA3B199313B3B83BD795BC
SHA1:	993DB0EC4347B0CC53128CFDCBB767606D8A3576
SHA-256:	38399EFE707A8FFC12359A0086E7340315B42194A10FD2E1D1288BE12DA9E39C
SHA-512:	2346622E53705ABB58BDC45818D497CB17E9F9869B546CAF298D1E4D4A2D7E15B5A3C3EE8E6779D64C4C4BB0F98A58216A394BCA81F6660AE137FC6326B48955
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff
Preview:	wOFF......N.................................GDEF.......6...F....GPOS...........f.x.{GSUB.......{... J.c.OS/2...8...V...`[.t.cmap..............3cvt ..........."..fpgm...........s.Y.7gasp................glyf......4...f.....head..E....6...6....hhea..F.... ...$....hmtx..F .......P.=).loca..H4..."....s.Tmaxp..JX... ... .3.zname..Jx...A....[.s.post..K.........SF.prep..N....S...V.c..x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x....a.......f.]C..fe.5fs...m.a<]Cv}...7..NG..7l.#.}&..J........^c.S.....>..yv.<{.C...N...p@...>....$..!......:...BH...p.C.}).O/..M...t...TB....E....t.....s..L.H _..G3.l.....l?..y.`..............=.....Q.6.e....v.n.]T.........}w..iz..czc;.....C....Z6...m.2G\|....b.8....x\|I'T..Lb%.xI'Q.H.p.%..."UbH.$.%..I&SR.&.4.$...RP2($a..4JJ.e$...M9...DSA..(.T.<S.xjI:Mh..vD.^.. !t..)t.'i../..`....&.1.%..L".)L.a.8.....#...@\|...".Y....J..$.....f%k.a.d.N<...r..6.#...}.gf~S.9......A.A..affff~.......Y.TZ..j....E..N...pO.l..Ze)......`.V..[.c.W.10./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20096, version 1.1
Category:	downloaded
Size (bytes):	20096
Entropy (8bit):	7.976739163404447
Encrypted:	false
SSDEEP:	384:pKEBfGHU8uXBvkV+PzO1hBPplViLe21Fyb5MXJL/HT0AvAOhFVOT3:pKCfG0pXBU+7g7lVAe21Yb5y7T0PmFVq
MD5:	A75563D7B9E5B1DB163971B9A2E66216
SHA1:	F52CCC0BBCE9D1E550790EA02639B36326764349
SHA-256:	C08EFA91781865D1A2E9FCB030F8AC55C2D8EADBF8822C2EA251556333F99D9C
SHA-512:	2ADD03FA487983BBF4E098E08BF87A6DCC0AF603B0A9F54CBB72452C5D410D45950155C106AF0C93C13C03D3EF1AC9A2C4A15EBF1F87699393F4350B5851F15C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo.woff
Preview:	wOFF......N........\........................GDEF.......6...F....GPOS...........T...zGSUB.......{... J.c.OS/2...<...T...`[.u.cmap..............3cvt ...........X..fpgm...........s.Y.7gasp................glyf......4...e..,..head..Ex...6...6....hhea..E.... ...$....hmtx..E........P.7%.loca..G............maxp..J.... ... .3.pname..J(...@....X.qEpost..Kh........SF.prep..N,...S...VS..8x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x..WUpc9.lC.af8ffff..cf..>fffffff/o`_..l.....R=?..f.o.K.'i..I-0B..p..Bt.=.;.u'^~.YX...N>...u.E.`.D!!....R...w..3O....ej@...a@...En..A%e.Ai...m...LA56..=.U8....xT...d#..kP.."..Q.V8I).zP..=....X...R.v....Mv2._.T>..bQ..&.[)...bD..&.{...`.gb.d3>......Q...[.?...O..?.......).S6\|..W.B.n..xDk.<.PN..f!.G...... v..aA...#.!_h@.P.2...B9.<T.....Q#..V.D.P.z...B....jV.j.....z...b.......Hh..B.6....P...l...-..b.^..._....H..Jq.0...H.=....q.\|....}..P...".v).W<W..!\/.p...-..Y.M..v!.;.......w...aE.+d.>aE./d..<..).c@.`P.^,.S.E..F.>.nz.sX.S..`..z.........H.G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19896, version 1.1
Category:	downloaded
Size (bytes):	19896
Entropy (8bit):	7.973207257576149
Encrypted:	false
SSDEEP:	384:vi9GdFUguXBNV01KI0EhV+xnP+gu9ZLpanYwJz1aRRxaFsq+6LVnQVOTa:vi94iVXBYQnmUYwJz87kLhxnQVOTa
MD5:	B03F2EC28F8E60E61974DD8C57610E5B
SHA1:	DFF9B2C95F626F894185C98CFBB976BB98B50F33
SHA-256:	D8DD0DE638293EB62DBA15A6E410FB0AF9A5B36C35DF226237B1B609D573C63E
SHA-512:	A585B769AA7CD7311FB4075DB5EEBE09E65A46CEA773639482DE0EAAD248C0BCDC571BEF16BCC9EE1196596014871FF39541AF66C1A53FA8B026A82C0F00904D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff
Preview:	wOFF......M.................................GDEF.......6...F....GPOS...........f.o..GSUB.......{... J.c.OS/2...,...V...`\?v.cmap..............3cvt .............9fpgm...........s.Y.7gasp................glyf......3...e.q.B4head..D....6...6....hhea..D.... ...$....hmtx..E........P.k!Nloca..G(........].(maxp..IH... ... .3.rname..Ih...8....X.p.post..J.........SF.prep..Md...R...V2...x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x.....]...w.jm{..m....m...m.F1.n....\|.........8....w..Uj.6oWkX......?..0.{...{3....4.K..pP....(.{.%..!./(.x....}C.d.`.....29x.@...+.!.......Q...T..+]g.^p.9....x.agI.W[jg.m.K........-.c.E.D......6..r...!.7>.......X+.ok..+7k.o.yj.%..<.uw.*....v.N...>...L`.....x...&..I.......4B$.p. F..4.$.D.#I.I.HR$.TI$MbI.$2$.,rH%WR...t.P.T>.T>.L>.,>..>.(........\.....I......)B8E%.b....H.4.I...I..u4.!Y4.114..)..=.....t..>z..^.x.#^.........3Pr.$~.3.l.H:......FmS%.R....#.S..cvE...6^[...v....Z..`A..]R.hg.\S../w.([.s.n..y.{.....osc....At.....x.%Q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[4].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[5].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Latin-Merriweather-BoldItalic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 24464, version 0.0
Category:	downloaded
Size (bytes):	24464
Entropy (8bit):	7.980368563514149
Encrypted:	false
SSDEEP:	384:1P93TGqXqtPIbW/ANhv2vXfXd9hVYOZBdHViiPHzgTkywyZFHcpw76eTIb9smLx9:1P93T/6pIb/J2vFHVYOZB1V9sTZw0cp/
MD5:	69DEBB55BA07CD17F2730F71CAF77339
SHA1:	0418038D16872C6CB6D70FF800DA1FABEDDD641F
SHA-256:	744A8B2D072D7B01617680B18FD829933B4F316A71BF971B7364539602F180D1
SHA-512:	E92EDC00DD7AB2328644E10B82111B447FC18A90A8A6E3619B1FDADAF7BB7109CEBB6B4E34329F20049AD2FA2DCDC5DF113E2A4F760692EAA2C7436311ED12BA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-BoldItalic.woff
Preview:	wOFF......_.................................GDEF..]....=...F.I..GPOS..^.............GSUB..^.........(..vOS/2..Pl...R...`W...cmap..P............Rcvt ..X0...A....5..2fpgm..Q\...<....vd.zgasp..].............glyf......I...z..n&6head..M\|...6...6...hhea..PH..."...$....hmtx..M..........8..loca..K..........n.maxp..Kp... ... .k.bname..Xt........!...post..[\|...G.....k.8prep..W..........0.hx...\|dG./\U7u.9...j.[Y...h4....f<.8.=3..0.3.6...x..cl0.lX..`.v..,y...g0.0&.......ROp....7..T..U.N..S.T#..#...i.!=R<..1"...1h...x!..%.t.<u...'.\|...O.=.89}f.....d.S.;.\|....2.....x....&..!B...q.n,.2.x.#e.qa1.k.Y-b8.k..;.....@S.....y....&..ml.C.....!.&..!5z..LP.>N......`.O.<.......`..7....Rc...ju\=..x.....v9.vx..d,.3...T!\..r..O....../....(.\{...e.=.%...b.~.!.N..]............O.=..S.'... ..=$......sc..1.....>...Q."...........).b7.$nE....E...+.........e...`.......8^..}8.oj....1.s.....pH.Z\|.....q.k.kz..`i...v.5..:.../f...h{./...v.qZ....4.:...u.......%.w.....)...V.v]...4.\|......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\back_to_top[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1218
Entropy (8bit):	4.565469135050744
Encrypted:	false
SSDEEP:	24:2v/WFCy5VKm2WNcklMHdl2W9cnxcm4LAwiecnxcmqS/cuDlPWSlFGlxqaunv:F5MmOka9nKd4EwFKdX/pdPGyaG
MD5:	01B303BD7F0651408E97AD668D6C363B
SHA1:	A7E9D3CE2305795C4334A2F9B5E038AEA3A62A0F
SHA-256:	260BC459CB0ECD15ECF5E32A19FFFD475166B4BC3E39197568E0FEC6B5B8B3B8
SHA-512:	D2F4AD43C4E1B69555F08F11370CC54892429BD120DAA1F24EB2D7BE1938292F0F3027E781F765FFBBFB568E5A86ADC649308FAEED5AA18972E2B1AD1B91E58F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/modules/custom/back_to_top/js/back_to_top.js?v=8.9.13
Preview:	(function ($) {. Drupal.behaviors.backtotop = {. attach: function (context, settings) {. var exist = $('#backtotop').length;. if (exist == 0) {. $("body", context).once('backtotop').each(function () {. $('body').append("<button id='backtotop'>" + settings.back_to_top.back_to_top_button_text + "</button>");. });. }.. backToTop();. $(window).scroll(function () {. backToTop();. });.. $('#backtotop', context).once('backtotop').each(function () {. $(this).click(function () {. $("html, body").bind("scroll mousedown DOMMouseScroll mousewheel keyup", function () {. $('html, body').stop();. });. $('html,body').animate({scrollTop: 0}, 0, function () {. $("html, body").unbind("scroll mousedown DOMMouseScroll mousewheel keyup");. });. return false;. });. });.. /*. Hide show back to top links.. */. function backToTop() {.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\chosen.jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	29004
Entropy (8bit):	4.912069363278223
Encrypted:	false
SSDEEP:	768:UOtj9+umwoSfCoxHNfhvwITdGWb0DvHrTgtV:UORjSoxHNfh1TdGWb0DPXgtV
MD5:	198860BE177A85C5D9FB224A2700FAE2
SHA1:	7BB8E837E5D49E9ACC0290EB4330209672E66933
SHA-256:	8FDC973AA28E9462A401EAD3CFFE8A0A595E92658FDCAB776BBB01BCC2BC2062
SHA-512:	8E046751DB3C27A9D8C70CC41DC3F37C54D6C22EA8569AA580A0EC3D16AC9C351AC43D76F919FC193170C193FDED8D02E3E2D2D09E19FD6D00249A0DC538E999
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/libraries/chosen/chosen.jquery.min.js?v=1.8.7
Preview:	/* Chosen v1.8.2 \| (c) 2011-2017 by Harvest \| MIT License, https://github.com/harvesthq/chosen/blob/master/LICENSE.md */..(function(){var t,e,s,i,n=function(t,e){return function(){return t.apply(e,arguments)}},r=function(t,e){function s(){this.constructor=t}for(var i in e)o.call(e,i)&&(t[i]=e[i]);return s.prototype=e.prototype,t.prototype=new s,t.__super__=e.prototype,t},o={}.hasOwnProperty;(i=function(){function t(){this.options_index=0,this.parsed=[]}return t.prototype.add_node=function(t){return"OPTGROUP"===t.nodeName.toUpperCase()?this.add_group(t):this.add_option(t)},t.prototype.add_group=function(t){var e,s,i,n,r,o;for(e=this.parsed.length,this.parsed.push({array_index:e,group:!0,label:t.label,title:t.title?t.title:void 0,children:0,disabled:t.disabled,classes:t.className}),o=[],s=0,i=(r=t.childNodes).length;s<i;s++)n=r[s],o.push(this.add_option(n,e,t.disabled));return o},t.prototype.add_option=function(t,e,s){if("OPTION"===t.nodeName.toUpperCase())return""!==t.text?(null!=e&&(th

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\chosen[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6506
Entropy (8bit):	4.624047268553028
Encrypted:	false
SSDEEP:	192:wXliBQ0yIF1U+KWeQs/vz/7262vm75Uaox2MJvTk8J3zjTUKvZiRRf:w1Uya1UV332vm7Ns2MJvY8J3q
MD5:	D21675ECE8A8AE3A9CF43F871F64FF9C
SHA1:	3752994EB4698A89308B15D471E569E4644EE1FA
SHA-256:	0ED321FBBE1966DE3C3C3D5E9074DA59C56CB53FF486DED6DA66E12D00C78411
SHA-512:	A6860EF93213AF8BC4BEA752D5868D35A2BDABCF1112CDA6DB245DA86EA200CD5A1899D5297D509C1F43C56819C576DD42087E48BABC9EA73063B8110D263652
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/chosen/js/chosen.js?v=1.7.0
Preview:	/*. @file. * Attaches behaviors for the Chosen module.. */..(function($, Drupal, drupalSettings) {. 'use strict';.. // Temporal workaround while https://github.com/harvesthq/chosen/issues/515. // is fixed. This fix was taken from:. // https://github.com/harvesthq/chosen/issues/515#issuecomment-104602031. $.fn.oldChosen = $.fn.chosen;. $.fn.chosen = function(options) {. var select = $(this). , is_creating_chosen = !!options;.. if (is_creating_chosen && select.css('position') === 'absolute') {. // if we are creating a chosen and the select already has the appropriate styles added. // we remove those (so that the select hasn't got a crazy width), then create the chosen. // then we re-add them later. select.removeAttr('style');. }.. var ret = select.oldChosen(options);.. // only act if the select has display: none, otherwise chosen is unsupported (iPhone, etc). if (is_creating_chosen && select.css('display') === 'none') {. // https:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\close-blue-60v-alt[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	5.103723313646496
Encrypted:	false
SSDEEP:	6:tI9mc4slzbtHqUNRtj9/ymqZlZkUq0vdGoAK+:t4LHqefjYhlLq0D+
MD5:	6EB4510EB4CF4022687A599D0E22CE75
SHA1:	2282CDDA6254F152D695143C653F59181F0EE425
SHA-256:	3CD4AAD8CD5F774DF3A6B8D73B8A76277AB0D5C0C42CE749A635CECAFCB8D66E
SHA-512:	8AF5E7076D973DA756A67408C1BA747083B5F4322CB5D860F941C913CC457231CB12F691C41F20C3C896A6CBE1CF20AB61FFCA421534B0E441BD081766E97F69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/close-blue-60v-alt.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 15 15">. <path fill="none" stroke="#005EA2" stroke-linecap="round" stroke-width="2" d="M0 13.0332964L13.0332964 0M13.0332964 13.0332964L0 0" transform="translate(1 1)"/>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\drupal[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6312
Entropy (8bit):	4.829027756516979
Encrypted:	false
SSDEEP:	192:8y7EabGSafu+3GfZqnWHMZxObyQEvShbIMPr8MZScmtCsLPIjj99Iuerd1:ttzjyIvTS
MD5:	2D083E808846C9D9780ADB0B098027D9
SHA1:	D5B5D83F9C911BD862A4977DE0F41D1BE9BFBAD7
SHA-256:	990FDA61C1303A87F6317B47FEF824552D611209F0537BD4FAAA9648D3DE1363
SHA-512:	827AF9DB47C3D27A27CF0C4BA70BB3C4A59D65DA05A2A6AFF0E8BC03F934E1CF5219AAD1D006D60F215104EA93C0FD034255AB7C977FF0B53D6A30CC8F1B9C12
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupal.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..window.Drupal = { behaviors: {}, locale: {} };..(function (Drupal, drupalSettings, drupalTranslations, console, Proxy, Reflect) {. Drupal.throwError = function (error) {. setTimeout(function () {. throw error;. }, 0);. };.. Drupal.attachBehaviors = function (context, settings) {. context = context \|\| document;. settings = settings \|\| drupalSettings;. var behaviors = Drupal.behaviors;.. Object.keys(behaviors \|\| {}).forEach(function (i) {. if (typeof behaviors[i].attach === 'function') {. try {. behaviors[i].attach(context, settings);. } catch (e) {. Drupal.throwError(e);. }. }. });. };.. Drupal.detachBehaviors = function (context, settings, trigger) {. context = context \|\| document;. settings = settings \|\| drupalSettings;. trigger = trigger \|\| 'unload';. var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema-logo-blue[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	30633
Entropy (8bit):	4.329100777319275
Encrypted:	false
SSDEEP:	768:HxJI7xcphSN2UwpMjXTtdN2lxkA3gA18J:38iC9wpKXbFAZ4
MD5:	3368EA7515DEE377CBB955D0C7D575B6
SHA1:	981087254B98E6786EA4C5C825169806A1776D2F
SHA-256:	1936633A2C23D0A260CC1750BFF59E8923D9A08C9D53274CF1D6BE6105412D19
SHA-512:	DDF4261D28689EACB5E277B0278C94637129EBBC421E95F25F4AD3149DA27F94EEEFB04B064C0DCAA9A3C2D6C9D0BCA82E33FE370DFBC8AB3DF427869E373318
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/fema-logo-blue.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 310 110" style="enable-background:new 0 0 310 110;" xml:space="preserve">.<style type="text/css">...st0{fill:#045388;}...st1{fill:#FFFFFF;}...st2{fill:#C42032;}...st3{fill:#C0C2C4;}...st4{fill:#0778AE;}...st5{fill:#5E9841;}.</style>.<g id="FEMA_logo_2_">..<polygon class="st0" points="127.1,76.4 133.5,76.4 133.5,37.1 127.1,37.1 127.1,33.2 159.9,33.2 159.9,43.4 155.9,43.4 ...155.9,37.1 141.1,37.1 141.1,54.7 152.6,54.7 152.6,49 156.5,49 156.5,65.4 152.6,65.4 152.6,58.6 141.1,58.6 141.1,76.4 ...147.6,76.4 147.6,80.3 127.1,80.3 ."/>..<polygon class="st0" points="164,76.4 170.3,76.4 170.3,37.1 164,37.1 164,33.2 196.9,33.2 196.9,43.4 192.9,43.4 192.9,37.1 ...177.9,37.1 177.9,54.1 189.5,54.1 189.5,48.4 193.4,48.4 193.4,64.8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_tables[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3111
Entropy (8bit):	4.581822386121126
Encrypted:	false
SSDEEP:	96:kfPO6vaF7kaBC/dRSvijO3mCtWveujO3lpAOA8Z1jOJXKb1jORXFsL:kfPOIaF7kaBC/fSvijCmCtWWujCleSZP
MD5:	4673C6527A891D7B84075552B86A330B
SHA1:	95B55BDF04B5B15318071BF74CE58A3A3A8CDE80
SHA-256:	8F22C43D5E58AE5469340440E2B9A70993B878C537BC76EADB8DBA25F53CFD7F
SHA-512:	1BCDC9CE6A1EACF5BB181946314B91F61A5A7AD1A1AB5D64D2909DB58FAEDDE36065DE051E4263C1B89686CC4101B55ED8E9D79883014B5FAC371582279A730B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_tables.js?v=1.x
Preview:	jQuery(document).ready(function() {.. function createDataTables() {. //targeting table with class datatable. // add "aaSorting" to disable default sort. jQuery('table.datatable, div.field-name-field-data-table-csv table, div.datatable table.views-table').DataTable({. aaSorting: [],. retrieve:true. });. //508 compliance calls and set title attributes. jQuery('th').attr('scope', 'col');. jQuery('td').removeAttr('tabindex');. jQuery('tfoot').remove();. jQuery('.sorting_asc').attr('title','This is a sortable column in a HTML data table that is sorted ascending.');. jQuery('.sorting').attr('title','No sort applied to this column.');. jQuery('.dataTables_filter').find('label').attr('for','datatables_search');. jQuery('.dataTables_filter').find('input').attr('id','datatables_search');.. //this applies the default sort arrows to our datatable. jQuery('.datatable th:nth-chi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_uswds[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text
Category:	downloaded
Size (bytes):	5819
Entropy (8bit):	5.119571476630061
Encrypted:	false
SSDEEP:	96:7yTWKvvqn8kaY1G59/CcRznSdYXCVVwEvOwCHnl7YXCVVwEvau/Q:7yEyC+SdYYCHl7Yq/Q
MD5:	176C9B3EA22B14902286F99CF01356C7
SHA1:	3572773FC1BF92C598C685DF143CFD76DE6D7669
SHA-256:	6F89CE0749E80BDEA53EB50B24CD88BECDB16ED66BD51FD498EF2AF70F789726
SHA-512:	E6B48D15950F9A65A5B7DC111D90A0165F05D828BF2262DF05D7F484D2571BB5F76B39A63165098A4A2433EBB2CB4C7AB818C6E894832C3C893BB0A2B353920B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_uswds.js?v=1.x
Preview:	jQuery(document).ready( function () {...var langCode = drupalSettings.path.currentLanguage;...// adds datatable functionality to .datatable class..jQuery('.datatable').DataTable();...// adds an hr after every h2 in the content region..jQuery('.region-content h2').append('<hr />');...// hiding dropdown menu until page is loaded..jQuery('ul.hide-on-load').removeClass('hide-on-load');..jQuery('div.usa-banner__content.usa-accordion__content').removeClass('hide-on-load');...jQuery( "#edit-dhlocation" ).focus(function() {...if (jQuery('#edit-dhlocation').val() == 'Enter your city and state, or ZIP code') {....jQuery( "#edit-dhlocation" ).val("");...}...if (jQuery('#edit-dhlocation').val() == 'Ingrese su ciudad y estado, o c.digo postal') {....jQuery( "#edit-dhlocation" ).val("");...}..});...jQuery( "#edit-dhlocation" ).focusout(function() {...if (jQuery('#edit-dhlocation').val() == '') {....if (langCode == 'es') {.....jQuery( "#edit-dhlocation" ).val("Ingrese su ciudad y estado, o c.digo p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_vaccine_graphic[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 2400 x 2400, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	49856
Entropy (8bit):	5.715861693099527
Encrypted:	false
SSDEEP:	768:TEjHH480CQQtKMoo2VdVJTPWUx5WKBsKs4upV:TWHl0CQoKpo2VdVJTPP5RHu7
MD5:	994FCB68D0A44BA492D6E45D2CDF8425
SHA1:	C336913DC78ADC208A2F23B00E63652009BBE0AC
SHA-256:	1BD499F7E813FE779127F7A05633822EAA3A2DA7C83DEDF101EBAA65C459D3C3
SHA-512:	48ED23FB8FB5C10D0C423E69306B887AAE2B1711BED6BB48F2FA571E73BCE3685C208384A39884487213A40BCD5AFF40EDAD3D62DCC8B68B8085F094607D9F69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/fema_vaccine_graphic.png
Preview:	.PNG........IHDR...`...`......M.n....pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmp:CreateDate="2021-02-08T18:33-05:00" xmp:MetadataDate="2021-02-17T16:42:50-05:00" xmp:ModifyDate="2021-02-17T16:42:50-05:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:116b3adc-d787-4783-b9a0-dde9633c7e8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	93965
Entropy (8bit):	4.431489842824501
Encrypted:	false
SSDEEP:	1536:QltYqJ6Gj9eOof8QvtKvbkDQIrAm5vMbViBsCUAz1fPJl9zQFGcQ8TlP3GVSB2ny:2q/9QIUNZAz1fPJl9zQFGcQ8TlP3GVS3
MD5:	50B314824C9A731926E6FC78855C6587
SHA1:	2800E259C7E5C2B8267BA738F4D1569EB09ACAC1
SHA-256:	88820D254438BEA10483CEBB78660724E01A9E56CA75B5B7DBE76DEC3ADF52D1
SHA-512:	B786F201620E9FC3CD0C1E7171134854AB787219E8AC79FC6BB970D1CB70C4DB71DBD86F7B8E076D7FA6BABFD45FD6BAAF2EB1CE56B2EC59C28EEDD5386A870B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="ht" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\hp-search-arrow[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 28 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	419
Entropy (8bit):	7.194954019543332
Encrypted:	false
SSDEEP:	12:6v/7ODgcAkt6OWN3j7CkU5zUI7byD4ygsrvJjut9ELseob7tyy:Qc5AOWwkU5gAbyRxN09EgPb7f
MD5:	AA44487BF605BD480C3EF049E2BF37CF
SHA1:	3D2BE80DA054E1CE9ACC844203FD4A0CE86BCD29
SHA-256:	71B87E54B25D094E0631ED156506E72796A0549F1E9673BFACDA5CB3D887E91A
SHA-512:	786C47C91862BCD27693A6CA924A2898EDC3D932213BB1066E974631A65BA0A082359F8DC5D1C140B9A6F1BFFAA2B2597C230CAC5366E734DBC8A82B7D79FD69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/hp-search-arrow.png
Preview:	.PNG........IHDR.......0......c......pHYs...%...%.IR$....UIDATX...1N.0.............&..8.+9@.......H%'(...AG.b.*'r...../y.....Gz....&eU..l7...J)....;.eU.UA.=..&z.ws.bM........f._I.V...R....s.........E..p;9..\|@.....NP...Zh..@{Ait.(.....(P....h..A..T....'e"'v....g.z.%{.NV.....!....]y..t....`l0.c.)X2..%..,..bQ..6......X/(..A...ja..&v.jc'`...sa....`.96....Wq.c....`..L,.zj..-.......5u........Q...v.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-dot-gov[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	651
Entropy (8bit):	5.121889669293397
Encrypted:	false
SSDEEP:	12:tvG1XHb+zu/rADafPxfjOBj2GwxujyrIT0px4Q0y8jbjagcjawm8HlP:tu1XglsxfjQj2yjyry6RP8jbjejXmaP
MD5:	D1C68805B39204BD12C74FB89CF46B5A
SHA1:	0D6AA00FB19A3F2A40D07C764950C3DEA1BE2208
SHA-256:	8D5D08018C88AD2FA2608E080EE8D7B994FCE4CE311BC65077A95469355BDD04
SHA-512:	A13FA3525453F52393FA7E53888A6F671794F5460BB4E02BD8E4D3AAFA33341D3F71024896F8CB82C85F6E0B3A98871AE40BE4BB6206FE13CA098F5E8E0C3F6E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/icon-dot-gov.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 54"><defs><style>.cls-1{fill:#2378c3;}.cls-2{fill:none;stroke:#005ea2;stroke-miterlimit:10;}</style></defs><title>dot gov icon</title><path class="cls-1" d="M36.5,20.91v1.36H35.15a0.71,0.71,0,0,1-.73.68H18.23a0.71,0.71,0,0,1-.73-0.68H16.14V20.91l10.18-4.07Zm0,13.57v1.36H16.14V34.48a0.71,0.71,0,0,1,.73-0.68h18.9A0.71,0.71,0,0,1,36.5,34.48ZM21.57,23.62v8.14h1.36V23.62h2.71v8.14H27V23.62h2.71v8.14h1.36V23.62h2.71v8.14h0.63a0.71,0.71,0,0,1,.73.68v0.68H17.5V32.45a0.71,0.71,0,0,1,.73-0.68h0.63V23.62h2.71Z"/><circle class="cls-2" cx="27" cy="27.12" r="26"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-https[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	518
Entropy (8bit):	5.18608229395607
Encrypted:	false
SSDEEP:	12:tvG1XHb+zGfrAUaTRbknUNDnUN5arnUatY3yWnUa6S+k8HlP:tu1XgGvIRbkUxUarUjU/MaP
MD5:	E012DECA8C4F6E0FC9E2E269F06E16C1
SHA1:	31997B49330EA1FC6B2A68DFCE1A885994CB5494
SHA-256:	C4FBE61CB398B85C01CD675F6A554F1845BC342F568B59297DE3C126A5E7F5F8
SHA-512:	718E35A5E2FFF62AC3D2ECE80C08E528B2BF57E4A73D0E9EAC98A6CD32DA3B354985667611B3128CBD4CE55CB4528E00575EF7CEDDBA0BB2018648CA843D379A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/icon-https.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 54"><defs><style>.cls-1{fill:#719f2a;}.cls-2{fill:none;stroke:#538200;stroke-miterlimit:10;}</style></defs><title>https icon</title><path class="cls-1" d="M34.72,34.84a1.29,1.29,0,0,1-1.29,1.29H20.57a1.29,1.29,0,0,1-1.29-1.29V27.12a1.29,1.29,0,0,1,1.29-1.29H21V23.26a6,6,0,0,1,12,0v2.57h0.43a1.29,1.29,0,0,1,1.29,1.29v7.72Zm-4.29-9V23.26a3.43,3.43,0,0,0-6.86,0v2.57h6.86Z"/><circle class="cls-2" cx="27" cy="27.12" r="26"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_disasters[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 100 x 133, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	941
Entropy (8bit):	7.401829576800934
Encrypted:	false
SSDEEP:	12:6v/7KgbIpuNvt72+QEaHMmxhwzI3ULhBZI+9z3TH2urKBJevWfAASdx3Epfpdzy2:zg5DjaHbxN3yZI+9z3THTesVzQh4YVJ
MD5:	01705151B2F2245471AB727C7C7CCA88
SHA1:	C70A5F62FD793812F20CD4359319C3E3EC0E156B
SHA-256:	06F93EDDF2435717426A15156EB086CE4D65D3DE3DAEEA757B0DCC9D6AF52782
SHA-512:	DB2B0E0372C847E40B881535ED70544A23CCCC50628CA384FE271259918843E8237635480CA77ECAD1C4784A5A335D9A83E93F35A7EFA05418C3DF4F01A03DDC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/icon_disasters.png
Preview:	.PNG........IHDR...d...........]s....pHYs..!...!....e...._IDATx...?h.a...G-.R.C1up..op....I.Q.....S..A(... ....X..`.8T.C..A...j..EA".IImr.....~?.!!wy{_...M.......P...#6^..~.H...Gh1.....hg....b<.A..+.Aj.#.Aj.:.A.... ...B..BD!HJ.Q...3.A.xE!.#.(.q.6.A.H.. .$.B...D!H`.F!H..D!H$.F!HD.D!HdsE!H.... ..-JCV......I.}.._...F...e..g`...p.......af..Y.J/_..!..&k.H.......3E"...6..=.[N^u.O...\....).DY[>../...1..C.1..#1... z.I..\........U=..t.....U...N.....=..y?6....j......cI.9D.A..D...I..Ce.O.\|d.o>e6........vs......,1..C.1..#1.._M..+>.....7...`T....C.1..#1..=w.......w......4.lp..!....!.........n.-..l,.H....W=.%. b.".u..!o]...n.5...2~.]..,1..C.1..C.1..C.1..C.1..C.1..C.1..C.1......./.{8....KbGwoM.=g....!....!....$.3D.A..D.A..D.A..D..j..._6>9U..%......w.R...;..u. b.". b\'...K..9....5...g..~LS.%. b.". b.". b."..wg,..a....D.A..D...bX~..%K.A..D.A..D.A..D.A..D.A..D.A..D.A..D.A..D.A..?.af}..@H0..iq.:z.!4....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_factsheet[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	709
Entropy (8bit):	4.985154720732652
Encrypted:	false
SSDEEP:	12:tvG1W7x7dXAKdGcdVeNSR5jxjHc0zVeEjxjHc0pAvZVeUeo5jxjHc0FSUnFcUaju:tu18dtF4NSR5jxjHc0z4EjxjHc0WvZ4A
MD5:	BB4DB2261C36D95C4BAF6CD77FDAA6B0
SHA1:	D0575AE32338FD2AA915B45672F40785D7FF6EBA
SHA-256:	F941CB25678894316914F28DF67F6FF654BAEEE0DF2050A617FBEDA817071134
SHA-512:	A07518569850592E4C1DB7B8B58A441ED198E0562E475CCA2B2B5D58F31336855AE45E5ECDBF3F7EFD1C356D8F42F31F31C1B34ECBD80F400283CBD14DD8B278
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icons/node-icons/icon_factsheet.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33.502 44.3623"><rect width="33.502" height="44.3623" fill="#d6e3ec"/><line x1="6.001" y1="36.6795" x2="27.501" y2="36.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.001" y1="31.6795" x2="27.501" y2="31.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><circle cx="12.9747" cy="14.4882" r="6.806" fill="#005287"/><line x1="6.001" y1="26.6795" x2="27.501" y2="26.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><polyline points="9.57 15.015 11.595 17.151 16.934 12.033" fill="none" stroke="#f5f8fa" stroke-miterlimit="10"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_webpage[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	789
Entropy (8bit):	4.932324967389328
Encrypted:	false
SSDEEP:	24:tu18dtcijxjHc0gsjxjHc0KQNjxjHc0LtljFR6HcPYNtjxjHc0Y:083zVpzVK0zVLJRe0OzVY
MD5:	8B2D1AAA07B7FE8DB4C23719B79B9C6C
SHA1:	52B2BB8AC728FF345E2851B3F9A2512C85A913CF
SHA-256:	C3B193FEE67BB8C4B5C631F672AB5A1A8F32555E3414F1AC48B4603883271F62
SHA-512:	DC4A8AE4B6585DD9D7B15572DE1C9970E7A2F6AD50E45676290FFAA377BBC99FE9D3028541C2772951BC06E4A26397025E3330D7660D38B7E040C8E8C924D889
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icons/node-icons/icon_webpage.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33.502 44.3623"><rect width="33.502" height="44.3623" fill="#d6e3ec"/><line x1="6.3157" y1="38.7079" x2="27.8157" y2="38.7079" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="33.4767" x2="27.8157" y2="33.4767" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="28.281" x2="27.8157" y2="28.281" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="9.453" x2="27.8157" y2="9.453" fill="none" stroke="#005288" stroke-miterlimit="10" stroke-width="4"/><line x1="6.3157" y1="22.881" x2="27.8157" y2="22.881" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\illustration_featuredmini_covid_careers[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2618
Entropy (8bit):	7.834641138650524
Encrypted:	false
SSDEEP:	48:k1sFC917mXpfKy0geuEl0R4AmEMo7XsaQvVNR2OrlMMYedxhfk1DeSJlXGIIs97:k1sQ917mhKyjeX1EMo0RBiMYeZ+iSJlJ
MD5:	55CB16CDB54A00354780BB1FD75B7596
SHA1:	2E4E8BE7EADE833999F4EC19738ADDF4B2884BC9
SHA-256:	1C61AFE9D4BF3E72E9E4F16205F0401623DF62529D01F6731FF4A88042C2BFD6
SHA-512:	6CCFF5AFB29707732847731492943301D8614C52D6D9823676DE584AC447BC4F21AE3458DE8DBC5BE2CE8B81278D906EB81C9865FBCD3842DB4704A7CCEF1359
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_careers.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx...oLU..........GP@.V.........6)..[...i..i..o.W...L..Y...4.kS.W.I...U...6..Z&uiQ..z... (.....{.s..=.9.Or_(.{....<.<...011A.R.._.$!. ...Q. .B.A.....@....~g...e..3D.....(@D]Dt...n?.z4../....@..6.......q{....x.......m....P.I.NB......mMD..#o.Qq...~-NB...Q..Q......p..o4.+..]...B..krpl`...I..}..V`.!. ...Q. .B.A.....@....(.cut.../.('......+VUwt.]-.....l..x@~..(..\.CN.X....kuBsK.....(..D!. ...Q. .B.A.....@....._..x. .6q.....]_.+Xr=!...lX.t........TP_V@u....\|......49.} ....\I.E..N^.h..C.....9...r.....wQgo..3>.f.<..7...~..:.7%..U.&.D!. ...Q. .B.A.......PO. ...M.Iz.b/.........w...t.......O.d....<.T.g............4-...;......\|...z...z\|..K])[..Y...L.p.\..~.+z..Wak9U\..n...M.Z... ............x..D. ......[...z..e.Ytdg.67/^...0..yO..=..=}..K.r.......vO..H....<%^./.......\|.AI......].....:./....5..t..@.........kV..........S...Q...KM.`.T.....coK...QG.)K.....Qz....;_\R...6x.q.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\illustration_featuredmini_covid_economic[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3116
Entropy (8bit):	7.863078074083735
Encrypted:	false
SSDEEP:	48:3CpmHV999WxIRzrO4t28QFhUN2TNRoWqODef6Nq1yzLOyKP+9x:HpBtpxigODer8GQ
MD5:	103DA5E25E66933B4CC94AD667F48B4E
SHA1:	EBDA1A264DCAF66CC30E28B57FA2B63AE9988011
SHA-256:	017A134A45ADC0F540F661F27C01CE99ED2B84E7977565C5BD3BE45CED4876C9
SHA-512:	CFABF2B688C022153B38DC192C2B00BF9ECF3CD7B69998E0CA084D6F1127808A3C8132FC7B48600DF126697A40070B935959B7B9512C5B5780FE4BECDFF7A1ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_economic.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx.._lT.........6`..vP0..;B...b.R.Fi...jE...%H}.B.EU.>V"y.CK..R..F..Zp.ZHk..............]}..^v.]{....~...^....g..Y4==m...g.hB..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HTY..7....1..r.0Z..wg.')c.....O$..LT.... Q..$.P.D..D.y...)3<:a.......fht\|.t./]l.....K.M..BS...6.x...{.}...............3h.-,(0.E....T.XFA..g%.X.......-395..{...".........R. .......3...fY2......K=...r...Xa.....k..N.6.]}N...,.'....aS..,.-b.....B.blb.tt.Y!..T.(..q"w7....62.ui.n.~.8....\.a..\....5.....+..=.u..*.c.q...w..(..uB ..l5...g..p....>..D...+.a.7...Mp..c..@}u.y..~g.....6..u...y\|A-p..}.ut..D.8..P\|.K...d..o....D.X.je...k.H~\.@\|Z.v..+.. P<....s1.C.N..6...z....;z....O........$...t.@...9....;L...%oM.....I.3p...GE&A.........?..}{.g....j..^...>_.H...GA...@.L..,.../v..........Q.a7...............h..\..6..]vr..y@.(.>...e..g`..=..H...`]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery.colorbox-min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20186
Entropy (8bit):	5.099467750395556
Encrypted:	false
SSDEEP:	384:D67gfC8BC9dwlGLqZCf/rQ5O38UxH7nHuUV/b:DRfC8BC9dwvsbQA38Mx/b
MD5:	4A85AD65F7F3C9A3FECFED3F3718B9B6
SHA1:	EE0CF4711566A9576B31FFE152F9152D69A89E99
SHA-256:	5A3CC48D900A5D6C3FE74EFE54186C088F7C5CD0F996DC3D97F4C6C981427BE8
SHA-512:	6D5997C4CA3E4F2A59C1DFEA7D34B93EEDC498535C737918AE8604248252EED3FDD6BFC3D159D47741747C5013653D01DD474BF865FA6269773767DFDB62481F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/libraries/colorbox/jquery.colorbox-min.js?v=8.9.13
Preview:	/!..Colorbox 1.6.4..license: MIT..http://www.jacklmoore.com/colorbox./.(function($,document,window){var defaults={html:false,photo:false,iframe:false,inline:false,transition:"elastic",speed:300,fadeOut:300,width:false,initialWidth:"600",innerWidth:false,maxWidth:false,height:false,initialHeight:"450",innerHeight:false,maxHeight:false,scalePhotos:true,scrolling:true,opacity:.9,preloading:true,className:false,overlayClose:true,escKey:true,arrowKey:true,top:false,bottom:false,left:false,right:false,fixed:false,data:undefined,closeButton:true,fastIframe:true,open:false,reposition:true,loop:true,slideshow:false,slideshowAuto:true,slideshowSpeed:2500,slideshowStart:"start slideshow",slideshowStop:"stop slideshow",photoRegex:/\.(gif\|png\|jp(e\|g\|eg)\|bmp\|ico\|webp\|jxr\|svg)((#\|\?).*)?$/i,retinaImage:false,retinaUrl:false,retinaSuffix:"@2x.$1",current:"image {current} of {total}",previous:"previous",next:"next",close:"close",xhrError:"This content failed to load.",imgError:"This image failed to l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery.cookie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3681
Entropy (8bit):	4.432977644958858
Encrypted:	false
SSDEEP:	48:NLocEG3yLTvBekpI9hutXoaRXOEouRKgCyB/ys9Xcmt:OTAyLTvckpILutXoahOEJKaBqismt
MD5:	56B9F5C33F0E746A063D7005855B91AB
SHA1:	71079911CE51C3FF517989A59A756A7AF133350F
SHA-256:	6A7A9B49222B7364759C2CEFDA3AD1193E0BE467146206CE70B80DAED7A8A563
SHA-512:	8A3ACD09EAA869777197B7089C450980B3EFD136CFCBDEE2F1F7896E81464A4F3887B25D6C6E954CC073F1F5B5727B8864B9763D483C1BCBA9BACBBB0EA301A4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/wcm_survey/js/jquery.cookie.js?v=1.x
Preview:	/!. jQuery Cookie Plugin v1.4.0. * https://github.com/carhartl/jquery-cookie. . Copyright 2013 Klaus Hartl. * Released under the MIT license. */.(function (factory) {. if (typeof define === 'function' && define.amd) {. // AMD. Register as anonymous module.. define(['jquery'], factory);. } else {. // Browser globals.. factory(jQuery);. }.}(function ($) {.. var pluses = /\+/g;.. function encode(s) {. return config.raw ? s : encodeURIComponent(s);. }.. function decode(s) {. return config.raw ? s : decodeURIComponent(s);. }.. function stringifyCookieValue(value) {. return encode(config.json ? JSON.stringify(value) : String(value));. }.. function parseCookieValue(s) {. if (s.indexOf('"') === 0) {. // This is a quoted cookie as according to RFC2068, unescape.... s = s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');. }.. try {. // Replace serv

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sourcesanspro-lightitalic-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20256, version 1.95
Category:	downloaded
Size (bytes):	20256
Entropy (8bit):	7.974658775886973
Encrypted:	false
SSDEEP:	384:YlahT1K8Pxv77e+3FRgBQ9MJIZb7CxkPnpWHbpkzg2XBg+lKvh83:Y4bK81MBYmIB7C2PncnIgG2U
MD5:	3FA6EBB831989F031E8BF92297A412BB
SHA1:	E797489A945F0C06A17F56A0B1F3F0AA891572A4
SHA-256:	AE4AA077E7150A6A2F01797C2C0B56850BFBAB1B334CFC61019B0E80DA44608A
SHA-512:	BDF528C153E07088E808CB377F40A5E8E8FF8EFCFF8B68486F85264F9F61BF056A09F74C5266A588FCB2E9261190DD0FB89AEE6F13FBF19A100AD4A805C8ACA9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-lightitalic-webfont.woff
Preview:	wOFF......O ..........._....................BASE..E....F...Fe.].GDEF..E....^........GPOS..F<...e...j...EGSUB..M....\|.....s.OS/2..8\...Y...`Z.oecmap..8....o...v.._.glyf...D..1...S.aZ(/head..5D...6...6....hhea..88...$...$.v.#hmtx..5\|........g%5.loca..2l.........J.-maxp..2P....... ....name..>(........-.i.post..A@...T....8(..x.....\..?..m......{.{..{...\|....{.7...PC1=.`....w.......!\|Sqz......mR..}.<if4..F#....."+..Cu... =Bi.........~^..rZ-.8..w.6.....O.p.W.....~.....3{..u'N...}.U...3.'...)?......hk...~...+....<P.A...r....3.;>....\|.#.}.=.nr.....@6?H..tZ..y...A.S(.z...<.N.....O.c'.n....\|..+&...3.j..w.....5...dJ.-8.6./......{..:.B.....@N..../..$....xO..4..Q..}1.nNEW..h.3......~.twlT0..../.....x.g.D..\....q.<~DX..L7.....t.....{..S.<x...+......n=t.S......\.R2............cx....4&.2.v...[.^.....p.#....._....z.......<.Os..~b{&:..t.8.Et.....`d..._...g......{..I....i.?#.......V......T.p...._..+....U......c.OT..A....u.Q.7..g.!x......Z.a...:.1..yCC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\wcm_survey[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	14633
Entropy (8bit):	4.315278643828363
Encrypted:	false
SSDEEP:	192:LixiNakySlg+dGIwaSJTCjbeyNccTbAgvPN6CBaZrLYLJgOWWlOatE6VyxZb/VLU:M/IbykMvH8pE8KUaG
MD5:	C616323DB283DF039A1D28E2D1C011D6
SHA1:	A0CA16CC5166E11D7A0CA544BF415D1D16933588
SHA-256:	E10C3593CCE4DE5AEFDF6D3516536A918F7C44FD6A22D4BA1637784B198AC55C
SHA-512:	3B6C9FB2519B0DFC13194A89784C08E151915D3C15780AB4B8F5532F50543BB901C211D6BD4F1509015534E9A9588201534F35C5C830B4DC82C4F24BE1AD5171
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/wcm_survey/js/wcm_survey.js?v=1.x
Preview:	/*. @file. . javascript to cause a popup to appear to invite the user to take a survey. /..var wcmSurveyPopupProcessed = false;.var wcmSurveyBypassSurvey = false;.var wcmSurveyPlacedInFooter = false;..(function ($) {.. /. Log to the console.. /. function log(variable, label) {. if (typeof drupalSettings.wcmSurvey === 'undefined' \|\|. typeof drupalSettings.wcmSurvey.debugMode === 'undefined' \|\|. !drupalSettings.wcmSurvey.debugMode) {. return;. }. if (typeof console !== 'undefined' &&. typeof console.log !== 'undefined') {. if (typeof label !== 'undefined') {. console.log(label + ' =>');. }. console.log(variable);. }. return;. }.. /. place the survey markup in the footer. */. function wcmSurveyPlaceInFooter() {. if (wcmSurveyPlacedInFooter) {. // this only needs to be done once. return;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\world-icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11652
Entropy (8bit):	7.870294742412392
Encrypted:	false
SSDEEP:	192:Iavo3gMbRfmSGLfhpETA4w92P/U3KoYQNXIvlsAEjlo2GnYQFnhr:fCsSST1QU3jNysdloZY4B
MD5:	4C5FEFB79E028D093197BA23959AA070
SHA1:	7A646F38446D99640862271ABF13328551D2E592
SHA-256:	EE10D15710AF3D9ADF7A349EDCA757B35C5DE9279BDD7FC9FA7448506C707FD1
SHA-512:	35F11A3604F96CC1786A4BBB40E037D1FA478F301917F6C2CC14B58B3F86F8AC69D0B3D73285D9917D83935D7609DD028CE4C4A92AEDF4803EC60BBC878E774D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/world-icon.png
Preview:	.PNG........IHDR...,...,.....y}.u....sRGB.......->IDATx.....U.....;....@d.....T.qF...-0....k.l2....."[.K.... .....D6A.AvY.d.dIH.Izyu.....u.[.T.{U.........=...u....!...............................................................................................................................................................................................................................................................................................................................................................................................................).V(.....u4..OP..#.....f2..$..J.O"......T/...."..r._...~9...]%.....J"~)...y........u...K..+/.D.4.t.'....[.....8....a.H:/..{B.>N.y........7.......Jj.8t^..`>G.:P.. ../.c.....^%..w.<.#r..!...?...2...3.X......Pr....."Nj.X........;..[i.......kT.U7.8......7..(}....%-.]KG.F.~V^.o .......I..%..U...8ogrR..c.%.[-f.p..i....O..L.Z..aUk..{ZG=M.\|8.3[...d.-g;..>...z....~.D.r...U^xY.g...R..7S\..f.0...0.....w>-.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Bold[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26892, version 0.0
Category:	downloaded
Size (bytes):	26892
Entropy (8bit):	7.981580169302439
Encrypted:	false
SSDEEP:	384:j7eBYLLHasHoQKD1ZD4CsYl+i3leazBvwqNgXBad5aTIe9MxxSH+wXTATm8PhY5:LLLHv6djl+i3XeqKRanajKxx6+wXTn8W
MD5:	704B3917B84CEA21AE1466CE46C61F69
SHA1:	27DA5AFDBF4CABDCAB9DB0D59BCC77944090ED85
SHA-256:	31AC3086C758E8082B42C188A4028EA782DFA0C9C39A9C134242479B148C7812
SHA-512:	063467896F3DB0A87E0E9B183C5FF276AAF8F2657417CA36B5365D2B7867E9493F93E9F65EF61DB64F7ED5FEBCDDF780E0A7977D2EA26B379B05DF866D44B7B2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Bold.woff
Preview:	wOFF......i........\|........................GDEF..g,...D...L.G..GPOS..gp...V...`...GSUB..g....A.....S.fOS/2..Y....P...`W...cmap..Y............jcvt ..ad...A....6h..fpgm..Z....<....vd.zgasp..g$............glyf......S....n..W<head..V....6...6.A.fhhea..Y.... ...$.0.2hmtx..V.........b..&loca..T.........O.).maxp..T.... ... .m..name..a.........)...post..d....}......t.prep..`..........0.hx...`.W.8.......{_m.v...ZU..m.Rd[.Kd..N..8q.8..)...!.H...I...; ...G98.;8.... .h...Yie......y3..}...7..).85y.q..).......6...^...b\..vN.8.g.S~..G.m}.}....q.l.....m...m.y....i.e...a..VB<......!....7..N#.0.3.Jk.sa.T.mV.".......hM&r..`.;.x.9...M.d...'..O.37..hh.i..K....g...0N.1w......A4.C0....x.!^.E...B.!...k..?..........O\.S..y.........#.Y.O.^.....AI.A..Tj...b.:..Y.}^.\.v9.v.........0.+..5,..a1\....c....O..2.....2..g.'Mw................?..I...A....Md.....J.......#.c.~.i5.).."...4".H...=..E<......!;.+...p.....G7_h.LE.6.=!..TzR.E....8^..m.\|...fq.......]...pHa.......#....<.T.p..i...:{t...^A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Italic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 24152, version 0.0
Category:	downloaded
Size (bytes):	24152
Entropy (8bit):	7.979130802237579
Encrypted:	false
SSDEEP:	384:JjXSaOhNuT+vSmZgppmsRM1RRedVQCQ+JOnqT4kfoljvPFwFqiaqgd7LIZh+gC9r:JjTQNM8AjdRM1RRMxSnqUk2rP+ad78ZA
MD5:	B85B8AE5763647FDDAC32F6843FCE5D0
SHA1:	077E9F2E1BF04794AF8FA55133F90162B74F6401
SHA-256:	99C4FCC227BC330F02658F5A77F4DE0DE380E9053B3377C01DC313C8D1491C45
SHA-512:	444171E83CC75046AC2A569E7D9A9ECDFC82A679D399A3DC96CDC49CDD498D458E538176256C9D57004374F13EA156B5CAFACB54A7AABDA968248F3734B31A3B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Italic.woff
Preview:	wOFF......^X.......8........................GDEF..\....=...F.I..GPOS..\.............GSUB..]X........(..vOS/2..OD...R...`U.cmap..O............Rcvt ..W....A....5:..fpgm..P4...<....vd.zgasp..\.............glyf......H...w..&..head..LT...6...6..ghhea..O ..."...$....hmtx..L..........\| .loca..Jh...........hmaxp..JH... ... .^.kname..WL..........$+post..ZD...H.....k.4prep..Vp.........0.hx...\|\Wu?~.}..}....".h4.v..].,K.l.l.v...8.c.8!.Y..$-....@......B[.......J.... ....%...oF........+.Hs...=.,.s.9w.AG...i.!.R>..1"..)d...E.(......'...'Z?...G.k{.q....cO=.....O=........p3...'P."..Y..>.....e..h.d..%.E..\|..fUD.....)$=nw.g.p....u^G4.u...k...\.1.4<2rH...!x^.^......P._.y.?+...+...9`4.8.U...hE.5.I3..z....q...x..l...MJ_..)......../R..1x...p8x...{...w.s.?.:".......`_...S._....t\|...z.._.dH.......zK.~...c.a.s.....3.G.4.....aA...ca..X..Dl..U.t...,...?.7....M.47u.n....!F......f.w~..5..7[w....m(.;Rhh.kh[.....,.V..=..NK.MM.....F.Kw..:..+&}....]M....;.Sgp...Z..@.h.....H@..A[.`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-LightItalic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23808, version 0.0
Category:	downloaded
Size (bytes):	23808
Entropy (8bit):	7.980219682523817
Encrypted:	false
SSDEEP:	384:PAc1Z+BQuy+CFwQM4ndVsuFTDU7FaY37A07FZ87hmJchPM3kP+r9smE1QztN9:Ph1Z+Ouy+itnddRDO77e7kqhPjPyE1gB
MD5:	AF8E7E14F7CDD26EA1024D2CF618B58E
SHA1:	5CB3474CECDB40DC5C6320030258A493E2DEABF6
SHA-256:	1275C33F64E5332F0C1C6CCE7BF78C7AFE715746248493780E15187D54557B15
SHA-512:	02FE231C55DF03D31EDD2881E531C3AB16B2688AFCAC7F46AB64DBE9220E1F1641AAD8F7BCFA2D7F4BE62EC610D509ECC3737B9282BF45C457345476F522F56E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-LightItalic.woff
Preview:	wOFF......]........ ........................GDEF..[@...=...F.I..GPOS..[............3GSUB..\.........(..vOS/2..M....Q...`U...cmap..N............Rcvt ..U\|...J....4..Lfpgm..N....<....vd.zgasp..[8............glyf......GO..v<...%head..J....6...6..Ihhea..M...."...$....hmtx..K....~......%Qloca..H............maxp..H.... ... .`.Nname..U....&...n.;.post..X....G.....k..prep..T..........0.hx...`\W.?\|.}mz.WI#.H3...j..$.l..8....I.8..$.J.$...O..i.e..XvY.,l............?x..{.4...~_".4w.{..sO..s...:...$g...H.Y....O.Ac.`/..q).........<....[..;r..#O<.....?...}.....p...../z..........- ..pc....+.is....\.f...P..[.76F.v[.e.s{...X.f..m..et..1.=.l.!....R........$.0r#?.,.....k$.p:.!.#..z%.5*.....b.:...x<~...u...;<.l2..3...t!\..9....._.........A.bW...N.Q......w..i.;.D..?..Y.^./....O<.....q....P3.-..^...#@......I..#\|.L...... ....0..,lh.........[.^...s.N..X.3..45v....\|....u8..a.......z..~~...l.c..X>c.u..j....L....'.....-]...Ec..wj.[4Y.=...G...d.6..s.]{......[#.P.`}.....h.xi..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Regular[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 27512, version 0.0
Category:	downloaded
Size (bytes):	27512
Entropy (8bit):	7.982147322572132
Encrypted:	false
SSDEEP:	384:RpLxI9raOnIJQihEbb7UqsnkjBKUr4lH97ErEs6vlyov79ZE418IKkkjTm0MmpYH:3VONaEbvEkjBKUr4hVYaVPCrk507s
MD5:	73C28F4EC1AA47641399DA34948DB75C
SHA1:	7FA7EBE77D5A0A6F3193E224399D579BD00DBB15
SHA-256:	BF534A2BA29317B46AD1FCAB142105C1D0E1A70191EF55F4E1B29C786C8AD824
SHA-512:	9B0F3FA2F3C0EA06964B8B8946986910F20027079A71712445E6CEC310DE5EED17851107D4CED65F504FCE7B90DEE3F3AF3B9761CFC07E16381575EBBFF47343
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Regular.woff
Preview:	wOFF......kx.......L........................GDEF..i....D...L.G..GPOS..i....V...`...GSUB..j4...A.....S.fOS/2..\....O...`U..cmap..\\...........jcvt ..c....A....5...fpgm..\....<....vd.zgasp..i.............glyf......U[....W.8.head..X....6...6.1.Xhhea..[.... ...$.!..hmtx..Y4........X.&.loca..V..........H..maxp..V.... ... .j..name..d.........2.post..g....}......t.prep..c4.........0.hx..y`dE..^U.u...+}.Nw..t.;w^2...$..$sefBf....a........D...A9D.Y...X...........".....z.;.L.......t.{U........!..".i..CF...V..iHas...D1!$....4Kcx.#...o{.G.i#O/...K'.(>.P..h...z.A./.../w.....<........n.q\..CH....3+T....p..kr.m.H8...g0.e..h&...,.%W..b..%c^:.).5.[....h`.I.Y.H0Bx...9.k.Gt..pq.t..&.....G..xA)MA)O!..~e.....~;.Y:......'..G.........nP......}F.A&..Sk.zQ.5...V.......q9aqVs.?./UL.\|....?{.....?.?6.....gM.1....r...[M..g-..Q.COv}.....>.......T4..v...@..Q.x...aA..0]X;?2...`.x....)."(.iD8.p.@w.."AP.#."3.;...Z..yF..B.....3.n.5...-......../...g.......6l1.#V.U..J#..38Q.9.8.T.7...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	48759
Entropy (8bit):	5.5215063523389265
Encrypted:	false
SSDEEP:	768:/yR3fYFBLbfsce5XqY1TyPnHpX/KWY3SoavPVRhwmCgYUD0lgEw0stZc:/y9gZfA5h1UHpXxY3Soiuw0sU
MD5:	0A4E309B5F2D7439B4F8876B19F37FC7
SHA1:	7AC30F933A2B889EDBE5D3449F4EC90049B0E2A9
SHA-256:	F79723478F4C48501CD49AC52B81D6244A6562B9D3F08CE8AB208A8B8878D4C4
SHA-512:	891337D9CD308331BD0166BAA7C99C2B856D47F0ADE8AF596F71AFFC962546BBE0952554C51CC9A10E28BB4CEE3648AEC819D83A8935E69E95F53F5CBF141C44
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\angle-arrow-down-primary[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	536
Entropy (8bit):	4.458359665373743
Encrypted:	false
SSDEEP:	12:t4zSMMZI4bfUgkju1LPAuLCdVISuSSWFF0b080/tLvSGABb:t4zSbZIVTjmYuLCdVIlSfnvK5
MD5:	D0652B4DB22232AE88D5615B6C8AD13D
SHA1:	D37BFD0D5AA3C84956E14F7068DB34F0E6B8491C
SHA-256:	AFAEE6EB7874BC5367742AF8802FBCCE763860FC67BBE9E9890368D7A405D542
SHA-512:	3F71D0EA83ECC0B79D557DE3C26AFFDBB0DF705FB861CF7FB33CAC4A964475A89C1B6836449FCA56C5C0F756289EC5052E4652BC47B3F1446B66CA6BC3451A69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/angle-arrow-down-primary.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 284.929 284.929"><path d="M282.082 76.51L267.808 62.24c-1.902-1.906-4.093-2.856-6.57-2.856-2.47 0-4.66.95-6.563 2.856L142.465 174.44 30.263 62.24c-1.903-1.905-4.093-2.855-6.567-2.855-2.475 0-4.665.95-6.567 2.856L2.856 76.516C.95 78.417 0 80.607 0 83.082c0 2.473.953 4.663 2.856 6.565L135.9 222.693c1.9 1.903 4.092 2.854 6.566 2.854s4.66-.95 6.562-2.854L282.082 89.647c1.902-1.903 2.847-4.093 2.847-6.565 0-2.475-.946-4.665-2.848-6.57z" fill="#005ea2"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89091
Entropy (8bit):	5.033695363472416
Encrypted:	false
SSDEEP:	1536:wr3XMXd+AwljF+vg7LD81XaFKvrfefa2J:r+AwljF+vg7LDafefD
MD5:	39B4468AA9D64F68CADB5A6ECF24695F
SHA1:	706C585B5610659FD9718B853C91710F849702CE
SHA-256:	54D80B9361125322C09703EB1081D8B4E714A58366EADA5D87F9BA8460C53338
SHA-512:	544C5B48FC6A03906F58252BD891F5EE37CDAD9A3E158DA2E932A19F979185CA7CD061BC3D395CDC7D83A94C7FF77BF2D0ED02B0B1E695AA35A991994E57CCFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}fig

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css_grh0buQF8qNvIccuqzcF5vMhz2awV1fMgFle-uW9IwA[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	22326
Entropy (8bit):	5.05208449988245
Encrypted:	false
SSDEEP:	192:hEXJR92FTkLzRYiJayDysyvaAMFt1JgxA/S8oLXl686czKXE5HY/LuJQw07GTeR3:/mZrXXrlCWnW7h/ylD
MD5:	645DE6BFEC028909D15A2DE5C98735F8
SHA1:	0734B2C1869C9E7AF94973FC0EE3D736A5764233
SHA-256:	82B8746EE405F2A36F21C72EAB3705E6F321CF66B05757CC80595EFAE5BD2300
SHA-512:	1E2141F0C68E107EACBBA9BE59BA3CAD3E3336DDC3A7FB6A12A64856580D9A31843AA10BA3B999FCEF5ACBC84A77A008B76424ACAA24163F9AB360A26C24E96E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_grh0buQF8qNvIccuqzcF5vMhz2awV1fMgFle-uW9IwA.css
Preview:	html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}figure{margin:1em 40px;}hr{box-sizing:content-box;height:0;}pre{overflow:auto;}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em;}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0;}button{overflow:visible;}bu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\drupal.init[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	727
Entropy (8bit):	4.98666298065344
Encrypted:	false
SSDEEP:	12:UkaFN0fw0PXlDlk91R6omRVARZrmEKsyAu4W31oUfCSoUfMPc9VwmWhpmf:SXT8lTomRVA13yrx31j5jM6d
MD5:	561D5E5F6F76F15FD1375A9A1C2A18F1
SHA1:	7F5514D8BDFF39269C12134505B9722484ED6CE7
SHA-256:	41683E0BDFED00E74DE14D86441E289271CA70B2A94C721653B9A49DC32FB24E
SHA-512:	B6FFCCAE5515BD354677128CEC38F5C45B4C806D72463C695673D7582C46DD5F718776C16D604D82210ACDAEEA35209DC04F3B628BB9EFD56A930E6714E31E2B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupal.init.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..if (window.jQuery) {. jQuery.noConflict();.}..document.documentElement.className += ' js';..(function (Drupal, drupalSettings) {. var domReady = function domReady(callback) {. if (document.readyState !== 'loading') {. callback();. } else {. var listener = function listener() {. callback();. document.removeEventListener('DOMContentLoaded', listener);. };. document.addEventListener('DOMContentLoaded', listener);. }. };.. domReady(function () {. Drupal.attachBehaviors(document, drupalSettings);. });.})(Drupal, window.drupalSettings);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\drupalSettingsLoader[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	519
Entropy (8bit):	5.161310412773144
Encrypted:	false
SSDEEP:	6:Uwq4VCi+5cGMKN0fGLB0PQwPoj/LR7nadOXCuhtdz2mySYuhtdz2myGy5mpq3Wja:UkaFN0fw0PKjNWdAbZbomvNXmirN5fgn
MD5:	49DBE4BAC61E9CA48A5951BCBE0D03E9
SHA1:	020EFEBBF1F6E97D39DDCDDC5262F34C1DB7807F
SHA-256:	5F8F69EC521F7998AF455985A8EDE6D8DCF3527B43795FE3D26F1F1B57A5A554
SHA-512:	C184CC753599864802BC90582698CF0D66E2E782D34ACD2E1EE26CA3F03BBA8C9D4FB2DB40E9B13FE0568DD9ABFE147EDC8A86FDD1B8EB5483AFA867C039C375
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupalSettingsLoader.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..(function () {. var settingsElement = document.querySelector('head > script[type="application/json"][data-drupal-selector="drupal-settings-json"], body > script[type="application/json"][data-drupal-selector="drupal-settings-json"]');.. window.drupalSettings = {};.. if (settingsElement !== null) {. window.drupalSettings = JSON.parse(settingsElement.textContent);. }.})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 108x107, 32 bits/pixel
Category:	downloaded
Size (bytes):	47998
Entropy (8bit):	3.6375882047289023
Encrypted:	false
SSDEEP:	384:8UP1rUUmpmH5B+uTdrFiJAVQJJJJJJJjJJTIJSJJCWJJJ8mJJJJvs0JJJJJJJJd6:8UP1AUOKNCT6
MD5:	0610064CB73C5B9BC9B13ECC32916BAB
SHA1:	C1C20C329913255E49173EC60ECAE74D8EABC21D
SHA-256:	4F480AE00061AE87D1C9EFE6BE1B88766670EC8B43314765CABF3B587BD64BB3
SHA-512:	335EA0FA4D4D6FC3E24329E6C8C689FF6CC1170EF2F0DA2424FC794F44F7FBC94A266761A6FB7F36AD61CD6359BEB0EEA08F7774C5AAE8E5B68F33A413087EAC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico
Preview:	......lk.... .h.......(...l......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fema_saml[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1759
Entropy (8bit):	4.990612441581551
Encrypted:	false
SSDEEP:	48:kMm/mZrTvOfZtVKBr/7svaWPycxKq4uEvw:njOfZEsiWPfKq4vvw
MD5:	A78D8568D656AEC6DC5EE905D9259683
SHA1:	A1AA8B42A398391B0090CE529BC6E17260F40FD3
SHA-256:	B72F28534ECA12C883E1D3FD6BDDB7DB40EA0F6294678163283113CD97A329B1
SHA-512:	D54BDD7902BFAC1AD12DF68CDD5FA05525DCCAC795D5C1DEED107A799E4F2EBB54B14CB72858CE5E09225B7DF800D5F775DC92D8996D62E8D4ED76DBE7971C97
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_saml.js?v=1.x
Preview:	jQuery(document).ready(function() {.. // Jquery is being used to insert some divs and text since the appauth module is in sites/all/modules. // Wraps AppAuth button in div to add styling. jQuery( "#user-login-form ul" ).wrap( "<div class='appauth-area'></div>" );. jQuery( "#user-login-form ul" ).append( "<div class='clear'></div>" );. jQuery( "#user-login-form ul" ).prepend( "<p class='appauth_subtext'></p>" );. jQuery( "#user-login-form ul" ).prepend( "<p>Insert your PIV card into your smart card reader.</p><img class='piv' src='/profiles/femad8_gov/themes/fema_uswds/images/icon_piv.jpg' alt='PIV card image' />" );. jQuery( "div.appauth-area" ).prependTo( "body.page-user div.region-content" );. jQuery('div.appauth-area').before('<h2 class="h2break piv-login"></h2>');. // injects variable for text located in html.tpl.php. // jQuery("p.appauth_subtext").text(AppAuthSubText);. // jQuery("h2.piv-login").text(PivH2);.. // function to parse the url and if

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fema_stacktables[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2406
Entropy (8bit):	4.530672548345211
Encrypted:	false
SSDEEP:	48:0ExQjroYU/ToaOqJT9UBPAh7kalDWxV0xtN99vygaTwkYf/YhCUxOZtXafy7hlxH:0ExQIFhpJT3h7kalDWb0PN99KgaTwkYX
MD5:	8C2A543EEAA0A49BC3B277BA1E922256
SHA1:	2AD7B3E696143634E2C2175CCE7EE69278F3A84B
SHA-256:	1760C784FD76B0128F0AA3C52F5C6885940F768095E4C53018593843517C2F48
SHA-512:	411F23E9773A88F72E8EE1D52F4B370584116E2F79D4ECD4F2A7F3D35CE78FCBCF3ADDF814424D4283FE881C7C8AEC2E63FF3E315FDB937358649A0A95C82530
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_stacktables.js?v=1.x
Preview:	(function ($) {. 'use strict';.. Drupal.behaviors.stacktableResizeBehavior = {. attach: function (context) {.. var mobileBreakpoint = 800;. // Resize timeout event ID.. var resizeTimeoutId;. // Resize timeout duration in milliseconds.. var resizeTimeoutDuration = 0;.. var resizeDebounce = function () {. clearTimeout(resizeTimeoutId);. resizeTimeoutId = setTimeout(doneResizing,resizeTimeoutDuration);. };.. const targetElement = 'table';. const datatableClass = 'datatable';. const datatableSelector = `.${datatableClass}`;. const datatableTableSelector = `${targetElement}${datatableSelector}`;. const datatableWrapperSelector = `.dataTables_wrapper`;. const stacktableClass = 'stacktable';. const selectors = [datatableTableSelector,`${datatableTableSelector}.large-only`];. const smallOnly = 'small-only';. const largeOnly = 'large-only';.. var doneResizing = function () {. var width

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fr_gS3tHmI3ppuHDLOinbISzm3sUzwHeI0BWG1M1IE1h6M[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6734
Entropy (8bit):	4.86794480785369
Encrypted:	false
SSDEEP:	192:N7FQO3QptQOE0MyPOylJXVMXUaEThCXrwJaiDkdY:4O3gH/SeCXrwtDV
MD5:	C72554E607B10E705296D641DBA8AEF6
SHA1:	5A79CAEA2879DF9DDD68A77983C0791D995CD8E6
SHA-256:	812DED1E6237A69B870CB3A29DB212CE6DEC533C07788D01586D4CD4813587A3
SHA-512:	A23B5F5DD89866162A9E9129B28629A480C7B441262E4BF03A328B7B2F47B2E42A58F4C5CEAAAAE26FC0A051BFE01629B820606011A4B90470665A149C0C94EB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/fr_gS3tHmI3ppuHDLOinbISzm3sUzwHeI0BWG1M1IE1h6M.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Hide":"Masquer","Changed":"Modifi\u00e9","Collapse":"Replier","@label":"@label","closed":"ferm\u00e9","Home":"Accueil","Image":"Image","Link":"Lien","Unlink":"Supprimer le lien","(active tab)":"(onglet actif)","Next":"Suivant","May":"mai","Sunday":"Dimanche","Monday":"Lundi","Tuesday":"Mardi","Wednesday":"Mercredi","Thursday":"Jeudi","Friday":"Vendredi","Saturday":"Samedi","Alias: @alias":"Alias : @alias","No alias":"Aucun alias","Cancel":"Annuler","Title":"Titre","Status":"\u00c9tat","Submit":"Soumettre","Group":"Groupe","Author":"Auteur","List":"Lister","Remove":"Retirer","Description":"Description","Disabled":"D\u00e9sactiv\u00e9","Enabled":"Activ\u00e9","More":"Plus","Taxonomy":"Taxonomie","Download":"T\u00e9l\u00e9chargement","File":"Fichier","Tag":"\u00c9tiquette","Edit":"Modifier","Date":"Date","Search":"Rechercher","Reset":"R\u00e9initialiser","None":"Aucun(e)","Category":"Cat\u00e9gorie","Settings":"Param\u00e8tres","Import":"Import

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	103197
Entropy (8bit):	4.335562748883692
Encrypted:	false
SSDEEP:	3072:Gq/b6NAz1yPJl9zQFGcQ8TlP3GVSB2nxv8x:Gqd
MD5:	BA582801B17EB54324D87D88EDDBA2E6
SHA1:	BC58FC7A3A7A7DB7BECD4831992D5F1E1D455EDE
SHA-256:	C05D322C0F04C46DCB25D18E77DA57DC6BF3F203DA1DA07837C12734C3E435E5
SHA-512:	E9AD7A08C1CC0C4D5BF487F61185EFAA60EA57AF0044EA5C9FF77EBB3C43B6EE1178DE0D9399D3465349A627ACC283AC8DA52038B30C943D240AB350766E49F3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/es/disasters/coronavirus/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="es" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ht_jsmTPvUkPo3P9JWlMIAn6G_o1cITWsWmpoeGs6kH6b8[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	142
Entropy (8bit):	4.798554372742572
Encrypted:	false
SSDEEP:	3:FQgEiKRLLWiOWRcxWn2uuJwE+fKHfH3AUaicHvkuKEJ2YcufeHAVJHBA9f/ue:FqiKR/WpWRcxi2ziRiHvAUJcPkLE4rQ6
MD5:	10D73D2F2A031AC5168CE16ED43052D3
SHA1:	0565362A5BF2A0C3C3B752A5A08CDCCEB748A042
SHA-256:	8EC9933EF5243E8DCFF495A5308027E86FE8D5C2135AC5A6A68786B3A907E9BF
SHA-512:	CBD5C9B9AE8E9C6F39894EDDFF0710B6C1884357487A966FFE4839506AF16C6F895AD3D4D5A34637BE928725E00CDE741FD77186A981AF64F28F89469D6F8E58
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/ht_jsmTPvUkPo3P9JWlMIAn6G_o1cITWsWmpoeGs6kH6b8.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Enabled":"Aktif","Search":"Rech\u00e8ch","Apply":"Aplike"}},"pluralFormula":{"1":0,"default":1}};

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\icon_release[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 100 x 133, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	911
Entropy (8bit):	7.43355335205232
Encrypted:	false
SSDEEP:	24:zg5qQq8jCQcCQcxx7QYrBWm2QCQkcCUn7TpWeGjw9CQcpDCQcCQYkj7:hWjIIVKQvn3o7EMI8s
MD5:	9359BFC3EF8CDAE619AB073189414AA6
SHA1:	0DBC39D10D83378F1162F081036AA1F5788372AA
SHA-256:	42F2E4CDFD40E2409BBF0E4E05D5E42AF38B3AEE0CCEC5D3E6343188BAE0887D
SHA-512:	912DA6CD6E5091637BE7A176A8C54C18D2979F7EA86E5C66D1C40A1280631A1DB5F5911F36F79ED4EF71702161223C6496784F248624F837679900178014EC87
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/icon_release.png
Preview:	.PNG........IHDR...d...........]s....pHYs..!...!....e....AIDATx....K.Q...W.m....D......!;gt...;z...A....x...)..lA...<....P#...xR...v?g..Ew..9.3o......#..)X..c....... 0..1..A`..c....... 0..1..A`..c.......%.p.>...U..{...p.h+`$..$...p...4.t.n...'.c...c....... 0..1..A`..c..$K'{..`x.o.NV....m.w..........r...Q,.F... 1.`..0..@.!...s{. .....G....}.Q4.6HoW{...T....^..(A..\|......y......7..Y...5.Hg..pj.j[..f.W.4..B...[..OU.......nR.9..m...V.... =].._G.Wm..$._.4..B...x.u..u..7...O7qd.....;...........y......U.Q... .d.b......W\Y..L=.%y:J.Ab...,k.C....B\|.a......`..c....... 0..1...?..#.. 0..1..A`..c....... 0..I....ay5_....l+..Cu.O. 1.De6.[.[..=..Q.{...`..c....$....E....m?Kq......S..A`..c....... 0In.W.....Y./.v.......~.$A..7Be.C....JE. ..`..c....$....P.>....kq....;..,...... 0..1..A`\~O..w...3. 0..1......Q..`..c....... 0..1..A`..c....... 0..1..A`...?S........O..IT2......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featured-mini_covid-19-report[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 161 x 161, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2336
Entropy (8bit):	7.803586716889103
Encrypted:	false
SSDEEP:	24:keUjROZmJC11111ewaUusGk+rhe7qNNpJkEYB/ehPXzSidZrh1tbx6L0EqvjOyVo:k4Gk6NZYBKPjzhD5vjOyEws3JNBXrDkm
MD5:	AFE0B9133E5423D8AD90CB8AC6DEB078
SHA1:	8BECCB2BE48F5F4BE28E7153D240595A5005DEF5
SHA-256:	A637A40B1681B13F8EC96807BDDD5BDC7E86326B689C1DAA8D2AC06ECFC1FAF0
SHA-512:	5ED79A6A9BF807A4132D86FF93FACC3A5D5EFF2057D8F4C28D7D0E43DD40B69826FEE5B86B666D509C2B2857DEFAFDD8C0C6FB86CFA37CB46ECD2100050B988B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/illustration_featured-mini_covid-19-report.png
Preview:	.PNG........IHDR..............Q.....pHYs...%...%.IR$.....IDATx..Ol.U.......?.A,"%....%R#. .M/.@.`.z"z..C.1......L8Y..$6A4&............P,)..L.\|..2...ng..7...I6..,3...~o.....L.X.B4..O...D.JH..D.JH..D.JH..D.JH..D.JH..D.JH........".+"..rp..9sNmn[uG..a...h\|Xu.3.\|VD.Ddq.{2.yN..T.%Z.S.9v#`.....'.DM.L.....o..F.,/?.....c....Vf....]....Z...T.h.>...}.q.'L..&..:...C..:...C..:...C..:...C..:...C..:.......X.l..\|.-r...:'.G.j...bT.L....h"67..Z.e....m/.y....}9(#c....i....\.[D>..+R&..0tC6.4E..l...1".;..n.............x..5....ni.bM`*.F5.5.#U......%..!Zk..).!..#..m.....Hk+.$...#.p.gg.X-O>...k..L..@o./.....'.........l.)...........^..+$.v.d..u...q..[R.t#..rx.....EDJ..0...6=...y.>...z.~ (.;;......b...N..cz..F.)...p.kB......g.}B^.~].clh^.<.9....]..1BD.g<..@.A.....7....7:.....&3"eK..I1..o..6..5\|..w.;Mo.+..nr....9z.=n.lJrSB.i....xed..p.....f.'...E.MP......... ._..ys..{.j..&.'....). ..}z..i.s.}.J......iz..&(a.]..{.H...E......(a.../$.-nUL...G...-...0.......R..u.N.Jx..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featured-mini_financial[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 161 x 161, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2639
Entropy (8bit):	7.837619879518007
Encrypted:	false
SSDEEP:	48:kwaSnWN1/9BrSzlBjOUKv8I0ZC2xPxBLZhMa+LIgp12XfyX:YM2GzfbiOZRxpxZKtLII
MD5:	1061408CD443AE0921DC3729C7955E2F
SHA1:	83F086D2764CCFB0C951CFE4291FB73E0841993E
SHA-256:	0BC17060837EA56B240E3AFB330213FC17B214105C473B663B123E3DA285B66C
SHA-512:	1DCDAA973B3D75CC74E9B3B5FE3EA2F5459D2B5D1CF5860A23E05CC08D85482BF6013D3CBB9CDD1AAACFCA8073D46F13328268D227D5AC5A967BFC49DBFD3407
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/illustration_featured-mini_financial.png
Preview:	.PNG........IHDR..............Q.....pHYs...%...%.IR$.....IDATx.._h\U....&.4.b..].Zm....DZ....aQ+.H...."(.yu.i....,.C.>..V}X...T..-k....j..O.W.i$I[G.w.....s.......@.43......;..)..B.&Kx..6...C..:...C..:...C..:...C..:...C..:...C..:uIz..\.]D.~....W.4%..)d....NT....P3.\|VDv..#a.gz.b...T.d.ED.V...%...wi...>.n..6...}..&...vM...M......'.@{`.M.] .;6....o..h..a..[w..nd....a.D..6\1!.PB..%$.PB..%$.PB..%$.PB..%$.PB..%$.PB.NU..2.\|X...h.].3...../"m..$.k......j..'...'\|...r.)!70..."...$DOB.zI%p...C..:.m.#m.+B.lt......@.#..A:V^..m..^.._fdlb..r.....V..:Y......imj...!^kW^)ww.....\|uF...I./\T.6M(a.@>..}.5.P.4......z..\.$.'.xB.(#%\...........U....9.5..A.C@.w.k...Z@...;......#'...9E.......YU.......`K.'..<..6......>..(5...4....L.?YkQ4E.M.....{....:.(Ol.E._V_.{..;7....C...tl6..k.F.! ...GG...q...=...{n.Z.....`~......!q.h..+.].[X....;...W..E..#6..O_...N.5.".\|;6u..O..:E..!D,qR..........?d.....}.o.1.O..5+.........1..y.......P..P.y.B_..,.~&.W.E.y.C5...S.h_.._.....d....C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featuredmini_covid_workers[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6434
Entropy (8bit):	7.954124581619025
Encrypted:	false
SSDEEP:	192:mzk+y2dkt2syblinQG0y/3fEF9oggu2zGEURu4v6/R:wk+OPPnbR/3qgu2JUY5
MD5:	F7EC4D28454FEFEF4AE82FEF080FA7E0
SHA1:	4323D85803A1D3C5BC9DBCA43A958A0C53E4F13E
SHA-256:	921A6B0F4B51E2E25FBBB2B62505A29C1B4561D460967FD3958648B679652554
SHA-512:	6569B9316E97D919DAD4F393C8C3D5218819D4DBD9A56F9BD67D664C59EC69757470DF7E2A5C10B06D081EB2388FD4EC9B7873CEB93667B3CB51931DA34F6078
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_workers.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx..].p.U..'..QH0........."z..>....x...VQ...ej...R....U.,]wY......,..[...VA.e....L.A^..B0!...uN..N..c....j..L.......b......2.O>......U.......p.........\Ef...#T^.KD...^..~..."....>.j~$.5..A.P.F.."c..8..7..."..............l..k ..x.V..p=O#.......h.KKXFD...iI@&......,.x.....k..." ..@..=..5Z`..V...."m.....Z.c..P...".."..l.Z....#..m..G.K.Py.b..\#@%..z.&....\(...)O.U.)@> '..qJ.0T^Y...!.....q.)..Y..}.,.ilc.8....,..q4dk.{`..".Tp.SY.....T...!...{<.Z...1I..H....u.S.)...K....^.]M...5........"...v....Mu..D...a.Gu.M...}.....PTP.z.e......y..M.Qu]..T....J....k..XI........]1j=.3``...&..6......$`]cS...) ]...5..l:l>.i.?.I.......].......}.~..kv.}.....i....._.....^...Y...y...h_.........7.kO....).^.^^w........I...k.i}.A.i=.....c....C..~U........z.t...J.o......@BO..\|..??b....'g.u.\|...E..5).......<OB.....H".....d...R.x2..y.]w.p...7.a.*.i.zQ.....i...d...p.$........_.8)U..o...Y.z...Cr.I.qH........j..1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_hero_disasters_corona_2[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1188 x 881, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	45302
Entropy (8bit):	7.834642368168608
Encrypted:	false
SSDEEP:	768:Uj21tevchj6IcMsCt5hNr70Pb13Ox4FnE9ArG7rYgK48rbJIJ4POrab0Q/O8iTY4:71rN6pCUPbhOJqG7MgKnbJIJ4P2aYQmt
MD5:	1894AAD77DD21EEB2B27A227EE40100F
SHA1:	0D0A852DA34D89DBA3E5F5EA7BE0109CA0F330D2
SHA-256:	1A56D83240C5D36938A9255307D34ECC85E70A0379081DB17709394B51439386
SHA-512:	254C7540662EB073930A503969FF51E2F00E1F5B5D506F4A1ADA71E6398C47FAA9D0C8EA03591959F8D9CC8564C9F7EB88EA4337FD27BD2925BE3F158F21DD08
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/illustration_hero_disasters_corona_2.png
Preview:	.PNG........IHDR.......q......wa.....pHYs...%...%.IR$... .IDATx...kl\.....e....lK.X....v'.^$@\S[%$....EC...La.}..V46.....f.........0..`.6..gv.H....r&q.....X.l..).d.E....?.Q...T..s..~..nd.9.).._....ommM.......a.........@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\query_string.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Pascal source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10915
Entropy (8bit):	5.165697591580398
Encrypted:	false
SSDEEP:	192:27svUtuikEpNoIAhKRvC9599MRvCI30C9mepCR23t5j5u59QyXB9P48LPCakJxkF:27/pAgpC9HepCI30C9mepC03iQqwbaka
MD5:	23CD1A00FECC861A6A8EF9E3A1EAA95C
SHA1:	46C7201F3AAC540BBC41AFD12B0DD3A0F98C16E3
SHA-256:	A538E11479B2D316C7316B0D2D86F99E4BABA3CC75883556482BFBF5A90AC19C
SHA-512:	A4DF8734142592B837629B2BE35C273A6CC72444D86253125BCBC9C8B78581FEB85361E74835C06B6F98184C71E3ED9E778D09220BD01EFC03AE3CE2A529D5D2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/query_string.min.js?v=1.x
Preview:	(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){.'use strict';.const strictUriEncode = require('strict-uri-encode');.const decodeComponent = require('decode-uri-component');.const splitOnFirst = require('split-on-first');..function encoderForArrayFormat(options) {..switch (options.arrayFormat) {...case 'index':....return key => (result, value) => {.....const index = result.length;.....if (value === undefined \|\| (options.skipNull && value === null)) {......return result;.....}......if (value === null) {......return [...result, [encode(key, option

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\sourcesanspro-bold-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26040, version 2.45
Category:	downloaded
Size (bytes):	26040
Entropy (8bit):	7.9821543727670825
Encrypted:	false
SSDEEP:	768:nz+uUXMYhtpBaPnZ/di084wyO+ev3tRNl6TbZ:CdM6XQxM0DO+g336TbZ
MD5:	738B5FD59F27AFA7B332F0D228DDD531
SHA1:	EFC3A93BFE745D7F4C22C43D4CD15D2A3C805D22
SHA-256:	48406BAC7EBB5B06CA30657A669D330CF25EA052A8FFD801369FA792367A14A0
SHA-512:	90657F6B5E1365E5E9A2422027C7397FE034D6A8253BA205A5875689A0ACD230F37D32AD411FA665BCC464EA6AA5883A17F59916A901D3A7160C0163D86654B6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-bold-webfont.woff
Preview:	wOFF......e........D...-....................BASE..Pl...F...Fe.].GDEF..P....t........GPOS..Q(......9l.\|s.GSUB..c.........l.V.OS/2..A$...W...`\@r.cmap..A\|...n...v..f.glyf...D..8...e(L.5Ahead..=....6...6.w..hhea..A.... ...$....hmtx..=...........>.loca..:.........zK..maxp..9........ ....name..F..........V.post..I........2Unrmx..\|.`[G...'.m.,ff..m.l........a(.A.u..W.+.a......)...m.K.....8.~..k.$.........QyT7E.K....J.2JBQA.Ah..l&^4...d....y.tY...m....u...ML..qz...#.K..{..}.../Cg?.$g...$....)J...V.)?.#..L@yF..bU1...._....;j..._...I_L.:....)....T..!...X.`@...y..o....p.j2.7....{ .pV.Dc.<.J.m...wiR.W_)......@.:MV}z.B......'..Q..3Z..P$..d<..d.....&.Gc.?....7......-..f{B...o.j..k{..q.&0^.t.Y1:I.D.v......c.m@...~j.=.'=.>...BM.j.~..M......a.s.RD.Fb..%&x.@.._.>.J.];..~....Q.........~....q\|....Z.\|.e..6....\|.f....=CM.....g....._...{L.C.q.v.......oI.f.f......J.@...wL..w......>.....2%...$...........=....dF.-.2...(.....e~..1...WU....u.tGb*N1.WC]~.fP..L...c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\stacktable[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	8219
Entropy (8bit):	4.688120544793996
Encrypted:	false
SSDEEP:	192:kGom6O2ZnApLNCNSuu2TIvm5YZVNpbNLuNt++C9DULb5y3PY0CRhMpv:khRA7yY5raHN/Ra1
MD5:	5CBC0BA1DFDE182C4697BF2B67901536
SHA1:	FAEF6BA9C210A3C6FE582AD5DFCA42831587FC50
SHA-256:	58EE289CC3B0E66D80A8860AB61C78B003B2794A2B01059F5E5A1D6DA47E7327
SHA-512:	374C053291774999F83B7F1E773BEE5F9E914CAAEDA53CC62D38DD3BF23F5BA8EB907DBA6DFC44423ADF8605B970F4EC5747EB2654B44C643672F823C37C6BBC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/stacktable.js/stacktable.js?v=1.x
Preview:	/*. stacktable.js. * Author & copyright (c) 2012: John Polacek. * CardTable by: Justin McNally (2015). * MIT license. . Page: http://johnpolacek.github.com/stacktable.js. * Repo: https://github.com/johnpolacek/stacktable.js/. . jQuery plugin for stacking tables on small screens. * Requires jQuery version 1.7 or above. . /.;(function($) {. $.fn.cardtable = function(options) {. var $tables = this,. defaults = {headIndex:0},. settings = $.extend({}, defaults, options),. headIndex;.. // checking the "headIndex" option presence... or defaults it to 0. if(options && options.headIndex). headIndex = options.headIndex;. else. headIndex = 0;.. return $tables.each(function() {. var $table = $(this);. if ($table.hasClass('stacktable')) {. return;. }. var table_css = $(this).prop('class');. var $stacktable = $('<div></div>');. if (typeof settings.myClass !== 'undefined') $stacktable.addClass(settings.myCl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\twitter_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	731
Entropy (8bit):	4.32075516554521
Encrypted:	false
SSDEEP:	12:t41jrfVllLWiHGllL3553+DY+Qcmv71JZQJL2pJ9bt0SGrlHXv/NvC:t41jT7Olx3554ZQcmD7ZQl2pJ9beSGpk
MD5:	D884FA68D9BB0F23163953AA5C26EDD9
SHA1:	D9F55E6C8DB66080DD6C351B4AEA472700032175
SHA-256:	08A3B7D9839A2300FEE8002C8DE58B54090D16C6694CD513C3CC1BEDF9FC78D0
SHA-512:	565D87D501B87403936E6B4E95482BC03CC474C5F757BF5750BC0B5B81C30318D0EDE4CF1FF180183123168E5C96EC17146AF6C06DBE40DCC82E0373DAF8A20C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/twitter_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>twitter_white</title><g id="twitter"><path d="M25,0A25,25,0,1,0,50,25,25,25,0,0,0,25,0ZM37.563,20.259c.012.25.012.513.012.775,0,7.963-6.062,17.15-17.15,17.15a16.793,16.793,0,0,1-9.213-2.725,10.95,10.95,0,0,0,1.438.087,12.116,12.116,0,0,0,7.487-2.575,6.018,6.018,0,0,1-5.625-4.188,5.747,5.747,0,0,0,1.137.113,6.009,6.009,0,0,0,1.588-.212A6.034,6.034,0,0,1,12.4,22.771V22.7a5.92,5.92,0,0,0,2.725.75,6.024,6.024,0,0,1-1.875-8.037,17.1,17.1,0,0,0,12.425,6.3,5.527,5.527,0,0,1-.162-1.375,6.031,6.031,0,0,1,10.425-4.125,12.207,12.207,0,0,0,3.825-1.462,6.024,6.024,0,0,1-2.65,3.337,12.233,12.233,0,0,0,3.463-.95A12.352,12.352,0,0,1,37.563,20.259Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\u-440qyriQwlOrhSvowK_l5-fCZK[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23600, version 1.1
Category:	downloaded
Size (bytes):	23600
Entropy (8bit):	7.973583674109776
Encrypted:	false
SSDEEP:	384:OMPViqjFD/7v1VG9bCaNwTTRz10p2dF5rnmaMfmF1tKIYFwWajBob/T670WyDLrx:hNdjhRV0bCaNwvRz10pAF5CaMfm8Iqjj
MD5:	69F09800F4F6479D06E44EBA837DF872
SHA1:	5C889B1BEE3D4E75A5FC0749617A15C0E6922072
SHA-256:	8E0F8D862D80DB8B358C03FCCD1FCEB993DEA6A22569620BCD0959806D3D1D12
SHA-512:	1EFFE91D2A3BC1C6442E9B8012EA6806AAB60FCCFB1947F011E281170FE8070FFA5B9E6096363B2B3908C8BCF0D49AF3DDD1BF004E87438B6F0C450FE968F105
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff
Preview:	wOFF......\0.......t........................GDEF.......S...p....GPOS....... ... DvLuGSUB............s.e.OS/2.......O...`U.Kcmap............j,.\|cvt .......8.....~.lfpgm.......F...mA..\|gasp...(............glyf...0..F...y.e.a.head..S....6...6.).7hhea..SL... ...$....hmtx..Sl...c....VG(.loca..U.........b.C.maxp..W.... ... .g.pname..W........r:.Q.post..Y....~.....yujprep..[.........Z.,.x...........'@T7H.....$ AJ...`f...<.......V.vy.QN..........>...Q.m..y.2...k................DFLT................x...n-Q...am.Fp}.k.m.m....A.2.de.d...~.lc..,..8.v.;F...O.Q}......X^..NY(b.O....o>....[7.+e..#.O..\|...../...[...M..T..pH$....D6.T..#....6.O...Sc..R..Z..F>..Q.....,E..O._..hy....V\|.\|x...f..b.X+6?x~...:Z..1b..'z".+Z.-:.O......`..a...l...I3V@....L.....Xj.U;.bG#1.t\|.....Q.7....O.2.....J.........3<R....q..x...!.........K..o#&g.....UL.....}..d..#.L.u^..p..\|....v.....S.s..C...k.3.^.6......s+`..A.x.c`a..8.......).....B3.1.1...@)8`.b&.'8.Y......(.....X4...........)..f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\u-4n0qyriQwlOrhSvowK_l52xwNZWMf8[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23260, version 1.1
Category:	downloaded
Size (bytes):	23260
Entropy (8bit):	7.976160585728166
Encrypted:	false
SSDEEP:	384:Bv0MPVryqjFD/7v15tcgxwkH5+WVPgq7FGj2mQf4MBpgt3Re+X8NM7v/9J9PJ3sN:tzNRjhRAG5f+2I2my4YmtMNNMrL9pssC
MD5:	BA56EA84B8084B7FF9677F50D3CD81BD
SHA1:	799C0C07912F6996B80459937AC097813B6B461C
SHA-256:	649C6472A611C5BCFEBB341109E5754F205EE57550F5614577C6B6CB963D17AE
SHA-512:	724487602C085EBA3D79D74A40BFF75A3123241CAE759A27D21430813C0ED6D90899E826A7BE49FBABCD8586DD08DB76D86BB9BE4C8FD9B284AB747727A0A299
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff
Preview:	wOFF......Z........p........................GDEF.......S...p....GPOS....... ... DvLuGSUB............s.e.OS/2.......P...`W..8cmap............j,.\|cvt .......<........fpgm.......F...mA..\|gasp...,............glyf...4..E...uD...head..Q....6...6.M.7hhea..Q.... ...$....hmtx..R...._...._B".loca..T\|.........`..maxp..V.... ... .g.oname..V........Z7.O.post..W....~.....yujprep..Z<........Z.,.x...........'@T7H.....$ AJ...`f...<.......V.vy.QN..........>...Q.m..y.2...k................DFLT................x...n-Q...am.Fp}.k.m.m....A.2.de.d...~.lc..,..8.v.;F...O.Q}......X^..NY(b.O....o>....[7.+e..#.O..\|...../...[...M..T..pH$....D6.T..#....6.O...Sc..R..Z..F>..Q.....,E..O._..hy....V\|.\|x...f..b.X+6?x~...:Z..1b..'z".+Z.-:.O......`..a...l...I3V@....L.....Xj.U;.bG#1.t\|.....Q.7....O.2.....J.........3<R....q..x...!.........K..o#&g.....UL.....}..d..#.L.u^..p..\|....v.....S.s..C...k.3.^.6......s+`..A.x.c`a.........).....B3.1.1.2.......1.........AI......,.......ArL:L....3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\uswds.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	24790
Entropy (8bit):	5.28735236798167
Encrypted:	false
SSDEEP:	384:YjXVWEnRI6eqcL7P5Vmm7QctEpiQtgBK+lHnyELkRUJ:YJWQRIKcLr5VrfGiR6Y
MD5:	1D38B965D51F8EBA4CD4542FC1115059
SHA1:	D8F7E45232733805EFB13CEB5DC55BC8BEB5BB9A
SHA-256:	9ACC5EA0D590FD2EB34A6D8F7421A5A15378F73F9BC05FCBB29958E392FE86B7
SHA-512:	9BD61A184AE7B6DD8ECD7CAB7A9B37423440D318F5F800CA3C827FDDCCBB4872315CFD9A71590E28FC674F64A125189B1BC6E0F50CCF4A2AB9774B397C7872D9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/js/uswds.min.js?v=1.x
Preview:	!function i(u,c,a){function s(e,t){if(!c[e]){if(!u[e]){var n="function"==typeof require&&require;if(!t&&n)return n(e,!0);if(f)return f(e,!0);var r=new Error("Cannot find module '"+e+"'");throw r.code="MODULE_NOT_FOUND",r}var o=c[e]={exports:{}};u[e][0].call(o.exports,function(t){return s(u[e][1][t]\|\|t)},o,o.exports,i,u,c,a)}return c[e].exports}for(var f="function"==typeof require&&require,t=0;t<a.length;t++)s(a[t]);return s}({1:[function(t,e,n){"use strict";"document"in window.self&&("classList"in document.createElement("_")&&(!document.createElementNS\|\|"classList"in document.createElementNS("http://www.w3.org/2000/svg","g"))\|\|function(t){if("Element"in t){var e="classList",n="prototype",r=t.Element[n],o=Object,i=String[n].trim\|\|function(){return this.replace(/^\s+\|\s+$/g,"")},u=Array[n].indexOf\|\|function(t){for(var e=0,n=this.length;e<n;e++)if(e in this&&this[e]===t)return e;return-1},c=function(t,e){this.name=t,this.code=DOMException[t],this.message=e},a=function(t,e){if(""===e)throw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\youtube_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	500
Entropy (8bit):	4.758719016843956
Encrypted:	false
SSDEEP:	6:tI9mc4sl3QQCmRDxQL2WwVHDqbUbHW7aWwerVQtXJEPusWiKuXAVWiqGo2E9TdRS:t41jtFxQFwY7dwY6pam3lOA84o9KGbC
MD5:	B56886C59F611D5CAB56286BEDCA22F3
SHA1:	415E0DE7BDBB5C6AC4B82F4DA9D118AA7D802100
SHA-256:	7B0214207905F9255AAB6E20D50C164730BD4BB08DB3C7D1D3CA145E1F9BE6F8
SHA-512:	18AF77AA8F1665C46D8E48B12EF627A3BBD65DD5DFD9B07B2716EAFD6DA26EEFD3C53BAC11C3F9B7AD733DE72B3D5579A79889AEA3C9BDB81EB2C9760BAC208B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/youtube_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>youtube_white</title><g id="youtube"><path d="M48.955,12.887a6.283,6.283,0,0,0-4.421-4.449C40.635,7.386,25,7.386,25,7.386s-15.635,0-19.535,1.052a6.283,6.283,0,0,0-4.421,4.449C0,16.812,0,25,0,25s0,8.188,1.045,12.113a6.283,6.283,0,0,0,4.421,4.449C9.365,42.614,25,42.614,25,42.614s15.635,0,19.535-1.052a6.283,6.283,0,0,0,4.421-4.449C50,33.188,50,25,50,25S50,16.812,48.955,12.887ZM19.886,32.434V17.566L32.955,25Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[4].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\covid_banner_option_04-14-2021[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 2000x498, frames 3
Category:	downloaded
Size (bytes):	142763
Entropy (8bit):	7.9873581865725445
Encrypted:	false
SSDEEP:	3072:jeDPBUSOOUXEYsfv7sS7MhW881Cytr7jIXBpDeGjhCm6tbwl:je7iS2Xu7sS7MhACyt/jIXth4bwl
MD5:	482EA8334641DCE176EAD911CC42042B
SHA1:	B9C75ECD923CAA7135BDFD484299EE603F864254
SHA-256:	A07DA38E1FA8ECFFBC9F2A4F61817D9D1226C614BC85BF8EB463DBC1F60E0437
SHA-512:	D946B60D487347B550555B464F0BB4C75BFF4741A9AD39E54DB76ECF187E600D845C68EDEAFEDDE0CB73FB6AF827D2E23D46BF01DD6327907145DF5BE59BB74C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/home-page-hero-images/2021-04/covid_banner_option_04-14-2021.jpg
Preview:	......JFIF.....H.H.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."................................................................................}....n').G.p"..D..\Og..?s..3G8=..+...:>]c.j.F..5.....-.)O.$.\n...:.s..?~<....m....i.._e:./.[..\M+.JY....%.Y.ft.X.&.'K.rto.c.J:..y.....$..f]....[..7O.t..Z..6@.+L2 ..wJ....%..O...U....x.9..+.L...h..B.4.5G.e...,j9.!..E.A..UT.E.QQ..#..+A.Oy..oK.b..j..u..5....t.K#$.'.,.\|N2...t....T!Qc...<=..3....<3.<;.s...x...9l.V.5!.J..@.1.....EV.E.....rG....2..\|..{7...~..o.......... ,rDe.+..je.o<..M.....M...t.._..1H..~J..f%.Q..m.[.N,....b.^.=..y...h.d\|...wL<.......3.._[.H..\..zvY.G......9..i.ko../........}=..Y..m.J..F-..=x.&....S............K.Y....G..:.M]N.O..J.[..RY.%K..5os....,.2n.=.5..c..}c..f=..vN.l...ZEji.p...s..o(..s../.........K<.#.z.3.5........J....FH..@...%z.. .zJ..FH$J.i(.+....V.j."$...`.`.`.#$.....1$.....m..L.N.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	911
Entropy (8bit):	5.180032150665888
Encrypted:	false
SSDEEP:	24:5AOYNZGL78AOYsZn9AOYXZG38AOYUTZGR88AOYN7ZG7K:eOWwLjOLUOgwXOxTw+OCwG
MD5:	6559984CF35A95A1F3567F4903E47716
SHA1:	6651235A71D4F95AACBA18BBADBC5E7B08017A3D
SHA-256:	5874DEC01627A418A8167969C6B2715778231B523B028CC6F769C764A98ACEAA
SHA-512:	FAF0ED047ABEB1FAB00688C3586CA457C93B21ADAC29C57228490912BE5ED25BA2DD100652A31F701F3F1CA4B6E435F628CA5765142C8DE9463BCAD4D27A16E1
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfedA.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 500;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlEw.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	5.207717462695661
Encrypted:	false
SSDEEP:	24:570OY7aTr70OYN0aTF7QMcOYRaocOY7a3cOYUMa0wcOYN0aJ:h0OEaTv0OpaTiHO6azOEaMOxMaeOpaJ
MD5:	DC937CE964861F42AFFF746D52B20397
SHA1:	E2100D1055B7D3ECDFD6A4FA445F5238D1B404C4
SHA-256:	3137EB35363EB5CE777F598A8AE67330143D6863CD5876C1E3DD40C6D407F563
SHA-512:	A86E1DD8070F5F58FC5FF420EDC4C5AE9959A4A4AFC2BEC8FD6DB0B2BC99A4EDAB54F606F2A02FA70BBF6E62206B7DFF8E5FAC28F9042F4175A4FBEDDD720407
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff) format('woff');.}.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 700;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 200;. font-display: swap;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 600;. font-display: swa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	548509
Entropy (8bit):	5.129798976537864
Encrypted:	false
SSDEEP:	3072:nm3W02v34Es0HpLA9+hX+QNryA4l6T7k7AXf7b:nm3W02v34Es0HpLA9+hX+QNryAP/f
MD5:	E727F3D89EF6D7E857E883D8CC5C8EF0
SHA1:	CCE8E1207B4BCEF1EA31E77AAD7C8448430E1108
SHA-256:	D13C940E46291844FB810B4CC73757DFF7A2B2CED2CFC8CA4D5AFF8B9CD274F7
SHA-512:	448E5418F953FDB4FD9A7787CD82FC5F954D5BDB230D8E236A5AC909CC3DE76A75A36A6C1B78B8EB37EEF7E7E83310F94F4F7A8C50E4E393054D862BDEAEBAD5
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);.messages{padding:15px 20px 15px 35px;word-wrap:break-word;border:1px solid;border-width:1px 1px 1px 0;border-radius:2px;background:no-repeat 10px 17px;overflow-wrap:break-word;}[dir="rtl"] .messages{padding-right:35px;padding-left:20px;text-align:right;border-width:1px 0 1px 1px;background-position:right 10px top 17px;}.messages + .messages{margin-top:1.538em;}.messages__list{margin:0;padding:0;list-style:none;}.messages__item + .messages__item{margin-top:0.769em;}.messages--status{color:#325e1c;border-color:#c9e1bd #c9e1bd #c9e1bd transparent;background-color:#f3faef;background-image:url(/core/misc/icons/73b355/check.svg);box-shadow:-8px 0 0 #77b259;}[dir="rtl"] .messages--status{margin-left:0;border-color:#c9e1bd transparent #c9e1bd #c9e1bd;box-shadow:8px 0 0 #77b259;}.messages--warning{color:#734c00;border-color:#f4daa6 #f4daa6 #f4daa6 transparent;background-color:#fdf8ed;background-image:url(/core/mis

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css_wFl6wWXW8mkSBb9CnCjEnU5hRiydLO04gAYNaYjfXQI[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	87121
Entropy (8bit):	5.029133083621057
Encrypted:	false
SSDEEP:	1536:wrlXMXd+AwljF+vg7LD81XaFKvrfefa2J:Z+AwljF+vg7LDafefD
MD5:	ED4D08CCF426727EB06D19BC2E3B42BA
SHA1:	1275B491BF0BBFED437800E48CC4BB6D8C21DEFA
SHA-256:	C0597AC165D6F2691205BF429C28C49D4E61462C9D2CED3880060D6988DF5D02
SHA-512:	3301285FD100077D303C31990F0D5B07EB5429F955AB18BD490D35EB162A59B3DF559A5E4FA3C54B3E8AD8BFB3D0538B9647F358BBEB22FBE173445FAFEB2ADD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_wFl6wWXW8mkSBb9CnCjEnU5hRiydLO04gAYNaYjfXQI.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}fig

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\disaster-responses[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	90777
Entropy (8bit):	4.3671936403243405
Encrypted:	false
SSDEEP:	1536:JltYqJ6G+mF8rtD0m2/LcFTNQh840ljCXPD5Az1PJl9zQFGcQ8TlP3GVSB2nxEPu:Tq/BShFAz1PJl9zQFGcQ8TlP3GVSB2np
MD5:	12B007A36E8C99106B62A6ED34255681
SHA1:	29AB4391815E8882558B366226EED10590CD66FD
SHA-256:	65F221D7B4D0BF26A4DC1E1B118831BE7982C606E3E8F1C9EEDAF45B9BA687AD
SHA-512:	0525A4059A68312B90F4E975D8579CC7F5992FAC2EB679503541B6F1F6ED3BF7169A3541A12D9CB79D3FC66E5901CC52F751C01AFDCEA43FEC916DF3A04D5896
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/disaster-responses
Preview:	<!DOCTYPE html>.<html lang="en" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\effect-min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	16816
Entropy (8bit):	5.357184455434572
Encrypted:	false
SSDEEP:	192:5vTeXBVAInxCBhjX2sjhlStCsbiXcWzNvwu2LqQ6uZWs74:5vKXBVAWxC3jmQCCsbQ5IdGs74
MD5:	86F1E6B37CFAF2786F58619B88778717
SHA1:	96975EB34AA586AD9FA48C6F994A4AD2D87A0C60
SHA-256:	252B076ABB37EC8CEE93AA75EE776C45E01515D8361A9BAE2341EDFE02D875F7
SHA-512:	756F0D67A468BA5DAF96420DCFE493383A26833A392336180C1D2194190E995C409AD778A87429E0C84C41F77968852A4C0B0A239B473EF77A9BDEF03BDB1891
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/assets/vendor/jquery.ui/ui/effect-min.js?v=1.12.1
Preview:	/! jQuery UI - v1.12.1 - 2017-03-31. http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed /.!function(a){"function"==typeof define&&define.amd?define(["jquery","./version"],a):a(jQuery)}(function(a){var b="ui-effects-",c="ui-effects-style",d="ui-effects-animated",e=a;return a.effects={effect:{}},function(a,b){function c(a,b,c){var d=l[b.type]\|\|{};return null==a?c\|\|!b.def?null:b.def:(a=d.floor?~~a:parseFloat(a),isNaN(a)?b.def:d.mod?(a+d.mod)%d.mod:0>a?0:d.max<a?d.max:a)}function d(b){var c=j(),d=c._rgba=[];return b=b.toLowerCase(),o(i,function(a,e){var f,g=e.re.exec(b),h=g&&e.parse(g),i=e.space\|\|"rgba";if(h)return f=c[i](h),c[k[i].cache]=f[k[i].cache],d=c._rgba=f._rgba,!1}),d.length?("0,0,0,0"===d.join()&&a.extend(d,f.transparent),c):f[b]}function e(a,b,c){return c=(c+1)%1,6c<1?a+(b-a)c6:2c<1?b:3c<2?a+(b-a)(2/3-c)6:a}var f,g="backgroundColor borderBottomColor borderLeftColor borderRightColor borderTopColor color columnRuleColor outlineColor textD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\extlink[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	12131
Entropy (8bit):	4.989656129321139
Encrypted:	false
SSDEEP:	192:0ylfDS8TGQagunKkuiCqIryXJaBFagUdar/vAyKYUVuh9W+z2TxkRng7uKOmKaeF:5GxLKTaSnPuy82P1wVtO
MD5:	8D9C6B70088EF032B791015028A993A4
SHA1:	148F6DA696C868AB9DD2D3AEFE9C7B5BCEF16614
SHA-256:	2541237FEFFE96F5FB2CFEDE3F77B8B13CF8E72E0D70C1F7017D303C743CCBAB
SHA-512:	15CC9545BCA93786907DFCA0DB353805615D80D50BB22012EEEB9AAFA5B7511D17884E39ABC3ED78E1D395D2CA371E51B51F8D0B2DEE13E55D3BF13851296735
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/extlink/extlink.js?v=8.9.13
Preview:	/*. @file. * External links js file.. /..(function ($, Drupal, drupalSettings) {.. 'use strict';.. Drupal.extlink = Drupal.extlink \|\| {};.. Drupal.extlink.attach = function (context, drupalSettings) {. if (!drupalSettings.data.hasOwnProperty('extlink')) {. return;. }.. // Define the jQuery method (either 'append' or 'prepend') of placing the. // icon, defaults to 'append'.. var extIconPlacement = 'append';. if (drupalSettings.data.extlink.extIconPlacement && drupalSettings.data.extlink.extIconPlacement != '0') {. extIconPlacement = drupalSettings.data.extlink.extIconPlacement;. }.. // Strip the host name down, removing ports, subdomains, or www.. var pattern = /^(([^\/:]+?\.))([^\.:]{1,})((\.[a-z0-9]{1,253})*)(:[0-9]{1,5})?$/;. var host = window.location.host.replace(pattern, '$2$3$6');. var subdomain = window.location.host.replace(host, '');.. // Determine what subdomains are considered internal.. var subdomains;. if

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\facebook_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	353
Entropy (8bit):	5.077371229316119
Encrypted:	false
SSDEEP:	6:tI9mc4sl3QQ5CRWbr44LStdasvU3kclETLYhUo9eCCUsE72TMcGHpAZQtGyJAC:t41jgl4LSt5U3a0HEbUwMcGHOZAGjC
MD5:	F03CE1FECA3D42A0322E7E6A6A0597CD
SHA1:	AEA0F9FC7D7293658C2A1246DB0D8ED1BCA9DE82
SHA-256:	2F7113793C5D5FD6B38E7BAB63CA5D88FF29EDB32DB7AD519E9746414A1A697A
SHA-512:	608468EA1E48920DCBD131B7A29195A4F18F116AB949FB1D1F81D3689CCE47FFC16706E8ACB2E83883107B4201E9B2EF68BDA66A6435342F8F19F75CCABC6364
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/facebook_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>facebook_white</title><g id="facebook"><path d="M25,0a25,25,0,0,0-3.906,49.7V32.227H14.746V25h6.348V19.492c0-6.266,3.732-9.727,9.443-9.727a38.444,38.444,0,0,1,5.6.488v6.152H32.98c-3.106,0-4.074,1.927-4.074,3.9V25H35.84l-1.108,7.227H28.906V49.7A25,25,0,0,0,25,0Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	100319
Entropy (8bit):	4.600868461164398
Encrypted:	false
SSDEEP:	3072:Tq/IINJa/ozAz1HPJl9zQFGcQ8TlP3GVSB2nxv8A:Tqj+
MD5:	6FE0729A35259029E929C470F870D97D
SHA1:	CE3A63F05610CC73ABB6C448C0F3225DDAB2FD96
SHA-256:	507E7366AE858096AE497F2F40701BADF96AA956EE05CD8813EB6C3E74DC8018
SHA-512:	43C5F5FEA4CC4454A47C2758F3EB6431C2549AE365DBE2A9D34AA92269D6C0983A9736FD6751DDC952F9EDC58A2A1A008CAB68F6229B20D910367740E23C4B6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="zh-hans" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\funeral-assistance[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	102295
Entropy (8bit):	4.508877639155757
Encrypted:	false
SSDEEP:	3072:9q/zPyQUTSxiaTAz1oPJl9zQFGcQ8TlP3GVSB2nxv8A:9qrPh
MD5:	60CE39905A668CB4C247607759A06367
SHA1:	C2BDE796E0493AA9EA5872583467EC825812AB84
SHA-256:	36AD0777AFCA6CD84F05302BF8193116105B6C41CB339D402750CF4322B8B799
SHA-512:	C51302725E17E81506A5C317F63DF42FA877A27D019A0FCCB66EE657DB5C81CD98B8C5FD8C0DB0FB1762380E208AD0147EAA4586E58D6ACDCF9CB099EA67F8C8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="vi" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\icon_pdf[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	668
Entropy (8bit):	7.482374070784684
Encrypted:	false
SSDEEP:	12:6v/7LnOJQuuLvSNDwM3fGb2nfIZ3/cKK+uvsB2OtjGDlRn/DheiIgVJ4:eOJtKvSx3gOImKK+MsFGD/Dheitn4
MD5:	A9AA48BA3EE6C644A53FA0007EB8533E
SHA1:	33581A5EA5438B06EF224F06528E875E4D58446F
SHA-256:	811FA84C912B5A3F1D125312E35B3CC7583FCBCE2382008352AF3EDE0ED2EBB0
SHA-512:	A75C1C9B3229EE8C452BA503BFF2B87D3524BED41E281E9B560E49084BB5DAC530611B29F9FC72C0D04C679D3075164E2E7F3F203675C4FC635D48176360FC5C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icon_pdf.png
Preview:	.PNG........IHDR...)...)......`......pHYs...%...%.IR$....NIDATX..X.q.0.Us./...`.0...t.f.lPFH7`....LP.L..Sq.Fv..&..w`.....;D.H...Z..b..`H.[..{..F.$..I=.........zF.+...C. ..J....C_..S.....N....!..66..h...E....^..d...Dt............G.o.Kn..w.{N...T........* ..f.}z.U#=&...1U..UP.........IT.bIr.....,..u..?./..&........A.!.........2.......9.<."..w.uE{!.y..\|\|GJ.b..D~`.Z".:Hq.F.R..d.d,w...d.>x%..1{k.P.Q.Z..T.L6+%$7L_I.....-.X.7.)..m......{)2...EH......H..".C..HM....Ern...."...-.R.X.]...F..!}.$.......o...E4..Wpv...!}.&..G.&.>...H...X...Q...xq....$.D.....%.&..U..piq..9.......7.rs.`..'...\zJ.W].#V4qEQ..HU.M...IY&..{m..k.....LB..w.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\icon_release[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	756
Entropy (8bit):	5.156766536345231
Encrypted:	false
SSDEEP:	12:tvG1W7x7dXAKdGcdVeNSR5jxjHc0zVeEjxjHc0zVeUeo5jxjHc0xCK0A6485yehX:tu18dtF4NSR5jxjHc0z4EjxjHc0z4UlO
MD5:	9698A1E052D604A8CF3C73E813C42D41
SHA1:	D033B00A807797D811958305917CAB8B63E77B29
SHA-256:	6B92FCE78B87FF57D47B4F9D01619F0D698CA2E0B99B58449B983F62972F01A5
SHA-512:	3B12D9E78B6B54F385856E72ACC50DB90ECF7337BCA66EEA42C045A832D9C920FBD5D0EA68173320AFF17FCAADA5EB67AAA507823574E299A94D4D3CEFE12488
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icons/node-icons/icon_release.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33.502 44.3623"><rect width="33.502" height="44.3623" fill="#d6e3ec"/><line x1="6.001" y1="36.6795" x2="27.501" y2="36.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.001" y1="31.6795" x2="27.501" y2="31.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.001" y1="26.6795" x2="27.501" y2="26.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><path d="M5.9411,21.4113H19.8377V7.63H5.9411Z" fill="#005287"/><text transform="translate(9.6053 18.2851)" font-size="10.4609" fill="#f5f8fa" font-family="SourceSansPro-Black, Source Sans Pro" font-weight="800">N</text></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\illustration_featuredmini_covid_data[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3136
Entropy (8bit):	7.892659516927266
Encrypted:	false
SSDEEP:	96:EKPlhPh+CkcsC0St41dRkCacMurAQHoJkdczEhPcj:nPlhPh0R24zZM/+oqCzEhPcj
MD5:	FC56159A2E04BAF00F9155F9D9F1A0AB
SHA1:	0EA51373BF38C70E259040DD79AE44C881D5512B
SHA-256:	577FA065C19715D7AF13E8114E48ACF3EA5BBF9D699A7696694BE32F92366EB9
SHA-512:	A50A534359DD3B726F17D13C1543CEF8E8AD42B369FCD257DAD85BAE282093CFBCE0231FE0D6C08C406890A060519084FC3BD279FD06D67DB4555773EA067CC4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_data.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx..[l.W....^.._R.q....B.T...y.C....R@..Q...j.... ^h..o-..@.......Em!.R..H[....!q".....;..}....zv..33...r....f..........%!..U..'&...(.......P@b..H.B..Q( 1..$F...(5:...K..E. ..d....t.@........\|M.`....P@b..H.B..Q( 1..$F...(.......P@b..H.B..Q( 1..$F...(.......P@b..H.B..Q( 1..$F.,35L.......1.xm.y.:.ecG.....i.........?.........;......'..wl./.....c..X..z?{.U..1...w..../.f4,...e.G>7h...S.......4..........q..>A./(h......>@_.p.Q.5..........n..F....4@.}0<6........A..Q(..:..5\...w.?(..6u...F....i...>.w.mR."..s..&.B.}.&....t.7..'(..{Sg.s...'....k...e065+7&g.....w(..l.\|.\...r..no.-].R..x..>."&.._......<G...>@.;\|...#c..R[S.dI./.:.....q..6........a.K.8......s$T\|.......o.!..{.r.....*RB......./.....].}.....g{.\|s.=y......+..l....M._8.w....}..%......yM.c..)wuw..^1....7R[/H.......>..mw.c...}]H...~"/..y...S@...../.^}...V.:.W..1p.b%..i]?B.=8.r..}.~g.O'.:.S/.P.[y.w'.........,.......0.S../.}0_

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\illustration_featuredmini_covid_help[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3244
Entropy (8bit):	7.9020115367396055
Encrypted:	false
SSDEEP:	96:xFIUfkZwt4euV6DmWmEqFj/bNI8PTsQ8K+c:bIUAehUEIO8PIQ8/c
MD5:	5DBF8527DB3974B9D71B5C181D67C9FA
SHA1:	8CAEF23B3BF6899676DB8F2664213568F9AE7AB9
SHA-256:	A5621135D5B79941920F9EA8AB5A1B26C0D9206410BC7A03F2EB0FEBFF6F9D57
SHA-512:	57BBCE32131F8C879BA883F08CAD8A949378A77DDB1CF49D957FBD16F753789533E7B5237F46C3F849DAE691EA66A3451FC197DC1B07552F7C6DC935BF6E3688
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_help.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$....^IDATx..OlT...?(`b..B.U.....Ak;.PE..s .Z.8...JZ..m...T..@..*.Z.UjL+...pJ/.C.F......$-..J.......S}.,<...y3....$+"...~;...f.{..a.X.5.P..2....), C.....2....), C.....2....), C.....2....), C.....2....).\..T.`....1&~r.Lz......l....u3...\....J...-~.b......a.3.b.. ..=.:jTx..MN.M.._XR.............BF.ZG..5\?..n...$.....B..Vj9.B...(....S..S.e..f.....&..6.....Z..".....X.#..:$^)..e3.a.^&.?...cu....7U.Q.S...R[....S..Q.....u."E.......PT6....p3.D... <.?.).9..../.v.=.."..tg3....re..e.."..a...!..b.n.Q.Y....w...Md..(.]O+5..&%..~...-.........8&.Z.K.LzH..cZO.D..D.P4..Dz..h.....\O..$.X.....Vn[.Y....s=.%..p(...N......^OJ..e.S...=..#.?x2..LH=u.......R...q_5.... f.g..)...w.Y#Tm.....2 .S).]o.h..Fh..lN5X.gZE..,q..U.E..-.......L.......H;.J...~Ad7i]o)].[ua[@.....Um.J.v..~f......bP.Kx.i....<D.".O.......#Z..,p.F....P.r]..~..9a.#`.gu......[...l.......0..`.m...Xk6,....,....}.....Se..._3...;, c.j....`.\[....A.W'.`v.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\illustration_featuredmini_covid_newsmedia[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1958
Entropy (8bit):	7.74261528645934
Encrypted:	false
SSDEEP:	24:XdTCJVQHoIudH8NXuZDDEConuPjqMuFvLj5MWrSEGmpY+oe8zVdyT472fC3xy66u:pC9IuN8vpLj5MrmXuZkgDYm9
MD5:	6E6B2C7488FDB77C876451B5C6CC0BF7
SHA1:	0E70D95239D7A17717AB9004808614DA225A7377
SHA-256:	BEE88783B16C5A03FD8FF1D64E6DD099DA613F79061A3DE8E2DA90FAF8601030
SHA-512:	EE8BADA3E61FF62D56D198626299AA74EB42DB855F11A5B517B65257563FD62869517F9CA7F0426ED3BC9C598E44389A39B7BC07EC5CEB44A2BE89F283D12BC0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_newsmedia.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$....XIDATx...KlTU...G...JyT^B.P....#............F..hb\...IX.+...u.A#B".].P.....S..1m..\|73M.3..<.w...%.@g.93..{........h.yX"@."@."@."@."@."@."@."@."@."@.........&"zi.......ho.VWOlro./.B.7.....KSc].H./....-.j.y/~.`:....u.vD+b...{rn...M.u.G.,......%<7ut..D.v..pp.45.....f.6.D...&w.a....]kk...3.....p&749.in..%>.....6>..j..}...oW.w........v.....;....o./.I......~.s....z....#>.uu..F[.\....8...n..zWj.+.~zM....kw....f.i..H{T.^mM{...J..L.@....f.D..[..T#l....A...s}.@..+.AF.f~.d...nc....{#.h{.'...f..@.7..&m...pmH.... ./.x..-..~H..X.WV2.....}...d.v.9...f. .3f...omZ.'.g...0E.0E.0E.0E.0E.0E.0E.0E.0E.0..Kq_.z.xg.....lt.=19..`ErEY.4...[.7..x......k..$5../G...o.KW...g....%..>!..g..)[L...-..%.;......l.!@..;{%i\|.?....."@.tv.......'..S.....^0}.W......=.R..L.W...n.......?......4N./.-?&....-../b8..?{s..X.h........)...M....W-.b;v.......[..j\|..~.J...F68....";.,./..i5.P..>...%..>....._."..p..!0.U.G.[.^........@..h..O_.)..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\illustration_featuredmini_covid_rumor[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2525
Entropy (8bit):	7.81492970597675
Encrypted:	false
SSDEEP:	48:2UTEKWRsj//V//V//V//V//V//V//V//V//V//V//V//V//lPDg1KNmzFeuzRQB7:2GvWRKFFFFFFFFFFFFu+fYhgh/3Xw//+
MD5:	1651A447A7DD6FC9966A571C406F931F
SHA1:	15B44CF766BAAE25EA62D4F15F24A97809A379D5
SHA-256:	6B96C6C47811D660B258657D18CA949007845D5DCB270C89396F459A0469C494
SHA-512:	3C079E60174B35586BE6193B80F2AEDFA49F01CAB9700C926E872EF4634D28EFCD3415AF8B60CF89938BB46C2837512DCF9C5A8B498060C53803333D0294D80A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_rumor.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx..Oh.G...-.B.E..F..`.-....d...^L.j...K.....x..,.9..........d.../&TA....Mv~.y.f......g....o...y......)..O.H...(......(......(......(......(......(......(......(......(......(......(......(......(......(.....~..)..E......J2...K.}Q)...1..o.?.+%..{.=.....H...o.JK).TJ.i1..J...u.!...........h!.W.2.....~...NxpK&....z.T..{#Z...z...B........W.......8....9o.B.D.......-.f^..\T.Z@-..\.Z}.....Ji:...R@..%......r......4(>^...\|..`.........3ZD.:+....[.\...vBfE7..>.....Qo:.=[...<.K4....P..'u..Y....:....X(W..h?r=~..+%Q...P7.5.p.B=.b.RZ[B..o.`.$.B>.PK..%i..B.B.J..).n%..~NBBq....r.....p.u.DT@-_.U+.1.RB.N..f...............IN.<...U....E...]......vl...4.....4....i.n.s...L....Vm#..v..}jp`W[..)...'O......._...K_.F....(l..Y..E.s..p...c...Pw.z.VcI]...^....[a.^).s<.K...t.p.O.nG<..\|..:.......%.N..Sl../d.jj...LmO.w..\{.n.,...`...{.......;zP.8r.E>...d.N..f.....b.f<..jr..Y_...20N$.......*.i6.......+.,......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\illustration_mini-featured_needle[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	6091
Entropy (8bit):	7.888097781515962
Encrypted:	false
SSDEEP:	96:r2DsHMET8nE+NO3Sr/Xk4p5Ra/JqySxObxeZa6TRr36xazTYYuorGomqf0OAqL9G:CpU8nEYJjnprKcydd6lr3/zTYLisL9Lj
MD5:	56343CFEC1633248EE290BAC38471422
SHA1:	230EDBA52640C6F962EB37727207C4F632B484B1
SHA-256:	12DD31C29A23BC6CE1DABA2B0892B560BA63C03EC26CC38A5B7A4695AEC41C8F
SHA-512:	7D92D8CC1CA4B2E18F8A8C3B6851067021B49E96B4A8FC32EFF24E73CFC1135CAF16129F9AB889D2D30DA51EFB0BAE1E1E655CACC663AE6B7ECFBCAC97B5CE6B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/illustration_mini-featured_needle.png
Preview:	.PNG........IHDR................z....tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c005 79.164590, 2020/12/09-11:57:44 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.1 (Macintosh)" xmpMM:InstanceID="xmp.iid:6D6C5903591311EB8F74D1580F35D52C" xmpMM:DocumentID="xmp.did:6D6C5904591311EB8F74D1580F35D52C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:6D6C5901591311EB8F74D1580F35D52C" stRef:documentID="xmp.did:6D6C5902591311EB8F74D1580F35D52C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>..M....<IDATx..ypT......H"[B....(..]G@6.i..F......q.U.....g.MM!.........QYMH....@..Y:.}_.6..t..!I.Mw._..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.once.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	908
Entropy (8bit):	5.080594716216923
Encrypted:	false
SSDEEP:	12:UOzU1tEIxdc+l+Q1V2DKF4kbbju1KAD4cSdcWKp2RDFrOz0hGhe9a711x5OvGKVw:NY4oiZSdcL2DFaTeY10vGK5YZY1rlW
MD5:	48540C4B174900EEE9E0894EBBD23FD7
SHA1:	3D7ECB0A1FEF4AEEACF3F9B82099027DE44C652A
SHA-256:	1DA79754CCDA7C241F56D5A82ED377C3384B58DB3C718D9C1FD38843C47D8DF3
SHA-512:	74ECE696B1E978E6E86A783C356FFA0275DC736AA67AB8698AF8E0E53C40FBAE56748450951AF86A6773450B7FD885D269978C55DF384401AC5F5211A4488012
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/assets/vendor/jquery-once/jquery.once.min.js?v=2.2.3
Preview:	/!. jQuery Once v2.2.3 - http://github.com/robloach/jquery-once. * @license MIT, GPL-2.0. * http://opensource.org/licenses/MIT. * http://opensource.org/licenses/GPL-2.0. */.(function(e){"use strict";if(typeof exports==="object"&&typeof exports.nodeName!=="string"){e(require("jquery"))}else if(typeof define==="function"&&define.amd){define(["jquery"],e)}else{e(jQuery)}})(function(t){"use strict";var r=function(e){e=e\|\|"once";if(typeof e!=="string"){throw new TypeError("The jQuery Once id parameter must be a string")}return e};t.fn.once=function(e){var n="jquery-once-"+r(e);return this.filter(function(){return t(this).data(n)!==true}).data(n,true)};t.fn.removeOnce=function(e){return this.findOnce(e).removeData("jquery-once-"+r(e))};t.fn.findOnce=function(e){var n="jquery-once-"+r(e);return this.filter(function(){return t(this).data(n)===true})}});.//# sourceMappingURL=jquery.once.min.js.map

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\json3.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	8104
Entropy (8bit):	5.637893091956298
Encrypted:	false
SSDEEP:	192:wq6oGPunc696v7m2G4xXc9sbVwabuTPP4/0BX/UVTUZxcVQWQXEATf:wqVG2c57m21XSs/buTjVsTUqQXf
MD5:	BA28BD92C1B44FD2DD8DFA017A9EDA02
SHA1:	46785C1E5D0D42C9A7A7CB43908238DC7D8AD376
SHA-256:	3B096823DFE7BEEDB02E5F77CFC5D37D2EDC1FDB6AE04583F13727D84E9DA5C6
SHA-512:	DE7A6F51A51DB8807F29126A76212A87230FE971DB35C29A485879EEE99FF54C9B7F2302506DB2659255168E51C910614757F681B23C4ED77D0AD6CAFABB3D6E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/wcm_survey/js/json3.min.js?v=1.x
Preview:	/! JSON v3.3.0 \| http://bestiejs.github.io/json3 \| Copyright 2012-2014, Kit Cambridge \| http://kit.mit-license.org /.(function(n){function K(p,q){function s(a){if(s[a]!==v)return s[a];var c;if("bug-string-char-index"==a)c="a"!="a"[0];else if("json"==a)c=s("json-stringify")&&s("json-parse");else{var e;if("json-stringify"==a){c=q.stringify;var b="function"==typeof c&&r;if(b){(e=function(){return 1}).toJSON=e;try{b="0"===c(0)&&"0"===c(new A)&&'""'==c(new B)&&c(t)===v&&c(v)===v&&c()===v&&"1"===c(e)&&"[1]"==c([e])&&"[null]"==c([v])&&"null"==c(null)&&"[null,null,null]"==c([v,t,null])&&'{"a":[1,true,false,null,"\\u0000\\b\\n\\f\\r\\t"]}'==.c({a:[e,!0,!1,null,"\x00\b\n\f\r\t"]})&&"1"===c(null,e)&&"[\n 1,\n 2\n]"==c([1,2],null,1)&&'"-271821-04-20T00:00:00.000Z"'==c(new D(-864E13))&&'"+275760-09-13T00:00:00.000Z"'==c(new D(864E13))&&'"-000001-01-01T00:00:00.000Z"'==c(new D(-621987552E5))&&'"1969-12-31T23:59:59.999Z"'==c(new D(-1))}catch(f){b=!1}}c=b}if("json-parse"==a){c=q.parse;if("function"=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ko_FnJm7Xd-wzIUQmVQOF0fwwxvNvX0stfDp-AY6VdzmoY[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6722
Entropy (8bit):	4.792393673784155
Encrypted:	false
SSDEEP:	192:N7TP/JIvEexBbdiO7GPurkrwxiQWEJmt+fDHcXPT79/Dq:9avEIBbdiO7WurkMxxWEMt+fDHc/T7ZO
MD5:	AA9E31E00E72240150F376C2CC62EBA2
SHA1:	C8C5FCD378AC9BCF3426E4CECA427ABB816EF7E3
SHA-256:	167266ED777EC33214426550385D1FC30C6F36F5F4B2D7C3A7E018E957739A86
SHA-512:	AB8382363ADD41548DD2F801E491B4AD9CF658EE5E151A20E5372A0E847DDBCA97D4C73EB8ACBA908858111ECD892AC326265C70A95EC8EF3591FD418F754B3C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/ko_FnJm7Xd-wzIUQmVQOF0fwwxvNvX0stfDp-AY6VdzmoY.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Hide":"\uac10\ucd94\uae30","Changed":"\ubcc0\uacbd\ub428","Collapse":"\uc811\uae30","@label":"@label","closed":"\ub2eb\ud798","Home":"\ud648","Image":"\uc774\ubbf8\uc9c0","Link":"\ub9c1\ud06c","Unlink":"\ub9c1\ud06c \uc81c\uac70","(active tab)":"(\ud65c\uc131\ud0ed)","Next":"\ub2e4\uc74c","May":"5\uc6d4","Sunday":"\uc77c\uc694\uc77c","Monday":"\uc6d4\uc694\uc77c","Tuesday":"\ud654\uc694\uc77c","Wednesday":"\uc218\uc694\uc77c","Thursday":"\ubaa9\uc694\uc77c","Friday":"\uae08\uc694\uc77c","Saturday":"\ud1a0\uc694\uc77c","Alias: @alias":"\uacbd\ub85c \ubcc4\uba85: @alias","No alias":"\uacbd\ub85c \ubcc4\uba85 \uc5c6\uc74c","Cancel":"\ucde8\uc18c","Title":"\uc81c\ubaa9","Status":"\uc0c1\ud0dc","Submit":"\uc804\uc1a1","Group":"\uadf8\ub8f9","Author":"\uc791\uc131\uc790","List":"\ubaa9\ub85d","Remove":"\uc81c\uac70","Description":"\uc124\uba85","Disabled":"\uc0ac\uc6a9 \uc548 \ud568","Enabled":"\uc0ac\uc6a9","More":"\ub354 \ubcf4\uae30","Taxonomy"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\leftarrow[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 31 x 31, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	705
Entropy (8bit):	7.57132262885162
Encrypted:	false
SSDEEP:	12:6v/7nRxmIlCrCfg0IVZOZIByLLfOgLo746W6ULVC0jI6ElRHPDgpc:AA5QgTZaIByLCgEn+LVa6EPLgi
MD5:	F0F0DC43825D121965A95EDE7709BAD5
SHA1:	539B71D4EB8BDE2D97A3BC77DC669DFA17F6CAF5
SHA-256:	C7E512C56E610CFA871397D621A220BDF170FAEBA3AEEC7B021464682AF18ECE
SHA-512:	E4F15E26B200ED9C811E3634520EFEEEF15CB54C2B6A69B97BE69BA75095C278554405C19AA99D11A08330D34B98F17D7D71B7D351AD43AE1427A1DDC8396C84
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/leftarrow.png
Preview:	.PNG........IHDR................9....pHYs...%...%.IR$....sIDATH...1l.0...#.J0.M.(en.7..D.l]NX......z[68.....z].....:7'....&.....Y...^p.%q..R.KQ"............n.@.....".!.@.N...F8..Al.C.W5.<.......g.Qz....p.;....0Y.........H.P.\..-.m..g.K#7.//v.KS..]...;..{O.......^.5`C.<.qw..26E...ac.f.j.'.......>$..Z.E?c.xG..piI..U...o.>.....$2..z.....I..}.......G'..T..w....$..]e.U.I...#...../..0<xcQ.,..=....oi..D..>.J=s...U.....%%.T.!..D#......K.'..T.3.(..U[..n'....V.0..k;..4...>5`3..k............I]..d.$+&.w.......T..U..jU....}.p....<..;+WL...,&.....(2......;...xv.+.......S..BR.i.....z.e..]...+..w4....!.Q_.NTb4.X......X..*W..Aq.F...SJ..5.;.M...0.j.2(..(..Ug2....u....+l....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\linkedin_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	500
Entropy (8bit):	4.7794707363492455
Encrypted:	false
SSDEEP:	12:t41jzKvGmGdjc9AF3c/b1Iz70+kOg3c1I/ORmIz0ShkcBWKC:t41jWJ6Y9AF3cD1Iz7VkO1I/ORmIz0Sy
MD5:	F7B2F2D04178C0DFFD8314D8DB448253
SHA1:	DABB860DBDBA4CDCC3D45EA8494A0EAB33813E34
SHA-256:	AA789ECB3E44F8E7B902426F51D76B98B9F1F2050CE60B34CF8C52E989C34CC5
SHA-512:	72BEFD85C4D8C4A1CBDF30B60F37D364556B4B1C27068726196620655998EE97A40ECE3D0573549CA0816995E73D7284BEFC15AABE635A0A9289665D1446CE76
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/linkedin_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>linkedin_white</title><g id="linkein"><path d="M46.5,0H3.5A3.508,3.508,0,0,0,0,3.5V46.5A3.508,3.508,0,0,0,3.5,50H46.5A3.508,3.508,0,0,0,50,46.5V3.5A3.508,3.508,0,0,0,46.5,0ZM16.667,39.583h-6.25V16.667h6.25ZM13.542,14.025a3.675,3.675,0,1,1,3.646-3.675A3.661,3.661,0,0,1,13.542,14.025ZM41.667,39.583h-6.25V27.908c0-7.017-8.333-6.485-8.333,0V39.583h-6.25V16.667h6.25v3.677c2.908-5.387,14.583-5.785,14.583,5.158Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\luxon.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	70519
Entropy (8bit):	5.344478829134344
Encrypted:	false
SSDEEP:	768:ACRDX0b+spQcM6nO2n16S2BATgKF0vQU9UfZexruJ2tIdYdevBex122yw8R:fDX0bS6nO2fn+QUyfWrupB01I
MD5:	855CCAFBD68FFBE91B78B281FA53178E
SHA1:	6FFE648865D45797C6760A083FC5C93FE9F0044B
SHA-256:	3959367F04D1717625545C6BFC4097B1A92A7A525B3A0E560A3D5D5D221BFA75
SHA-512:	3B2AC8DB8F59457DA163FD42003F9E75047DD1F961B97A98AA33581490227E5B0AB0CC6951883991B0C301503C569D073253C6FDA025D6D1404A2D61E1E46843
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/luxon.min.js?v=1.x
Preview:	var luxon=function(e){"use strict";function r(e,t){for(var n=0;n<t.length;n++){var r=t[n];r.enumerable=r.enumerable\|\|!1,r.configurable=!0,"value"in r&&(r.writable=!0),Object.defineProperty(e,r.key,r)}}function i(e,t,n){return t&&r(e.prototype,t),n&&r(e,n),e}function a(e,t){e.prototype=Object.create(t.prototype),(e.prototype.constructor=e).__proto__=t}function o(e){return(o=Object.setPrototypeOf?Object.getPrototypeOf:function(e){return e.__proto__\|\|Object.getPrototypeOf(e)})(e)}function u(e,t){return(u=Object.setPrototypeOf\|\|function(e,t){return e.__proto__=t,e})(e,t)}function s(e,t,n){return(s=function(){if("undefined"!=typeof Reflect&&Reflect.construct&&!Reflect.construct.sham){if("function"==typeof Proxy)return 1;try{return Date.prototype.toString.call(Reflect.construct(Date,[],function(){})),1}catch(e){return}}}()?Reflect.construct:function(e,t,n){var r=[null];r.push.apply(r,t);var i=new(Function.bind.apply(e,r));return n&&u(i,n.prototype),i}).apply(null,arguments)}function t(e){var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\nr-1208.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	31332
Entropy (8bit):	5.307480606148579
Encrypted:	false
SSDEEP:	384:bW+ioYSXVnMGIhDlu7kKuaq9VB5gwlfy9StcepgYYKxsq6lM7Y0vncYemRhVxp8q:bW5Laq9VHTZDhumdcfKtCK/
MD5:	1A71E4208296F97B465116492F59124D
SHA1:	40C8559838A758630287ED0B0F8E4E076215BDB0
SHA-256:	4014CA31D3C8E768608A40ED160A405AE39836A5B2C43F256BEE3BDF427DD67F
SHA-512:	2E5853FBD0D19FE6C69D8B3106F1788A1AB2483202FAC40D8303E74925D4632E91E66B40D3FB37802E59269EE715D5EF8BFB92BAE65E215D0D67BB29D55B4C4C
Malicious:	false
Reputation:	low
IE Cache URL:	https://js-agent.newrelic.com/nr-1208.min.js
Preview:	!function(n,t,e){function r(e,i){if(!t[e]){if(!n[e]){var a="function"==typeof __nr_require&&__nr_require;if(!i&&a)return a(e,!0);if(o)return o(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=t[e]={exports:{}};n[e][0].call(s.exports,function(t){var o=n[e][1][t];return r(o\|\|t)},s,s.exports)}return t[e].exports}for(var o="function"==typeof __nr_require&&__nr_require,i=0;i<e.length;i++)r(e[i]);return r}({1:[function(n,t,e){t.exports=function(n,t){return"addEventListener"in window?window.addEventListener(n,t,!1):"attachEvent"in window?window.attachEvent("on"+n,t):void 0}},{}],2:[function(n,t,e){function r(n,t,e,r,i){var a=c(n,t,e,i);return a.metrics=o(r,a.metrics),a}function o(n,t){return t\|\|(t={count:0}),t.count+=1,m(n,function(n,e){t[n]=i(e,t[n])}),t}function i(n,t){return t?(t.c\|\|(t=u(t.t)),t.c+=1,t.t+=n,t.sos+=n*n,n>t.max&&(t.max=n),n<t.min&&(t.min=n),t):{t:n}}function a(n,t,e,r,o){var a=c(n,t,r,o);if(!a.metrics)return void(a.metrics=e);var u=a.metrics;u.count+=e.count,m(e,fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sourcesanspro-bolditalic-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20164, version 1.95
Category:	downloaded
Size (bytes):	20164
Entropy (8bit):	7.974122324136636
Encrypted:	false
SSDEEP:	384:qkavcgccU3T+vp6EqucelJ+MxJBFbQCgWHb8Kzg+GOZ5Uj83:qkavcDcU3T+xGSZJ3bK+fQU
MD5:	60573F53E7E5CEB3A6D0983E118864AB
SHA1:	1787E4C43B00AC33FE46D459446734959D6EA0FC
SHA-256:	0E3F88097CB18C4B1BF6DC48E22A500FCEE50FE691C56BF1087ACA509DC30152
SHA-512:	3AB94BAEDB64EB4FEEDAD1395ACDF45C17D9B2021A8BC92C7B1C7FA8C3F3D64FEF24A5A11C0C728CBF92D2648EE1A477505C020D72CBA77F2CE4B13A12C26E1C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-bolditalic-webfont.woff
Preview:	wOFF......N........h..._....................BASE..E$...F...Fe.].GDEF..El...^........GPOS..E....\|...j.&..GSUB..MH...\|.....s.OS/2..8....[...`\5r.cmap..8\...o...v.._.glyf...D..0...Rb8...head..4....6...6....hhea..7....$...$.{..hmtx..5..........%#loca..1.............maxp..1........ ....name..=........N.qZBpost..@....T....8(..x..\|.`[..6.K..DR.{_.MqS$%j.-Y.lY.-...KN.f.YV..u.r...=.:....xm..,'&.......9.].........P.......@.........JQ.d.VSQ.......\`<..8../.8...c..........uf.<1..]..^X.=.....a.....%t... .D]N....!..i,..>.C..Jw.~8s.pk..Cpaz:<.k.V\A...<..^.,...H...v.f.R...T.OS..D<..~1\....Cm(.2t.....3......)t.w(5#.r..m>x$....D... H...[:AlRgs:.<.m..N.&FJ...O.q....r.mW..7...Qoo...kLk..%a...;W..Ho:0.=18cP....1..f.!....wa...o]......{Zwd&:u...G....J......)..V,...!.-..U`...U.i...'6H....[V?.Z]~CUy.\..c.Ob..W...~O.~[H........N..(...9.._8:.:k..X....A.Sd..S.Gx....F..}......(>atU.....T...h9.h=.....7.....~...T../..n\.b.rG.......?.&..6.+...&q.1.Tj.qR...j..77...c....0...Yl.hq...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sourcesanspro-italic-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20204, version 1.95
Category:	downloaded
Size (bytes):	20204
Entropy (8bit):	7.975650403567298
Encrypted:	false
SSDEEP:	384:KzGuGj5etsqz9e//B48hJ0XQCedPMWHbcxg+zgQtf83:KzGuGj5g6/BTWXQCed5Q5U
MD5:	12C96D9D41277F807F1197332B75CE45
SHA1:	1C62E817904365A0A535B8BEEDAC23F62AE6BD4A
SHA-256:	AF192C0F11ECFABB552397400E5CF40DD571C42373CE60A8B4721C4491405E15
SHA-512:	7733DF622B8791DFDB80AEA306E244029A372887997A9374ABA68EB2F72B6E43A5E53CC3BBA9235AB6F736C665B8E6141344956BC662AA79045B2FB85AF9C33E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-italic-webfont.woff
Preview:	wOFF......N............_....................BASE..ED...F...Fe.].GDEF..E....^........GPOS..E........j.S..GSUB..Mp...\|.....s.OS/2..8$...Y...`[.p{cmap..8....o...v.._.glyf...D..0...R..v,.head..4....6...6....hhea..8....$...$.x. hmtx..50........~}/.loca..2.............maxp..1........ ....name..=..........W.post..@....T....8(..x.\|V.X....MB....Hi...-4u..ay.......swww......oRa.o.r._.{f..9'.U`,.....c.V..1.f.0......3&Bp:...;i.b/@..\|..~...o.V.....<..{..W.....=W..l....<#.....h...n..W.a4%89...d..4.....&'.$i....-...;.....Ht.8./.,^w..y1...8Z."..Z...z.......!.C....0..ha...EBw.Y...........e...K.=\|'_I."}s<:....W......0...{..cV...s\0..!...8...z....M..>.#.<}v&2..D...B;k.7v40...`...z...gr..D\|..P.z0<.'...].q.n).3..z.K.'''.........om......c.A......l.@1.2..]J...K......._o/{...y....%..x..v...8.K.?.~......?zv...#..s..7.6u.L&.Fi.e..........^-Bl>.N.V..zG1..%..a._..A^.....^8...L.K.3...".r...*.!.g....F.PN.....5...3\H....Rl. ..M..rvp^.U.....6t..8....z8.(..H.h..(.o#P....9.r.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sourcesanspro-light-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25956, version 2.45
Category:	downloaded
Size (bytes):	25956
Entropy (8bit):	7.977685413062721
Encrypted:	false
SSDEEP:	768:B6wjjuv+j8i70qzE8fiJiugyso+XVMxo4vc/zWL5Z:4wjXv0qw8quyso+lMx1vc/oZ
MD5:	9CF8ECE97D8D8B563A906B6257A5D006
SHA1:	9342D1E7DD7C58756FC2420DBB03D0978975C7A2
SHA-256:	9CD6677981D8B53E162FF6F74D1FD84131B93A1AFD8603666C6CD6121815D5F5
SHA-512:	6BA14DC4A8B6D5FFEE3CDA81420105319F1224F1A9F842A093CE84B10C643F4F2F87F4C415E994479C5D51E623451FAADFBFF63C725D9E0E1E219B20D7A0D602
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-light-webfont.woff
Preview:	wOFF......ed...........-....................BASE..P....F...Fe.].GDEF..Q....t........GPOS..Q\|...@..8...GSUB..b.........l.V.OS/2..Ad...U...`Z.oLcmap..A....n...v..f.glyf...D..8...f".!{head..=....6...6.}..hhea..AD... ...$....hmtx..>4........U.Yjloca..:P..........maxp..:4....... ....name..G,.......Xa.#.post..J@.......2Unrmx....`SG.?...-.."....zo.,.w..l..L'..)...i.C...]H.r._.%.R/...H..@....7..4.....g.8W~%A..G.3..;...;.%`...C.....U..(...2..e.d4...Er...&...0.4-.d....[...oE..ld._..k.w...(>.9.s....a.h..,.@......KKE...Z%?...p..2......r......7f2..&...o....T..J...+...Q).....\|.E.H".c.v.....V]..4......M,.g...W.A.z.c.U...e.pSK]{.G..;.....P.....(.1L<.H`.j...m..J.J..'...gpg{...1.^...\_.Z...p...........fg..%.v.]Fo. ..'nA.P....K.,&JD&2.i...7.Y.)..x..7x.U...=......@B.......R....$\.....>.mh........$..K..$\.=..s..%.O].o..v%n.._.=n.Ge..C....j.eT..v%z.K.6...5_}..W@.`6....i.e....<.4-=.....}2.'...n..;..g...........h..{.#x>..P..6Ie...X..$..vM.]_..tJ.....=._.,..(.%p..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\sourcesanspro-regular-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26140, version 2.45
Category:	downloaded
Size (bytes):	26140
Entropy (8bit):	7.98099137767479
Encrypted:	false
SSDEEP:	384:sIb9NQuV3HVd+oMXg8/fI8rGR/eQncRZnWmf+qwtz02tRYMryaXX7+F+KzPs0cxv:sUVNVdp2VI6GtKxRkJyaXr+UYuwmZ
MD5:	34197DF8BD5AAEED8CFA0504A098E9A8
SHA1:	799B45D504ABBFBFE68180924D7F5AC62740FEF1
SHA-256:	74AC2F10F1ECEAA80BE679E67D878F29E39FE64BE78A85F91B0B008E4962BA90
SHA-512:	ADD408CE0624ECE8B59A0C2953908777E3986D299F1054CAD4528878B28257FFCB75C3DD68A62E14E745286AFBC17D8059BC1427A0A604746CC9EE9F3FCD5EAA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-regular-webfont.woff
Preview:	wOFF......f...........-....................BASE..P....F...Fe.].GDEF..P....t........GPOS..QD...-..9....GSUB..ct........l.V.OS/2..AD...W...`[.p.cmap..A....n...v..f.glyf...D..8...e&...head..=....6...6.}..hhea..A$... ...$....hmtx..>....$....t.O.loca..:.........y..Zmaxp..9........ ....name..G.........N...post..J........2Unrmx..\|.`[....O..!.Y{....d.,yo...,g....M.{6.\|@.m...J..F.B.#a4.$m.......s.._$.....~.?.{...s.....I..(u...T......$...vZ......c.p..!...].~,.....].{7..E.pbcr.5O.w^...o.C...........b.$..f....O......'...:~...3G'..e........g..S.8....X.\,.E..&..Cr.L..7....b.........eUC....k.Hw_...3.c[.....@-....y./H...'...55 ."s..4.mH.P..f.Fb1....l.Y .I.r..W..xh....SZ.:.JO.CK..n..B.h........=wh.......#..(Gb...=m.t.s....8.s...C]w.m_.....;.F...G.d...2.,,..u1.?..'8H]..l..,...E.b...O..h{.U..6...t.$.....:5vIo.e..Z....nYG7K.\|...jX.S[..;.*...-.....P.y.A.xhx]<..##.....`.3q4...5...y.5P....0..\|9..)..8..Q .f.q{.Q......h..Ng{./...L....r...0..%4O([<....~0....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\us_flag_small[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 11, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	176
Entropy (8bit):	6.175594527798972
Encrypted:	false
SSDEEP:	3:yionv//thPl90tikmul21IwLXe+M6aRAyYnl1hUy5VEuWh42xxh7THyH5ch8mKdp:6v/lhPUtHmulLwLXepxk5lVVWPx7LzhQ
MD5:	BE327DC2791D8096D69C7737A1D0A2B8
SHA1:	394B5D8B5324C9E32CA0B5D3E378B4A0D2C5285F
SHA-256:	8A6F68DD8703CE4CB475C92FC1EEFA84C41F4741EC4C6CA8403EF99B74B94D20
SHA-512:	B9258823039A9E61B0A7428957F486626C618D60E0F6782343512BF928C2DE044666DC578732D3B227E03DF6720CC1862FA5729F7290E51993580A63F2C458F0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/us_flag_small.png
Preview:	.PNG........IHDR.............A<......PLTE.3..4..3..@ .>..>..?.....? Do.5...PIDAT..m.7......=....1.AB..9).....aY..W...luLe.l}D.Bq..~..!.2........G..uO.......>..p.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\views_button_filters[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5588
Entropy (8bit):	4.783213550612964
Encrypted:	false
SSDEEP:	96:8LFaGfT9o+QTX58ASoolw1yVLV+gVJQHqacYJJWSqt1KF1lt1q91qF1lt6rHEpix:KF1fT9o+Qb5uooC1Gh+QJQHfZASK1a1C
MD5:	1FE3A7F0EE4FE52C2A0493B36BD1483D
SHA1:	92B2D455F9E91FF1A1C4C7713E271218BBC0D0B8
SHA-256:	24ADE1C0A1A9BEF196EB0855D03EE3D1791D11488E95AF9EB0D758278E628215
SHA-512:	CEBCB117F5A921D4719FC9B8B0A77578F0B977AC4951CA0E9EEB47DC4DFE3491A2DF32FBE9072FF4CFCFACC616FFE06E41CD68AF3DBC957E7E27EE187C164F95
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/views_button_filters.js?v=1.x
Preview:	(function($, Drupal) {.. const query_string = window.query_string;.. const viewsToCheck = ['newsroom_view','newsroom_view_1'];.. const getParent = (view_display_id) => {. return `.view-display-id-${view_display_id}`;. }.. const deduceView = () => {. let returnValue;. viewsToCheck.forEach(x => {. if ($(getParent(x))) {. returnValue = x;. }. }). return returnValue;. }.. const uppercaseFirstLetter = (string) => string.length ? string[0].toUpperCase() + string.slice(1) : string;.. const getUsableLabel = (i = '') => {.. var matches = i.match(/\[(.*?)\]/);. var beginning = '';. if ($.isArray(matches)) {. const match_one = matches[1];. if ($.inArray(match_one,['min']) !== -1) {. beginning = 'start';. }else if ($.inArray(match_one,['max','limit']) !== -1) {. beginning = 'end';. }. }.. var end = getUsableParam(i);. const complete = beginning + '_' + end;. return complete.split('_').filter(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\views_data_export_auto_download[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	463
Entropy (8bit):	4.502859605528411
Encrypted:	false
SSDEEP:	12:Uom4ziKdMAYVSfV7W3wwoa65wrUUyIxPuyma3xT:lhi8tYVaV7Wgwo6UT/yJ5
MD5:	9A5BD73BADEF9E5AF54015740ACF66D0
SHA1:	09725B94F69845ED0C9D2FFA1DBE768EF32BCA86
SHA-256:	75D7414107F0B91C4011FD22BEEB4443FF07BF0A459AEA6119C211EB808171CD
SHA-512:	6B716332CA66182D43CEB6962CEB75DF6B1FFA96E3942859E1E118CC55AD88555246EC6F3AE8EEC2A52F4DA3184734B80F43ACF7E877577E4C6710272D217AE4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/views_data_export_auto_download.js?v=1.x
Preview:	/*. Views data export auto download.. . Automatically downloads file if downloadEnabled is true.. */.(function ($, Drupal) {. Drupal.behaviors.views_data_export_auto_download = {. attach: function () {. $('#vde-automatic-download').once().each(. function () {. this.focus();. if (this.dataset.downloadEnabled === 'true') {. location.href = this.href;. }. }. ). }. };.})(jQuery, Drupal);.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19776, version 1.1
Category:	downloaded
Size (bytes):	19776
Entropy (8bit):	7.973310369215988
Encrypted:	false
SSDEEP:	384:IPY47Hx6zuUTuXBxrnZuVBAc/KiNqnUcYTOnBrMf93w6NGa1xzFHxYaEVOTM:IPb78dCXBx7EVBAcvqUcUOw1RNGgxhRm
MD5:	A3BEA45981594E21F3A107386BA1A219
SHA1:	DB569EC3C02A3905264374890A5F77ECDF6808E2
SHA-256:	3D5060EEFC89D35449FA315B21D4B309202B28F53BA96979741B2E90AF68B0F1
SHA-512:	64E3B78CD87219DF9E805E495C15EB9D9DEB1996210BEBFF0C8BD822496BF36D70B6AA5CCD68E57E8BC8B1378975E8776306E5B8207DC6DA15311814E6176F52
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff
Preview:	wOFF......M@................................GDEF.......6...F....GPOS..............EGSUB.......{... J.c.OS/2...L...T...`Z.r.cmap..............3cvt .............ofpgm...........s.Y.7gasp................glyf......4Y..h...[.head..DD...6...6...thhea..D\|... ...$....hmtx..D........P..0.loca..F.... ...!a..maxp..H.... ... .3..name..H....?....Z"r.post..J(........SF.prep..L....S...V..,.x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x...l#...?.'.$.M..z......33333...33.;f.\|.lY.ee..~.J.X.;...O.3.XS]..7) ...<.._...{.W>.qf>...\|.M....?.3.....^..A\|O..c...'..A.....<.+...T.'.7....(.0.O.x......".K....~%..j....Q=.o..C3c@.=&V.....+Z...=G..vN.>...Jw..bg.X.n........7v;...j4.M.....W..`....V.....FV...).8...6?.g..I..%B.-..D4.3!......P.h.9..(."G....>.E.....dHt1,...F...b.<c...CL.V.....91..f?...E..D..D.."b..f...6.F/..9^.+......kE...-...1..y7...3....?.g..9>O7_.+.q....0..H.p4...".q".x....r"'..)...D3..#l.i..!A.*.dW.J..Z..o%B..c..F....]`..O..,tU9.VU]Q....K(..~...........#+...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\877b02039c[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\Latin-Merriweather-Light[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26988, version 0.0
Category:	downloaded
Size (bytes):	26988
Entropy (8bit):	7.982310644876317
Encrypted:	false
SSDEEP:	768:xGyZpxGTEFrRlLX6k0oTM3JWuubBaEcS0F7S:7bxGTqp0oTM5iBR
MD5:	DDAE281A2BE8F2BD6A322793A0C3CD56
SHA1:	E043728ABF897E1196F5E274B9CCB60AEF4FAF85
SHA-256:	7D237C2CE9A0FC0A16F089F746AC7457CB6D5D273968FDBD8FABD62053FB79E5
SHA-512:	C8BE301F5DC1DBCA9C8E0F7F715C5E53BBF02BB22B9D9F8043CEF8DDC6F76369869841BEF91488F9F9675D5286D49B8F6393B8561E253B12E23884B5571470CA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Light.woff
Preview:	wOFF......il................................GDEF..g....D...L.G..GPOS..g....V...`...GSUB..h(...A.....S.fOS/2..Y....O...`U...cmap..Z0...........jcvt ..a....>....5...fpgm..Z....<....vd.zgasp..g.............glyf......SF....=...head..V....6...6.'.Nhhea..Y.... ...$....hmtx..W ........R!+.loca..T..........<_.maxp..T.... ... .j.=name..a....#....h.\post..e....}......t.prep..a..........0.hx...\|dU.8\|.}..}_S[j.T.U.=/Iw.t.K.N...-.......n..d.PD.QP..Q.e.....F....2..(..J.s.{U.t.....~.?:U..}..{.s.9.!.f...1.!.R.R...f.%d..r.....Ktq...<.P..G:.xo....$.-O...?T~.....P.C..@.]..'.;n..+!Ey..>...)D...8..M d...YTjG..E8R*.......s.\....Oz]!nq.:r.+?...X.Cou..?.9...hh.c...`.....s.'.Wr..ppF>.v...&.%+.#..(.S..)....lE+..?\..n....O..?o&.#/..ai..s.;%...E.+..Mj......"..k..-.2.....o.....,....L.X(G._Ad..../R..0..9n..j.....'lW^....7X.....>^x.....>>..a.....I.....%c....V.j.xnl.cZ.R...Au..jN-r'..9.jD.t!R...$.-...@..8..L.....B\|.Y...p....b~^2...h8...PHi.LT0.H..'..W...b...'ZH....t8]b$.....=.]NW.8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\SQ22SSVH.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	92362
Entropy (8bit):	4.401994818691602
Encrypted:	false
SSDEEP:	1536:JltYqJ6GZcNQhz1Az1PJl9zQFGcQ8TlP3GVSB2nxEPA3vx8F:Tq/xShZAz1PJl9zQFGcQ8TlP3GVSB2n4
MD5:	D3CF4FCB7536CF144B871EE6E3FF9C40
SHA1:	F3275732CE8F75AE91A919A0F56BE24555B36D0B
SHA-256:	49842FB20870D3305AEC74029A9FE80894F31DA2BB121FFD822E5742FC2E5E09
SHA-512:	0F8F778EDAF45955A7E110D1C0C29D826A4964D5CAC9C4748DBD4D7C791068A291B5E917AA696B05E8A77265662574F209EECE229ECDCD128D8CAADA83D1A47C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/
Preview:	<!DOCTYPE html>.<html lang="en" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\Universal-Federated-Analytics-Min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	18764
Entropy (8bit):	5.8275070554297645
Encrypted:	false
SSDEEP:	384:TnxV7nIQD1b25/KwjtlPQbYQlDDFMuw5FkhPY+Ejnmss6XYS6ESY8ru41mYFYomS:T/Dw5QbuFkhPYnjnbo1ose/4
MD5:	9E1B714F83B726462A83DB0033BAC6DB
SHA1:	D730FF339FC2379A66E33F981D5C86EEA12D932B
SHA-256:	456E60679A0853B3C885219AC1B8FFA4BECB397615E2AF7C5B3D8051241F569F
SHA-512:	2B2D373DC6976AED988B77285BAA961B897163A862B0E9385FAAA24629C27FA8603344D2DF06240DEF1B9F2DF93E1D128299F600FE8AE0935D21B59F7667F0BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DHS&subagency=FEMA&pua=0
Preview:	var oCONFIG={GWT_UAID:["UA-33523145-1"],FORCE_SSL:!0,ANONYMIZE_IP:!0,AGENCY:"",SUB_AGENCY:"",VERSION:"20181010 v4.1 - Universal Analytics",SITE_TOPIC:"",SITE_PLATFORM:"",SCRIPT_SOURCE:"",URL_PROTOCOL:location.protocol,USE_MAIN_CUSTOM_DIMENSIONS:!0,MAIN_AGENCY_CUSTOM_DIMENSION_SLOT:"dimension1",MAIN_SUBAGENCY_CUSTOM_DIMENSION_SLOT:"dimension2",MAIN_CODEVERSION_CUSTOM_DIMENSION_SLOT:"dimension3",MAIN_SITE_TOPIC_CUSTOM_DIMENSION_SLOT:"dimension4",MAIN_SITE_PLATFORM_CUSTOM_DIMENSION_SLOT:"dimension5",.MAIN_SCRIPT_SOURCE_URL_CUSTOM_DIMENSION_SLOT:"dimension6",MAIN_URL_PROTOCOL_CUSTOM_DIMENSION_SLOT:"dimension7",MAIN_INTERACTION_TYPE_CUSTOM_DIMENSION_SLOT:"dimension8",USE_PARALLEL_CUSTOM_DIMENSIONS:!1,PARALLEL_AGENCY_CUSTOM_DIMENSION_SLOT:"dimension1",PARALLEL_SUBAGENCY_CUSTOM_DIMENSION_SLOT:"dimension2",PARALLEL_CODEVERSION_CUSTOM_DIMENSION_SLOT:"dimension3",PARALLEL_SITE_TOPIC_CUSTOM_DIMENSION_SLOT:"dimension4",PARALLEL_SITE_PLATFORM_CUSTOM_DIMENSION_SLOT:"dimension5",PARALLEL_SCRIPT_SOURC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\alert[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	286
Entropy (8bit):	4.992260970878982
Encrypted:	false
SSDEEP:	6:tI9mc4sl3QQDqzcSzKvkLINoi1IMJEb1y9O9i9tYyJAytMe:t41jDqzclbIBx40iYjytMe
MD5:	CF204BC7249777AFFBC1A3E007AE09DE
SHA1:	A092C1CA8E17EA7E1407049BD1C386FEA95CCB77
SHA-256:	A0CB5B38DC682D598C4ECAFBA72BEA765B93B72B8BC66D2921932FE43783A28B
SHA-512:	39A7E2BA283777531E33EEB5511468E5389AC374151C2DAB1A0B4B1C45DF01FF231BE20D8966B5296C58462503158B9364B639AF9F83804D4E51EA4972555CE9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/alert.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><g><path d="M28.3963,31.1879H21.6037V8.9134h6.7926ZM25,41.0873a3.3964,3.3964,0,1,1,3.3963-3.3964A3.3963,3.3963,0,0,1,25,41.0873ZM25,0A25,25,0,1,0,50,25,25.0012,25.0012,0,0,0,25,0Z" fill="black" fill-rule="evenodd"/></g></svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\angle-arrow-down-primary[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	531
Entropy (8bit):	4.755724330996582
Encrypted:	false
SSDEEP:	12:t4/KYf3chNSipXWw26cuw2KXSjFQ0JZ6bz8Y:t4LfshNSa26I2KXSJQ0rY
MD5:	4E098A8A541CB321425A45CFC1894642
SHA1:	AC6FB56315462704602F4C901F711F666F4DEDC8
SHA-256:	DC9F2CC3705A9879938AF1B87D8BF0A7997FA05E2EAFAE881A1C5988659A3A5E
SHA-512:	D170377010F7C920FDB5D327826B6B8ECF6ED9C3495BD6365C55F1E9E4C9F6BDC6EBCD79F165AAFBFD889D6ECABC52886894CBD8510891145BC695710857C846
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/angle-arrow-down-primary.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 512 512" xml:space="preserve"><path class="st0" d="M506.9,137.5l-25.6-25.6c-3.4-3.4-7.4-5.1-11.8-5.1c-4.4,0-8.4,1.7-11.8,5.1L256,313.5L54.4,111.8 c-3.4-3.4-7.4-5.1-11.8-5.1c-4.4,0-8.4,1.7-11.8,5.1L5.1,137.5c-3.4,3.4-5.1,7.4-5.1,11.8c0,4.4,1.7,8.4,5.1,11.8l239.1,239.1 c3.4,3.4,7.4,5.1,11.8,5.1s8.4-1.7,11.8-5.1l239.1-239.1c3.4-3.4,5.1-7.4,5.1-11.8C512,144.8,510.3,140.9,506.9,137.5L506.9,137.5z" fill="#005287"/></svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\angle-arrow-down-white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	971
Entropy (8bit):	4.437718715330302
Encrypted:	false
SSDEEP:	24:2d6z7hsO42D1Qq0gL4bo3SuX6IhaVBw+wcTjwk5h:cKzD1QqzLeopaVBlb5h
MD5:	2016AC01D97FE306838A2340F7852BCA
SHA1:	5293834EDEDA047587D1B1880E805B5F4F7B785D
SHA-256:	7638FCE19AB3A14E436CD2C2EACCE0708233EA0FC5A0B0C617BD3DA5E7D4D724
SHA-512:	105ED4C6AF5D19D15A324BDED76491EC05A8B24E95307F99DF894D4F71C43D0B9481CBE7A076FCBDFBDD940D5CB5D19F2754FA5FBB4287FFD58F7AD20C133B98
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/angle-arrow-down-white.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>.<svg xmlns="http://www.w3.org/2000/svg" width="512" height="300" viewBox="0 0 512 300">. <path fill="#FFF" d="M506.884115,31.4837942 L481.234609,5.8414763 C477.816832,2.41651078 473.879738,0.709418838 469.428721,0.709418838 C464.990282,0.709418838 461.054986,2.41651078 457.635411,5.8414763 L256.000898,207.458019 L54.3807615,5.8414763 C50.9611868,2.41830772 47.0258907,0.711215777 42.5802639,0.711215777 C38.1328401,0.711215777 34.1975439,2.41830772 30.7797662,5.84327324 L5.13205746,31.4945758 C1.70709194,34.9105567 0,38.8458528 0,43.2932766 C0,47.7371064 1.71248276,51.6724026 5.13205746,55.0901804 L244.203995,294.165711 C247.618179,297.585286 251.557069,299.294175 256.002695,299.294175 C260.448322,299.294175 264.376431,297.587083 267.794208,294.165711 L506.884115,55.0901804 C510.301893,51.6706057 512,47.7353095 512,43.2932766 C512,38.8458528 510.300096,34.9105567 506.882318,31.4873881 L506.884115,31.4837942 Z"/>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\backtotop[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 65 x 65, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2949
Entropy (8bit):	7.343046009636644
Encrypted:	false
SSDEEP:	48:i/6meL4knA9WIONJ/c0SuCGJ3SIyHKAJJZp3kF/cahfRE2ZnHMQ6aEJE1fGmYMBy:iSUknmWIO7/oujk5HKAJ39k6ahK2ZnHY
MD5:	45E5009E95826981427DA928340D0CDA
SHA1:	D7DFFE8AAF6A57C73B7E5BC381CECF8F8D6A905F
SHA-256:	A00061A966CA9405457FEA0153C9D8094A655ACCBDC76368948620308C1D3149
SHA-512:	79A21C4DEEA3BA6A3B9593946C9B7CA12EDEA62584BAAA30F89DA1B5415D2430C352838888C97755094E0BB28ACC0904A7FC9982F7A847BA0CF3C78044BEF89C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/modules/custom/back_to_top/backtotop.png
Preview:	.PNG........IHDR...A...A........E....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c003 79.164527, 2020/10/15-17:48:32 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmp:CreatorTool="Adobe Photoshop 22.1 (Macintosh)" xmp:CreateDate="2021-01-19T10:22:50-05:00" xmp:ModifyDate="2021-01-19T10:58:28-05:00" xmp:MetadataDate="2021-01-19T10:58:28-05:00" dc:format="image/png" photoshop:ColorMode="3" photoshop:ICCProfile="sRGB IEC61966-2.1" xmpMM:InstanceID="xmp.iid:a9893f42-57d5-4fce-a129-31b4891634ec" xmpMM:DocumentID="xmp.did:a9893f42-57d5-4fce-a129-31b4891634ec" xmpMM:Origin

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\coronavirus[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	99734
Entropy (8bit):	4.341187430002758
Encrypted:	false
SSDEEP:	3072:Tq/MShsAz1PJl9zQFGcQ8TlP3GVSB2nxEPA3v83:Tqpm
MD5:	663D6C587F95D8E985C67BA2AD970F66
SHA1:	856D8F630AF2C7AB2C035CF3ADB0ABA24A7A07BA
SHA-256:	142D9C8E9318E77B6706D863C80957416B8CF8079E4D2A0A9F191B727FE45854
SHA-512:	DA57F39341635794823678757F291A0D981D6F049590CB442D025FBB76B1D6DEC9EB23E41C0FCC6652C9D9984A32E569E40D3DB51EAE24593E150F6A3496A514
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/disasters/coronavirus
Preview:	<!DOCTYPE html>.<html lang="en" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\datatables.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	139696
Entropy (8bit):	5.376548440008309
Encrypted:	false
SSDEEP:	1536:ePFoMpN8Q00R9aPZxJrtGPld60RM3PvatwQkxxgiEaCohcoKymy6yVQyPUG9JHt5:GGNQ00R9ouq/vatB1oK+599FtuY1
MD5:	AD803018C88C0922C59FF40B11983A5A
SHA1:	FED17B6110197247DD493E38270B3BA206473DE0
SHA-256:	A953487168E1E545F0C4397F352364FD48C419FBE5B7F4AE5889C475A2C02263
SHA-512:	3018D390023CEEF456A5696440DAD3431A181E1195639CFD3838AACFBC31DF8A645E183CFB5F27A12D762B556131F5372B76764A8A155567D04BB811807036DC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/datatables.min.js?v=1.x
Preview:	/. This combined file was created by the DataTables downloader builder:. * https://datatables.net/download. . To rebuild or modify this file with the latest versions of the included. * software please visit:. * https://datatables.net/download/#dt/dt-1.10.20/af-2.3.4/sp-1.0.1. . Included libraries:. * DataTables 1.10.20, AutoFill 2.3.4, SearchPanes 1.0.1. /../!. Copyright 2008-2019 SpryMedia Ltd... This source file is free software, available under the following license:. MIT license - http://datatables.net/license.. This source file is distributed in the hope that it will be useful, but. WITHOUT ANY WARRANTY; without even the implied warranty of MERCHANTABILITY. or FITNESS FOR A PARTICULAR PURPOSE. See the license files for details... For details please refer to: http://www.datatables.net. DataTables 1.10.20. .2008-2019 SpryMedia Ltd - datatables.net/license.*/.var $jscomp=$jscomp\|\|{};$jscomp.scope={};$jscomp.findInternal=function(f,z,y){f instanceof String&&(f=St

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\email_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1057
Entropy (8bit):	4.339923762577471
Encrypted:	false
SSDEEP:	24:t41jSjqzrrMfQyIksac8pBB/OHvvKZnji0hjC:CjSjqzU308pqeji0E
MD5:	73F7A65F5A8BF234D2767A102966EAEA
SHA1:	AB528A8D351C376FB6AC887B07B21491D18D1782
SHA-256:	6EB6A02D160331C1951B7AD47F68A1C35F82807E3A0834B99BE315339311239C
SHA-512:	089A9F58F4276D6369024CCCDEA9B9E1B9A3E17A8749CD6ED852329A50772EAD84D4273E3F62D66C8A8367A717ED4CBBA556F5B67062EC24D2E56AA68C7891A0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/email_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><g id="Layer_2" data-name="Layer 2"><path d="M37.85,38.1843H11.9086a2.8994,2.8994,0,0,1-2.8811-2.9208V21.21a23.7021,23.7021,0,0,0,4.3861,3.325c2.5067,1.7777,5.0283,3.5282,7.54,5.301v.0024a9.7053,9.7053,0,0,0,2.539,1.27,4.5848,4.5848,0,0,0,2.8314-.04,9.7953,9.7953,0,0,0,2.73-1.4157c3.2629-2.2861,6.55-4.5448,9.8135-6.8361.6348-.4512,1.22-.9769,1.8546-1.4926V23.33c0,3.9794-.0322,7.9589,0,11.9335H40.72a2.9636,2.9636,0,0,1-2.8687,2.9208ZM9.0965,15.6139a3.4643,3.4643,0,0,1,.7439-1.53,2.1824,2.1824,0,0,1,1.7257-.8257H37.813a2.8468,2.8468,0,0,1,2.9009,2.348v.0769a4.2893,4.2893,0,0,1-.7439,2.97,9.1013,9.1013,0,0,1-2.5389,2.539c-2.9381,1.9736-5.8712,4.024-8.7846,6.0745a14.5026,14.5026,0,0,1-2.6034,1.6116,2.6262,2.6262,0,0,1-2.3406-.0371,23.5158,23.5158,0,0,1-2.3356-1.4158q-3.7452-2.54-7.4505-5.172l-.0025-.0025a18.4327,18.4327,0,0,1-3.1736-2.467,6.217,6.217,0,0,1-1.5472-2.4819,3.6087,3.6087,0,0,1-.0967-1.6886ZM25,0A25.0006,25.0006,0,1,0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\es_9wP8Aa6iROKfy4Ywqbavri3nVLdPLDRbQJXYiRamec4[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	17345
Entropy (8bit):	4.870205252450117
Encrypted:	false
SSDEEP:	384:2Pbe9R5avD2WXDuH7G9QSaR/nnWDNJFh/1CoXZYI:7X0r5KbYmK1J1mI
MD5:	3BCAD93D8410F7F8D869F28B3EEBA38D
SHA1:	708AC346418AE52C444231052E6E8E2BE8A45CD3
SHA-256:	F703FC01AEA244E29FCB8630A9B6AFAE2DE754B74F2C345B4095D88916A679CE
SHA-512:	9E982693AFB5B20F300C342882EABBCA5D9B391D64A340E248477B612C8D99AD8A8B3F0E6D898E64EBACFD463D8E56B83F4BD8048F6682640B87E3951A43EAE6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/es_9wP8Aa6iROKfy4Ywqbavri3nVLdPLDRbQJXYiRamec4.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Show all columns":"Mostrar todas las columnas","Hide lower priority columns":"Ocultar columnas de menor prioridad","Show table cells that were hidden to make the table fit within a small screen.":"Mostrar celdas de tablas que estaban ocultas para que la tabla se ajuste a una pantalla peque\u00f1a.","!modules modules are available in the modified list.":"!modules m\u00f3dulos est\u00e1n disponibles en la lista modificada.","Hide":"Ocultar","An AJAX HTTP error occurred.":"Hubo un error HTTP AJAX.","HTTP Result Code: !status":"C\u00f3digo de Resultado HTTP: !status","An AJAX HTTP request terminated abnormally.":"Una solicitud HTTP de AJAX termin\u00f3 de manera anormal.","Debugging information follows.":"A continuaci\u00f3n se detalla la informaci\u00f3n de depuraci\u00f3n.","Path: !uri":"Ruta: !uri","StatusText: !statusText":"StatusText: !statusText","ResponseText: !responseText":"ResponseText: !responseText","ReadyState: !readyState":"ReadySt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\featured_mini_youtube_icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 140 x 140, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1367
Entropy (8bit):	7.667303061591432
Encrypted:	false
SSDEEP:	24:id/67DNhYfT8J8HFGPmuo5lk90IPdc39XITOTU8mWxvSzkxY8/FUfA1W:m/eJe48HFGPwlk90MQhqOmWx5xNF1W
MD5:	6109AF80822E95708CF2F63F65488C9C
SHA1:	3F25A8E1DC5F99A8979DD07AB145A100A6C4BFBF
SHA-256:	A91DA8C6D9726B36A1231D66BF78E2A90F10C39E0D14433F3A278450305281BD
SHA-512:	4860B1E1859CD3D9B25B2E5FA00CD6A0A1601FCDEEFB37EEF4FCBDCF80EADEA9FF2C4BABC9CE03E05787478D9CBE501D4E0D355DE8052E3367A69EB02F9D98FA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-03/featured_mini_youtube_icon.png
Preview:	.PNG........IHDR...............A>....pHYs...%...%.IR$.....IDATx....F.F?q.n....B.\A..L: ...t.+..`E......r....-....-h.=g_X\|\|.......)2...+3.............a.a.a.a.a.a..............a.a.My7.O.E.I...k)cr..~2..+I....K.p.vy......k.do...?fbE.%-...K...~..$...rW...&..R'.........I..b\a.h)iE...1...c..J2....f=d.HzD.I.A...L......N..].)_+L&.....{..\..h.,A......&.RI.0.A.E...csK!.=c.$?$...%..%h.;.:T.....2m.&E.p..]ZR.X....TRa.-...+..p.,phK..oKZ0Fp.........s.%.........1.D.-.x.?....d.^........pI.g/.....x.CjI.%....^.a..hW.!..kq...^....Ls....v......1,a...]......qV......2fI...^.#../....I.?d...Kk..8[7 .........)e.Z.vh.....#.R.o...0\|-p,N......q..k..8;.3'.(.%...\|.0...!. ...a..o.F..oV.>N9. ......\|.b...I.....\..s".&..#.fJ..a..7.i"w..1.W..3]k"7.L.......U.q"....S2..2..%-ixY...Q..!. .9%..*.CNA..r.F...D.~9e.....0.r.F<...w.f..(ZK..Y$5..BK". .9.F.)..)v-./T8K!.zC!.yW.......^K.9e+.uG..S.....kR....(..h#...,........T...C..S...^....%Qa.W......0...X.w..Z.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema-seal-footer[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	36549
Entropy (8bit):	4.218511469223735
Encrypted:	false
SSDEEP:	768:vhQefSEnFzG5HZJdt6a6phZS1LIpRwBfCBHPXP9:vhQMnFzG5HvaFphZSl639
MD5:	CF9000154B179BC7263183CBBE2E0A23
SHA1:	114AAC413A7360A6157048BDD047BE40CEDF49A4
SHA-256:	90958A025C0229DE6BD29A963116F14F9D9F72BE85BB6FC1CBBA9CEC674A2C3A
SHA-512:	877BBB750347F49138D11E7142BE763B1F09E649D78B4A3E5519A4C508C3D68DAB55C83CBCB43C5ED997C602A45A0DDD894ECF27502CFFA658DB0D5D1672364E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/fema-seal-footer.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 160 59.3155"><polygon points="65.792 39.713 69.049 39.713 69.049 19.89 65.792 19.89 65.792 17.904 82.358 17.904 82.358 23.068 80.371 23.068 80.371 19.89 72.903 19.89 72.903 28.748 78.703 28.748 78.703 25.85 80.69 25.85 80.69 34.153 78.703 34.153 78.703 30.736 72.903 30.736 72.903 39.713 76.2 39.713 76.2 41.7 65.792 41.7 65.792 39.713 65.792 39.713" fill="#00578e"/><polygon points="84.424 39.713 87.64 39.713 87.64 19.89 84.424 19.89 84.424 17.904 101.067 17.904 101.067 23.068 99.081 23.068 99.081 19.89 91.492 19.89 91.492 28.47 97.331 28.47 97.331 25.572 99.32 25.572 99.32 33.874 97.331 33.874 97.331 30.457 91.492 30.457 91.492 39.713 99.358 39.713 99.358 36.379 101.344 36.379 101.344 41.7 84.424 41.7 84.424 39.713 84.424 39.713" fill="#00578e"/><polygon points="103.132 39.713 106.39 39.713 106.39 19.89 103.132 19.89 103.132 17.904 110.757 17.904 110.757 19.89 118.388 35.82 125.895 19.89 125.895 17.904

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema_chosen_fix[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	422
Entropy (8bit):	4.85831894906918
Encrypted:	false
SSDEEP:	12:2vH0CvFjaKJbINeCvF0AL6L7W9BnrR/DJk3feH3nv:2vvjaKVu0AL6OpGgnv
MD5:	83189DA9CBC82F36C1D9980A27BCB7BB
SHA1:	0FE99FF3E593F27F8646FD04EC5BC22471435F01
SHA-256:	7E2984D5663F03ACF5CC807F1B1518C0A3BD8D18C9B7BB6804410919187FB4D6
SHA-512:	E2C258246E636666E704F3A5D0CE43EF986F25D4EC5B5EEC136828ED4117FAD512894BAE3D0FC29A67B4565D275FAA4A9337B672230B02CB8FCC228916C1DCB0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_chosen_fix.js?v=1.x
Preview:	(function ($) {. 'use strict';. const fixChosenTabs = () => {. $("select[tabindex='-1']+.chosen-container").attr("tabindex","0");. }. const watchChosenTabs = () => {. $('button.usa-accordion__button[aria-controls="edit-secondary-content"]').on("click",fixChosenTabs);. }. Drupal.behaviors.chosenTabFix = {. attach: function (context) {. fixChosenTabs();. watchChosenTabs();. }. };.})(jQuery);.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema_code_typography[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	183
Entropy (8bit):	4.676860650577912
Encrypted:	false
SSDEEP:	3:2LGXgw8tiNETL5dVOFYFwNbGTlKt79BdBcEWWXpRENxFtiF3y9ev:2LGQrtiWxdcFz4kZdO/epR+FtiF3nv
MD5:	97A8D6CAAF40AFA9C870DDFDA6EBB172
SHA1:	031C4E2C8207CA936A4D431658D24574AB28FF53
SHA-256:	E33C9F7910BD6D178949238FE65F6320C42CFF658C2F012150CCCA78141DE614
SHA-512:	DA89F0597A0FAD8F51CB08E3642FDD8A45B83B47B91891EDC66A36465984BF406582B898701090F41E81F78CD58F5CF0FB1D203F0256C99329804711490BEC17
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_code_typography.js?v=1.x
Preview:	(function ($) {. 'use strict';.. Drupal.behaviors.codeTypography = {. attach: function (context) {. $( "code" ).parent().addClass( "contains_code" );. }. };.})(jQuery);.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema_search[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3456
Entropy (8bit):	4.809212468400506
Encrypted:	false
SSDEEP:	48:cLvF+9fcmiAdfIckwW9pxQLNc3KbH1OoLOHMYTvOa+UW0VBDOk3Ad38dzk2:Ig9fcFPc7W9pxQBcOaDjOCZAd38dzl
MD5:	0A810F390DD828EF3467DB064C9EEAF3
SHA1:	BE13F10ABDADF4689FF3228915261AE141B85D1F
SHA-256:	0A0813E7A995A1480890E9C687F1E1C73571E747A9CDF525C9AC782343CB0227
SHA-512:	C661CEB4E0CAC81F0634A6B666AA1B9A4587B816786B8523BA1AB7538DE74B053C8ADC6C693B876FE9F620332EFB57EDEDF9823D87802342ECE731F698E0B07F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_search.js?v=1.x
Preview:	(function ($) {. 'use strict';.. const searchPlaceholder = Drupal.t('Search', {}, {context: 'Javascript'});. const searchAlt = Drupal.t('Search icon', {}, {context: 'Javascript'});. const searchLabel = Drupal.t('Enter Search Term(s):', {}, {context: 'Javascript'});.. Drupal.behaviors.usaSearchResizeBehavior = {. attach: function (context) {.. var currentScript = $('[src="//search.usa.gov/javascripts/remote.loader.js"]');. if (!currentScript.length) {. var usasearch_config = { siteHandle:"fema" };. var script = document.createElement("script");. script.type = "text/javascript";. script.src = "//search.usa.gov/javascripts/remote.loader.js";. document.getElementsByTagName("head")[0].appendChild(script);. }.. var mobileBreakpoint = 1023;. // Resize timeout event ID.. var resizeTimeoutId;. // Resize timeout duration in milliseconds.. var resizeTimeoutDuration = 100;.. const produceSearch = (searchForm,af

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema_search_filter[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	576
Entropy (8bit):	4.68801757473706
Encrypted:	false
SSDEEP:	12:zAMkHUymEIuarTuM9cmym3Sy4SRymKeIuarTuM9cmyZ1Sy4SPn:zAMkLmTujMqmym3Sy4SMmKFujMqmyZ1L
MD5:	51096BE55E8F32D548720C5ADE9A5185
SHA1:	D0F5287B2158707CF35F846A82C8640CC20F2B16
SHA-256:	104A54092E1109C9C43D116386798F6C2EB8037843FA41C446B3A0A07A5E87C1
SHA-512:	38A4549EBA25CCA44DC651D67722DE83EC134A835B005EE5575C9C5A1DBD00B461B81C8DCD975384024C56A4E8AE0C0B51A7A488D80D373DD7BC9407D7B27E43
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_search_filter.js?v=1.x
Preview:	jQuery(document).ready(function(){. jQuery("#search_filter").on("keyup", function() {. var value = jQuery(this).val().toLowerCase();. jQuery("#searchable li").filter(function() {. jQuery(this).toggle(jQuery(this).text().toLowerCase().indexOf(value) > -1). });. });. jQuery("#views_search_filter").on("keyup", function() {. var value = jQuery(this).val().toLowerCase();. jQuery(".views-row").filter(function() {. jQuery(this).toggle(jQuery(this).text().toLowerCase().indexOf(value) > -1). });. });.});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\fema_sitewide[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2699
Entropy (8bit):	4.777484255461125
Encrypted:	false
SSDEEP:	48:kMqUbTmmkcKaKDDNLJUrlL/mmlLYcYipLKmmLRcVJ/DNIDIgw6Q7ggPN:YWmyKaSLJeTmm/fUmJf/BCi97ggPN
MD5:	9C4E806D949C0A54F9E735667724B185
SHA1:	C44FFF165C4E107E5018885C5659A3440A308AA8
SHA-256:	0BFB30853E8F91B23D676DCE9885E87866DEEBEC66829538C0282A06339AE928
SHA-512:	74D87AAD5C22C35CEB67F5B0FF68D1422265FBEBB9C2D647F709AB50EC64B47E47EA623D0AE76AE347875B2A073C5AF8C5FFD1162CBA6652500D80FA28B653FF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_sitewide.js?v=1.x
Preview:	jQuery(document).ready(function() {.. //When a user presses enter or clicks a dropdown with the class expanded move focus to first element in dropdown. jQuery(".usa-nav__primary-item").keyup(function (e) {. e.preventDefault();. //When a user tabs to a primary menu item, hide the previous menu (via uswds attr settings). if((e.which \|\| e.keyCode) == 9) {. if (jQuery(e.target).hasClass("usa-nav__link")) {. var button = jQuery(this).prev(".usa-nav__primary-item").children("button");. var ul = jQuery(this).prev(".usa-nav__primary-item").children("ul");. button.attr("aria-expanded","false");. ul.prop("hidden", true);. }. }. if((e.which \|\| e.keyCode) == 13) {. var first_child = jQuery("ul li:first:first-child a", this);. jQuery(first_child).focus();. }. });.. jQuery(".usa-nav__secondary-links:first-child li").keyup(function (e) {. e.preventDefault();. //When a user tabs

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\front-behavior-mapping[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	294
Entropy (8bit):	5.084561001612572
Encrypted:	false
SSDEEP:	6:UnG45Bi8mgO9l3PDicLmGU91+n/6SSdfIU7JbDRWUkEmkUofiM3Z8:Urf1u3PDixGU9whiIyDRWUkEeoaM+
MD5:	5540088681EA28D1A6D6F2A4ABEB120D
SHA1:	C46D499613B6DF01DAA52BF4812AFF2FBD8A1DDF
SHA-256:	D7D98CC5A76519D555CC30144C3AFDC618CF152B86D5121F03C25ACA49E659A8
SHA-512:	F3C5A77D404962283AEBE542B84023C6693F20C32C6840F7CD240D0FDB3A65C867C053731A39F2CA44344D7E3D2BEAB5523DFAE65056F1DA46EB2D73B201BA76
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/front-behavior-mapping.js?v=1.0.0
Preview:	/<![CDATA[/.(function() {. var sz = document.createElement('script'); sz.type = 'text/javascript'; sz.async = true;. sz.src = '//siteimproveanalytics.com/js/siteanalyze_6121927.js';. var s = document.getElementsByTagName('script')[0]; s.parentNode.insertBefore(sz, s);.})();./* */.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	103962
Entropy (8bit):	4.3760687887015335
Encrypted:	false
SSDEEP:	3072:Tq/5ShkAz1PJl9zQFGcQ8TlP3GVSB2nxEPA3v8W:TqcP
MD5:	621E86ED2500A715F6C4D7C69D46E881
SHA1:	66B4854F27A0160310688B32E7EC2F43410C7228
SHA-256:	F2549779A9614535AE7185B218CE738566575B12CF2BEA1CFDDB8630228FC352
SHA-512:	45A1536853982E84755564245CB62592C33078F6902B0AFD7F572C2A383DE1C0A3C0A5CD060E47EF72031093A420B5741A82AD1689AD552E3F196656ADAEA7D0
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="en" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\funeral-assistance[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	100567
Entropy (8bit):	4.329209663608517
Encrypted:	false
SSDEEP:	3072:Oq/siUQAz1qPJl9zQFGcQ8TlP3GVSB2nxv8p:Oqq/
MD5:	5F98242EB5186869549343FE4E517847
SHA1:	20372A1C631144C63843D1FD2E24027586055358
SHA-256:	84A4D8078A7D209C30C4A3F4BCFF18CE17EA0CCD9C5A217235867F9FD9D14CFA
SHA-512:	BBB06F304C443CABF0BB0CCD251C58338B8DE0006969B9DBB4DBB9A3D28A897D330C4814647963DAB760E94792C08070A275F3B9243AF817E2D1444FADF681D5
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="fr" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\funeral-assistance[3].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	100774
Entropy (8bit):	4.5892591526277275
Encrypted:	false
SSDEEP:	3072:Aq/bm8Az1aPJl9zQFGcQ8TlP3GVSB2nxv85:Aqm
MD5:	A11293665026087BDCB1F83FF232135C
SHA1:	DF3BB28FD489CE718E952A8B2738BB27391E987F
SHA-256:	619E9133453BB283C75FA82AA99A032ABEF917CBC3B0D14F349FC07424B5A558
SHA-512:	A848EAAF36FB67D05831F46159F18A18AA1095C5B869C00AB83622BAF12BAA37C578A812E6A5653BCCA64219C85E31CACCFEDF1FF5B8B83E900D96D3A27C9E3F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="ko" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\google_analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text
Category:	downloaded
Size (bytes):	6531
Entropy (8bit):	4.678001199127084
Encrypted:	false
SSDEEP:	192:+gRTMxaTr3TyMTMtm7qyC6nfuL+eWlqNWGj9SWTAHDjts6h:+WMRtvmm+DqhpdAHDps6
MD5:	D9ECAFD81481EE04021754CF6FB45771
SHA1:	8ABCB5FDA8F0A2D7B5C834013B5DC07282F163BD
SHA-256:	54A490BD2AFAA118630D481C75CE9A79C65849C665F1D77D252B674B8D4E993C
SHA-512:	82D0B791C50B7B876307A17D26CB24DE427EAAAFEAFA2DFB945A3582823728484A8B77AE57891DF6BB39D6D1CE4FDBEB57A921A2762415B483E0959707B68600
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/google_analytics/js/google_analytics.js?v=8.9.13
Preview:	/*. @file. * Attaches several event listener to a web page.. /..(function ($, Drupal, drupalSettings) {.. / eslint max-nested-callbacks: ["error", 4] */.. 'use strict';.. Drupal.google_analytics = {};.. $(document).ready(function () {.. // Attach mousedown, keyup, touchstart events to document only and catch. // clicks on all elements.. $(document.body).on('mousedown keyup touchstart', function (event) {.. // Catch the closest surrounding link of a clicked element.. $(event.target).closest('a,area').each(function () {.. // Is the clicked URL internal?. if (Drupal.google_analytics.isInternal(this.href)) {. // Skip 'click' tracking, if custom tracking events are bound.. if ($(this).is('.colorbox') && (drupalSettings.google_analytics.trackColorbox)) {. // Do nothing here. The custom event will handle all tracking.. // console.info('Click on .colorbox item has been detected.');. }. // Is dow

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	93970
Entropy (8bit):	5.55997587439234
Encrypted:	false
SSDEEP:	1536:7tKObOl/vu0s+HWz7NfhBhH/fvQrsqYOeVRP9UCb199DKPbeRkWNmDLO0kAHa24W:RKeuu027NNH/kQRGCBi7vV
MD5:	537B5C62E2E027E2C8B65FC56F776FE8
SHA1:	86071839DFD243A836B381BA220E84ACC9B05939
SHA-256:	73FF2F1E8F36263B5B23FB1BD454B0C3E2C246A0DD70DA4329E2CF894E2F2FB5
SHA-512:	E2E97EA79548E7738C7A168852089DB922C7B285AB040552A0D4953822A9E7CD20CA947D88D958CE27A6071B9B5FEC9772DDA2186A1CB3D741A61C7DD7E42304
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-PNFPGG3
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"7",. . "macros":[{. "function":"__v",. "vtp_name":"gtm.element",. "vtp_dataLayerVersion":1. },{. "function":"__jsm",. "vtp_javascript":["template","(function(){var a=",["escape",["macro",0],8,16],".pathname.split(\"\/\");a=a.pop();a=decodeURI(a);return-1\u003Ca.indexOf(\".\")?a:\"n\/a\"})();"]. },{. "function":"__v",. "vtp_name":"gtm.elementUrl",. "vtp_dataLayerVersion":1. },{. "function":"__e". },{. "function":"__v",. "vtp_name":"gtm.triggers",. "vtp_dataLayerVersion":2,. "vtp_setDefaultValue":true,. "vtp_defaultValue":"". },{. "function":"__gas",. "vtp_cookieDomain":"auto",. "vtp_doubleClick":false,. "vtp_setTrackerName":false,. "vtp_useDebugVersion":false,. "vtp_useHas

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\illustration_featured_disaster_search[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 601 x 441, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4635
Entropy (8bit):	7.1633196826829995
Encrypted:	false
SSDEEP:	96:uFmyscJqZ2094X7CL4+e//pw+bKMHcYNppAK:6dEZJ4X78ipJbKuRZ
MD5:	E08B4713D341235F18137A330AE55F96
SHA1:	6A1FFB6321BFC57BA8083E607F9994B3FBDD1EF5
SHA-256:	E5D0DCD4FC79F09383A2AFBE494FC20F9A77802E88FC14FCCF6AC3675C521536
SHA-512:	235F3B19BE6F909AE0B59EDBC8805F364BA3D7DF95DEF08AD45E1988A6D9FB16F7DF099053009A4C9B7E7D7B7B99B04ECC42948FA8CEDB58633E67894A367778
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-09/illustration_featured_disaster_search.png
Preview:	.PNG........IHDR...Y..........T!X....pHYs...........~.....IDATx..._...}...p.#G.D....B;+.u....j.4F..+..m.M.^..n.,.b..T{3o..n.....H.X....N(...zN....k........{.~_.y<...?.......{...>1~....W.-'.@..,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@......Y...".. @d....,....... ....D..@.........b........d.\|........'.?...0......D..@......Y...".. @d....,....... ....L\|g...>]V...e.Y......><...MN..?.iY~.....S..V~.}..........~...#K.;7.*..........5...F.U-.koY...ql.Q`U+>.`...<.i...._..F..`..Y\......OL....?;.k...D..@......Y...".. @d....,....... ....D..@..b..\..._..L~f.o.X...K.\.\|..Y......e].............p.e..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\illustration_featuredmini_covid_bp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1804
Entropy (8bit):	7.562420025234679
Encrypted:	false
SSDEEP:	48:ptf3koM2CnU2Q0ezpQXG6CKv1BOuF5cA5sVJBb:7PNM2CU2HezpIG6JmI5cIsVJBb
MD5:	6C0532EEDF4337DBDC10B566FD5B0C8A
SHA1:	D8FE0278431DAAE6849A68E0E247613D60505B46
SHA-256:	1B2FB5C06C5FC64B851A10A427849ECE60ECB42346EA174D442331770A6FB41A
SHA-512:	FCF039C189734FE54DFCB55DD564211AEF401A2A801126CBC6A624985540C5AB34F247C8865BBB155F20579B30B32979B11A4CF4F94586AC4FA07E61015E4366
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_bp.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx..._hVu....?.........p.vQ..M.M.]0....n...Z.(u.E....B/...J..N.....f..1...........9.s....!.>.s\|....s..9.....<..%..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)..)......p...I...#P.O.X2`....JzC......H..r...a..a..a.k@.D._p'.M.?..tlk..$...@...........d...j.$S0.+./.w)N.._..n$..(. f...Z%}!...G..\..T.d..4.\|.AR......W&F.0.b.\...]!.0... .....t..)w&U..3..4.~r...rTu"B...8yh.q.m..m....=.VO.lT3....\...R....$`+.......){[..........7.......#``Fo....z...Zw.._.So....k.}.GC...^.........u...n..........i...c_..'..6......C.\|...D...w.v...1.*..D.........'..'...7..;v..zOQ.'.../_...S.........[.7.\|.O,...oo........->.`z.sc.8.z\.)...r....]....N.........j.wL....\|...SH....@W.:{/....c.h.<=..rm.=........Oh..zOV.)..."}g[...i.....(...7.....p...:..e..S....c.....[....j..u.nW%.....NO,.\|iX.`px.Y\|.z.n.WI\|%n$t...[.m.......K..;/>.....f.)...h...&!.JG.r...l\|Fu...j.......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\illustration_featuredmini_covid_state[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2219
Entropy (8bit):	7.706481857909935
Encrypted:	false
SSDEEP:	48:Gq/MGc4OJ3AVrvRQ5yt1V//V//V//F7gI+Ew+7Peuc2/m7y:FM/J3GrvBFFFBgI+ETc2/7
MD5:	9C0A4009782DABD422C6DE86611AA0C3
SHA1:	8F51D260E0B3BC884EFBCC57A7D961F2633F4216
SHA-256:	E93D640035E105C426FD14D0F246F78AC849084D58A7E0413E27E3BB3C3C59E9
SHA-512:	910E07EA32BD8498F0F7AD182C916DA5F9D59150C524EF6DC8C2E502CD5781123ABA848E8DFFA0E097C4639F92F5A1F885BB0AD5ACA23E09C4E911619913E9AD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_state.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$....]IDATx...o.G...$!.......bZUT.....:\.[.RoQ...A..d.d..S..@.BB.....VA...4...i...8...s..w.......\|.{ggv......T....)6...I ....Q ....Q ....Q.q..c.'...(....zU.) `...Q.'..D/."..` ....@@ ....@@ ....@@ ....@@ ....@@ ....@@ ..a. ...I....VW6j.J.Z......X....L6?BD.h.q.....X.....w..\|.i...P.S....d.4.58nj.M....P.#P.....g_.#.M..@@ ....@@ ...}.z...1"J.9._...Bn.....5d..cJ.c]v,.j..L!7u).L......8.>Q.fg...fK^..{#....O@D...Ms.$4~.5.t.......P ..Bn..u`.H...W;c......rS%...3.7...\..#U._R...!Q5....Y....Iy.LL....H..3I...Q......Y.....~&...T.........K..$4..c..7.........d.<...Y..m.X[.......y....`..(.T.9.a...l............5....i.kA..T.~V6W.9c@.B......f.9../..V.m..Y%.j~....(......\|..hC...#_.%5.O..c...z.e.>.:..u....8.o.`..#~...}4.&....\|w..H?.~...O'.....w.......h%.:...G...kTY...V..&.k.....*.)Q..N...1}.\'..wl....X..W".......7#C......[.n;...k..m.0)k.A@.....Q ....Q ....Q ....Q.).B.I..V.7...&.#bt..ox.[y..@.J.v..q........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\instagram_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1682
Entropy (8bit):	4.248922283220847
Encrypted:	false
SSDEEP:	24:t41jue/MUiYWmvmXx8UPcKWPVy+Ul+UyiXXsZTU6e0MuluXaJUy1z2jRZkZlxC:Cj7xLmhVKyMUXU9d1s42
MD5:	C8987ECBAF2520A48B088B59152409E5
SHA1:	C3ED7D4ECF88EF0E72CC61D16B55D654F96AB512
SHA-256:	E0DA75A8173A47C23F2B28FA9F2E4EBEC60921BD62EDA278DEAE56BEF07B6433
SHA-512:	F4CF216AD34778C140B8C496181C337DBA2411E8AD9ED6CA39D9E78CD4A9C85510BDA132280BE818B2EB75AA07FC685723EF731E7937A8E9CF34CE132F3FBE77
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/instagram_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>instagram_white</title><g id="instagram"><path d="M25,4.5c6.675,0,7.466.025,10.1.146a13.833,13.833,0,0,1,4.642.861,7.746,7.746,0,0,1,2.875,1.87,7.746,7.746,0,0,1,1.87,2.875A13.833,13.833,0,0,1,45.35,14.9c.12,2.636.146,3.427.146,10.1s-.025,7.466-.146,10.1a13.833,13.833,0,0,1-.861,4.642,8.279,8.279,0,0,1-4.745,4.745,13.833,13.833,0,0,1-4.642.861c-2.636.12-3.426.146-10.1.146s-7.466-.025-10.1-.146a13.833,13.833,0,0,1-4.642-.861,7.746,7.746,0,0,1-2.875-1.87,7.746,7.746,0,0,1-1.87-2.875A13.833,13.833,0,0,1,4.65,35.1C4.53,32.464,4.5,31.674,4.5,25s.025-7.466.146-10.1a13.833,13.833,0,0,1,.861-4.642,7.746,7.746,0,0,1,1.87-2.875,7.746,7.746,0,0,1,2.875-1.87A13.833,13.833,0,0,1,14.9,4.649C17.534,4.528,18.325,4.5,25,4.5M25,0c-6.79,0-7.641.029-10.307.15A18.35,18.35,0,0,0,8.624,1.311,12.255,12.255,0,0,0,4.2,4.194,12.255,12.255,0,0,0,1.312,8.622,18.35,18.35,0,0,0,.15,14.691C.029,17.357,0,18.209,0,25s.029,7.641.15,10.307a18.35,18.35,0,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89476
Entropy (8bit):	5.2896589255084425
Encrypted:	false
SSDEEP:	1536:AjExXUqrnxDjoXEZxkMV4SYSt0zvDD6ip3h8cApwEjOPrBeU6QLiTFbc0QlQvakF:AYh8eip3huuf6IidlrvakdtQ47GK1
MD5:	DC5E7F18C8D36AC1D3D4753A87C98D0A
SHA1:	C8E1C8B386DC5B7A9184C763C88D19A346EB3342
SHA-256:	F7F6A5894F1D19DDAD6FA392B2ECE2C5E578CBF7DA4EA805B6885EB6985B6E3D
SHA-512:	6CB4F4426F559C06190DF97229C05A436820D21498350AC9F118A5625758435171418A022ED523BAE46E668F9F8EA871FEAB6AFF58AD2740B67A30F196D65516
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/assets/vendor/jquery/jquery.min.js?v=3.5.1
Preview:	/! jQuery v3.5.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(C,e){"use strict";var t=[],r=Object.getPrototypeOf,s=t.slice,g=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},u=t.push,i=t.indexOf,n={},o=n.toString,v=n.hasOwnProperty,a=v.toString,l=a.call(Object),y={},m=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType},x=function(e){return null!=e&&e===e.window},E=C.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function b(e,t,n){var r,i,o=(n=n\|\|E).createElement("script");if(o.text=e,t)for(r in c)(i=t[r]\|\|t.getAttribute&&t.getAttribute(r))&&o.setAttribute(r,i);n.head.appendChild(o).parentNode.removeChild(o)}function w(e){return null==e?e+"":"o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\vi_yYsqGQPcltu2Ce9OPn0-o0qdrJfSLf9FKBYMdqGU0nA[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6433
Entropy (8bit):	4.846174924203795
Encrypted:	false
SSDEEP:	96:N7L7JMOD+Y8O/458Y7Qj6A4yJ7LderBmgaUgOsDJG6G6YixaY+wex2A:N7L7iY/4qj64J7LdegUgTGOxatvB
MD5:	51F95F224B7E8C6291ABFCACE62A8FB4
SHA1:	EA3F961FD57CD1A76B94ED1A922DCBF99432CBD1
SHA-256:	C98B2A1903DC96DBB609EF4E3E7D3EA34A9DAC97D22DFF4528160C76A194D270
SHA-512:	7AD8A8583050D3AB11055BF912DBBE1867E0AD4449B90CF36519D65E268489576DC5431B1FE101528A36B4C834B60D0E8EC9C117A19DB71E44D75D8266B29B41
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/vi_yYsqGQPcltu2Ce9OPn0-o0qdrJfSLf9FKBYMdqGU0nA.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Hide":"\u1ea8n","Changed":"\u0110\u00e3 thay \u0111\u1ed5i","Collapse":"Thu g\u1ecdn","closed":"\u0111\u00e3 k\u1ebft th\u00fac","Home":"Nh\u00e0","Image":"\u1ea2nh","Link":"Li\u00ean k\u1ebft","Unlink":"B\u1ecf li\u00ean k\u1ebft","(active tab)":"(tab ho\u1ea1t \u0111\u1ed9ng)","Next":"Ti\u1ebfp","May":"Th\u00e1ng 5","Sunday":"Ch\u1ee7 nh\u1eadt","Monday":"Th\u1ee9 hai","Tuesday":"Th\u1ee9 ba","Wednesday":"Th\u1ee9 t\u01b0","Thursday":"Th\u1ee9 n\u0103m","Friday":"Th\u1ee9 s\u00e1u","Saturday":"Th\u1ee9 b\u1ea3y","Alias: @alias":"\u0110\u01b0\u1eddng d\u1eabn \u1ea3o: @alias","No alias":"Ch\u01b0a c\u00f3 \u0111\u01b0\u1eddng d\u1eabn \u1ea3o","Cancel":"H\u1ee7y b\u1ecf","Title":"Ti\u00eau \u0111\u1ec1","Status":"Tr\u1ea1ng th\u00e1i","Submit":"G\u1eedi \u0111i","Group":"Nh\u00f3m","Author":"T\u00e1c gi\u1ea3","List":"Danh s\u00e1ch","Remove":"Xo\u00e1","Description":"M\u00f4 t\u1ea3","Disabled":"T\u1eaft","Enabled":"B\u1eadt","More":"Th\u0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\zh-hans_r1SUzkYIDSP6Tj3vzNsZOo0Zw93Z4ICVZz41-7OY2-o[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6619
Entropy (8bit):	4.871212690512379
Encrypted:	false
SSDEEP:	192:N7zOOxrCS3oCGjDyqA9P42YjZJprl8pD+0:QOQCyUW7o
MD5:	338ABDCF083F56379B69E99A826AE9AC
SHA1:	3EE1DF1E7AAC4269B7BFB3AE282C720287719853
SHA-256:	AF5494CE46080D23FA4E3DEFCCDB193A8D19C3DDD9E08095673E35FBB398DBEA
SHA-512:	17B31DC80D8C784E91521DA16D4E43B6E37FD8EE9D66DA46E85AB2C91C9567DFFE209BA0E02F4707F44C3304073764276043395ED1739262A4BE7D94A76992CB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/zh-hans_r1SUzkYIDSP6Tj3vzNsZOo0Zw93Z4ICVZz41-7OY2-o.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Hide":"\u9690\u85cf","Changed":"\u5df2\u66f4\u6539","Collapse":"\u6298\u53e0","@label":"@label","closed":"\u5173\u95ed","Home":"\u9996\u9875","Image":"\u56fe\u50cf","Link":"\u94fe\u63a5","Unlink":"\u53d6\u6d88\u94fe\u63a5","(active tab)":"\uff08\u6d3b\u52a8\u6807\u7b7e\uff09","Next":"\u4e0b\u4e00\u4e2a","May":"5\u6708","Sunday":"\u661f\u671f\u65e5","Monday":"\u661f\u671f\u4e00","Tuesday":"\u661f\u671f\u4e8c","Wednesday":"\u661f\u671f\u4e09","Thursday":"\u661f\u671f\u56db","Friday":"\u661f\u671f\u4e94","Saturday":"\u661f\u671f\u516d","Alias: @alias":"\u522b\u540d\uff1a@alias","No alias":"\u65e0\u522b\u540d","Cancel":"\u53d6\u6d88","Title":"\u6807\u9898","Status":"\u72b6\u6001","Submit":"\u63d0\u4ea4","Group":"\u7ec4","Author":"\u4f5c\u8005","List":"\u5217\u8868","Remove":"\u79fb\u9664","Description":"\u63cf\u8ff0","Disabled":"\u7981\u7528","Enabled":"\u542f\u7528","More":"\u66f4\u591a","Taxonomy":"\u5206\u7c7b","Download":"\u4e0b\u8f7d","File

C:\Users\user\AppData\Local\Temp\~DF47C29199E21B074B.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.3019838021791065
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laA:kBqoxxJhHWSVSEab
MD5:	A9B9FC9FF7D49736A525ECF63AAC6463
SHA1:	0FC49DBC1FF4B388B1208330FD66B5BD85B17FA1
SHA-256:	6DCE0D5FC477EEFD5AD5790F062AF6D2FC192CF8DF2AD00EEE769F2FF71A926C
SHA-512:	992EF531E3C0FABF0479AB5830C98596A69B743A76B983CE22E5F259E32676199327D0D6E99170ADE3A8E4F550003998978D5EB7CD492D1E215681E79D7A8A63
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DF8C0B9062984F8D35.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	149627
Entropy (8bit):	1.5103852078006899
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+XZbS5m4u9n7cBBhCDgVNuM1WUIFt62WGM8lWGM+3y8aXxklEEpLa0:0IFM9
MD5:	12177093AB0A791626C66950A0814DB8
SHA1:	768A15BE43AC0C76864FA87E32871011E419B69D
SHA-256:	1B085ED46B9F1D47F335B3992BF3C9E4406D0C90C81B35881CE19FD2C167EFED
SHA-512:	893BDE5F575A83D425E2EB2C9CBDB11511C55B5BE818376496A9E2DE0B422E41E3E11CB3E7D9F48BFB71951C0C34ED09136BB043099B69B365793A0BD155256E
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFEF6F7E374662853A.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.4789954045565633
Encrypted:	false
SSDEEP:	12:c9lCg5/9lCgeK9l26an9l26an9l8fROF9l8fRy9lTqInHF/:c9lLh9lLh9lIn9lIn9loC9loy9lWs
MD5:	6BCD9770ABFDF848967312E0279146A3
SHA1:	3E32D11D6FDB4EF7020BFF31298037500E6A4E9C
SHA-256:	37F3A75115864957D98368A54B0994D9BADFDEBFE715ACBA6CCA4DBFFB79F84E
SHA-512:	0F0664EE173815C86176EE3B9A289C0613A79D88FB8366F195558F82C5918A78159A370526BFDB2A8154851CB1E2EFF9DF93487A7EC695F370F6929A4A133C96
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\RWSMTU05G13N9QV5MXK7.temp Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	5149
Entropy (8bit):	3.1758842421303357
Encrypted:	false
SSDEEP:	48:aadiGPuIiC9GrIoaAsASFPkdiGPuIih683GrIoaAczPfdiGPuIix9GrIoaAV1H:aEPuQ9S6AJs+Pu53S6AoHPuX9S6Af
MD5:	EB6824BB84B3876CAB5D646358F8ACBC
SHA1:	2C7A9487571CF1ABE2904E22FDFC95EC62B67C50
SHA-256:	B73084C4FB42A7AE98F80737F379A8A77300F6DF1AD9D828A54A93EB45FF578F
SHA-512:	1356177726D06241577411604C011FD0F0E655D8154E0FA26822FE0E090E88F4362C7EAAA16286C37A59D140C139C49BA8B1CE18DC64BDA5BE1C7BCFA7CF8C90
Malicious:	false
Reputation:	low
Preview:	...................................FL..................F.@.. .....@.>......3.2....?.c................................P.O. .:i.....+00.../C:\.....................1.....>Q.;..PROGRA~1..t......L.>Qr<....E...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....l.1......L.J..INTERN~1..T......L..R5V..............................i.n.t.e.r.n.e.t. .e.x.p.l.o.r.e.r.....f.2......L.9 .iexplore.exe..J......L.J.R5V.....R..........x.............i.e.x.p.l.o.r.e...e.x.e.......^...............-.......]...................C:\Program Files\internet explorer\iexplore.exe....-.p.r.i.v.a.t.e...C.:.\.W.i.n.d.o.w.s.\.S.Y.S.T.E.M.3.2.\.I.E.F.R.A.M.E...d.l.l.........%SystemRoot%\SYSTEM32\IEFRAME.dll...................................................................................................................................................................................................................................%.S.y.s.t.e.m.R.o.o.t.%.\.S.Y.S.T.E.M.3.2.\.I

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2021 12:49:41.650415897 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.651741028 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.690875053 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.691005945 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.691610098 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.692114115 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.692208052 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.692823887 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.731895924 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732342005 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732381105 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732419014 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732429028 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.732481956 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.732495070 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733278990 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733419895 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733469009 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733489037 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733510971 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733534098 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733568907 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.734718084 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.734806061 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.735344887 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.735420942 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.745980024 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.746469975 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.746598005 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.747000933 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.751652002 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787264109 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787292004 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787327051 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787364960 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787571907 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787669897 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787682056 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787697077 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787723064 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787740946 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787763119 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787787914 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788614988 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788656950 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788686991 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788693905 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788702965 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788743973 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788748026 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788798094 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.789680004 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.789738894 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.791984081 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.792025089 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.792069912 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.817814112 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.823649883 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.858396053 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.865735054 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:43.819807053 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.820777893 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.873740911 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.873900890 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.874368906 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.874543905 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.875543118 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.876821041 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.927963972 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928335905 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928354979 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928369999 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928411961 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.928457022 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.928930998 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929337978 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929358959 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929373980 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929425955 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.929460049 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.940525055 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.941431999 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942027092 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942250013 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942437887 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993364096 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993408918 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993479013 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993516922 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993825912 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993896961 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993916035 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993993998 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994436026 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994467974 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.994505882 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.994609118 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994648933 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995309114 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.995407104 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.995428085 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.995429039 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995440960 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.995460033 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995496988 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995522022 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995801926 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.996196985 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:44.047482967 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.047812939 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.050185919 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:44.055166006 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:44.199143887 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.199187994 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.199271917 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.199342966 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.210380077 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.210820913 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.361592054 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.362337112 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.362364054 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.362380028 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.362436056 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.362521887 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.363168955 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.363193989 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.363219023 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.363261938 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.363302946 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.374249935 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.374363899 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.374602079 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.525643110 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.525778055 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526149035 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526190996 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526222944 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.526227951 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526267052 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.526459932 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526480913 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.526527882 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.526571035 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:44.527311087 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:44.527394056 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:54.101985931 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:54.102722883 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:49:54.253565073 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:54.254147053 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:54.254858971 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:49:54.254983902 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.430115938 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.430170059 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.430588961 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.581510067 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:05.581552029 CEST	443	49755	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:05.581666946 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.581721067 CEST	49755	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:05.582144976 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:05.583022118 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:05.583134890 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:06.067135096 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:06.218779087 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:06.219436884 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:06.219569921 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:10.051953077 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:10.203599930 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:10.204953909 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:10.205029964 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:12.199352026 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:12.351073980 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:12.351773977 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:12.351871014 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:17.855688095 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:18.009007931 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:18.009614944 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:18.009706974 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:18.730402946 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:18.883645058 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:18.884356976 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:18.884430885 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:19.414863110 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:19.568460941 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:19.569380045 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:19.569622993 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:20.183954000 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:20.335935116 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:20.337049007 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:20.337146044 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:23.385648012 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:23.537302971 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:23.538119078 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:23.538341999 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:25.557400942 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:25.708945036 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:25.709940910 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:25.710021973 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:28.253894091 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:28.405484915 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:28.406162977 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:28.406258106 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:29.069724083 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:29.226051092 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:29.226089001 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:29.226964951 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:34.033436060 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:34.184987068 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:34.186738968 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:34.186978102 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:36.400702953 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:36.552942038 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:36.552973986 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:36.553087950 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:38.145291090 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:38.296777010 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:38.297705889 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:38.297790051 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:39.660938978 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:39.813113928 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:39.813812971 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:39.813901901 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:42.246723890 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:42.398252964 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:42.398929119 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:42.399970055 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:42.995826960 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.026194096 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:50:43.082256079 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:50:43.082297087 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:50:43.082317114 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:50:43.082371950 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:50:43.082407951 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:50:43.082734108 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:50:43.087263107 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.139751911 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:50:43.152236938 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.152306080 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.152801991 CEST	443	49756	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.152852058 CEST	49756	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.199278116 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.200004101 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.348089933 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.348253965 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.349664927 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.356405973 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.356534958 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.358304024 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.497726917 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.499078989 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.499130964 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.499155998 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.499248028 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.499285936 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.505067110 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.505584002 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.515441895 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.516307116 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.516354084 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.516370058 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.516458988 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.516504049 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.521244049 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.653276920 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.653672934 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.653986931 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.654011011 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.654072046 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.654098988 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.655723095 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.655822039 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.678392887 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.678977013 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.679002047 CEST	443	49779	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:43.679066896 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:43.679102898 CEST	49779	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:44.117193937 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:44.267429113 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:44.268721104 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:44.268910885 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:44.845211983 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:44.993776083 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:44.993798018 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:44.993959904 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:45.973561049 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:46.121515036 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:46.122376919 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:46.122567892 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:55.955377102 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:55.955481052 CEST	49780	443	192.168.2.4	162.247.242.19
Apr 16, 2021 12:50:56.104779959 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:56.104856968 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:56.105556965 CEST	443	49780	162.247.242.19	192.168.2.4
Apr 16, 2021 12:50:56.105654001 CEST	49780	443	192.168.2.4	162.247.242.19

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2021 12:49:31.836177111 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:32.116338968 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:32.165350914 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:33.109535933 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:33.162635088 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:34.147094965 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:34.198741913 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:35.264157057 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:35.313461065 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:37.013514996 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:37.062258959 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:39.740586042 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:39.805598974 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:40.821105957 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:40.881500959 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.452179909 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.521622896 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.583909035 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.643265009 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.673877954 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.723695040 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.940026999 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.960547924 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:42.000262976 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:42.017704964 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.701103926 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:43.725138903 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:43.749593973 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.795666933 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.995332003 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.015399933 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.023281097 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.045562029 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:44.072519064 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:44.091254950 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:58.924324036 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:58.984334946 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:02.706779003 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:02.756808996 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:03.930140018 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:03.987736940 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:09.811964035 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:09.852564096 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:09.861752987 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:09.914652109 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:10.713376045 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:10.773519993 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:10.821856022 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:10.870717049 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:11.725521088 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:11.779591084 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:11.826534033 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:11.875241995 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:12.783030033 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:12.834628105 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:13.856408119 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:13.905253887 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:14.946597099 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:15.000122070 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:16.685909033 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:16.739510059 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:17.861408949 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:17.911900997 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:18.008429050 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:18.057079077 CEST	53	56448	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:18.943389893 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:18.994993925 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:19.225620985 CEST	59172	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:19.274573088 CEST	53	59172	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:20.483397007 CEST	62420	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:20.532124996 CEST	53	62420	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:21.586327076 CEST	60579	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:21.634908915 CEST	53	60579	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:22.603677988 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:22.667221069 CEST	53	50183	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:25.915914059 CEST	61531	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:25.966175079 CEST	53	61531	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:27.592505932 CEST	49228	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:27.642458916 CEST	53	49228	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:29.001718998 CEST	59794	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:29.050465107 CEST	53	59794	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:31.470613956 CEST	55916	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:31.519362926 CEST	53	55916	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:40.894579887 CEST	52752	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:40.944999933 CEST	53	52752	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:41.822966099 CEST	60542	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:41.875538111 CEST	53	60542	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:44.372824907 CEST	60689	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:44.424273014 CEST	53	60689	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:49.274296045 CEST	64206	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:49.337711096 CEST	53	64206	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:52.448410988 CEST	50904	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:52.507056952 CEST	53	50904	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:52.958602905 CEST	57525	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:53.009433985 CEST	53	57525	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:53.821203947 CEST	53814	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:53.882581949 CEST	53	53814	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:55.863524914 CEST	53418	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:55.912224054 CEST	53	53418	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:56.499140978 CEST	62833	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:56.549696922 CEST	53	62833	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:57.610954046 CEST	59260	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:57.673594952 CEST	53	59260	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:00.168108940 CEST	49944	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:00.217422009 CEST	53	49944	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:00.838685036 CEST	63300	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:00.896094084 CEST	53	63300	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:02.149461985 CEST	61449	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:02.210201979 CEST	53	61449	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 16, 2021 12:49:40.821105957 CEST	192.168.2.4	8.8.8.8	0xd4bb	Standard query (0)	www.fema.gov	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.583909035 CEST	192.168.2.4	8.8.8.8	0x5b3f	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.701103926 CEST	192.168.2.4	8.8.8.8	0xbf34	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.725138903 CEST	192.168.2.4	8.8.8.8	0x2376	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.995332003 CEST	192.168.2.4	8.8.8.8	0xb07c	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.023281097 CEST	192.168.2.4	8.8.8.8	0x9866	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:58.924324036 CEST	192.168.2.4	8.8.8.8	0xea3b	Standard query (0)	www.fema.gov	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 16, 2021 12:49:40.881500959 CEST	8.8.8.8	192.168.2.4	0xd4bb	No error (0)	www.fema.gov	www.fema.gov.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.62	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.113	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.16	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.127	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.749593973 CEST	8.8.8.8	192.168.2.4	0xbf34	No error (0)	js-agent.newrelic.com	f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.154	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.155	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.157	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.156	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.19	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.21	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.20	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.18	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.091254950 CEST	8.8.8.8	192.168.2.4	0x9866	No error (0)	www.google.de		172.217.19.99	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:58.984334946 CEST	8.8.8.8	192.168.2.4	0xea3b	No error (0)	www.fema.gov	www.fema.gov.edgekey.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 16, 2021 12:49:41.734718084 CEST	13.32.25.62	443	192.168.2.4	49741	CN=dap.digitalgov.gov CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Oct 02 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Nov 03 01:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Apr 16, 2021 12:49:41.735344887 CEST	13.32.25.62	443	192.168.2.4	49742	CN=dap.digitalgov.gov CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Oct 02 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Nov 03 01:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Apr 16, 2021 12:49:43.928354979 CEST	74.125.140.154	443	192.168.2.4	49754	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 23 09:18:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 15 10:18:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.928354979 CEST	74.125.140.154	443	192.168.2.4	49754	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.929358959 CEST	74.125.140.154	443	192.168.2.4	49753	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 23 09:18:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 15 10:18:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.929358959 CEST	74.125.140.154	443	192.168.2.4	49753	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.362380028 CEST	162.247.242.19	443	192.168.2.4	49755	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.362380028 CEST	162.247.242.19	443	192.168.2.4	49755	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.363219023 CEST	162.247.242.19	443	192.168.2.4	49756	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.363219023 CEST	162.247.242.19	443	192.168.2.4	49756	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.499155998 CEST	162.247.242.19	443	192.168.2.4	49780	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.499155998 CEST	162.247.242.19	443	192.168.2.4	49780	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.516370058 CEST	162.247.242.19	443	192.168.2.4	49779	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.516370058 CEST	162.247.242.19	443	192.168.2.4	49779	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5964 Parent PID: 800

General

Start time:	12:49:39
Start date:	16/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff698750000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 2896 Parent PID: 5964

General

Start time:	12:49:40
Start date:	16/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2
Imagebase:	0x1180000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5964 Parent PID: 800

General

Chronological Activities

Analysis Process: iexplore.exe PID: 2896 Parent PID: 5964

General

Chronological Activities

Disassembly