Play interactive tour

Edit tour

Analysis Report http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance

Overview

General Information

Sample URL:	http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Analysis ID:	389168
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

No high impact signatures.

Classification

Startup

System is w10x64

iexplore.exe (PID: 5964 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 2896 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49779 version: TLS 1.2

Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.facebook.com/FEMA/?ref=bookmarks"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/facebook_white.svg" alt="Facebook Logo" /></a> equals www.facebook.com (Facebook)
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.linkedin.com/company/fema/"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/linkedin_white.svg" alt="LinkedIn Logo" /></a> equals www.linkedin.com (Linkedin)
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: <a target="_blank" href="https://www.youtube.com/fema"><img src="/profiles/femad8_gov/themes/fema_uswds/images/social-icons/youtube_white.svg" alt="YouTube Logo" /></a> equals www.youtube.com (Youtube)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml0.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig> equals www.facebook.com (Facebook)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml5.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig> equals www.twitter.com (Twitter)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: msapplication.xml7.1.dr	String found in binary or memory: <browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b9898aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig> equals www.youtube.com (Youtube)
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: <p><a href="https://www.youtube.com/watch?v=DgvN_9m58Z0">VIDEO: Providing Financial Assistance for COVID-19-Related Funeral Expenses</a></p> equals www.youtube.com (Youtube)
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: <p><a href="https://www.youtube.com/watch?v=NGaWq_Hg87I">Proporcionando asistencia econ equals www.youtube.com (Youtube)
Source: Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: if(oCONFIG.YOUTUBE){var videoArray_fed=[],playerArray_fed=[],_f33=!1,_f66=!1,_f90=!1,tag=document.createElement("script");tag.src="https://www.youtube.com/iframe_api";var firstScriptTag=document.getElementsByTagName("script")[0];firstScriptTag.parentNode.insertBefore(tag,firstScriptTag);var youtube_parser_fed=function(a){if((a=a.match(/^(https?:)?(\/\/)?(www\.)?(youtu\.be\/\|youtube(\-nocookie)?\.([A-Za-z]{2,4}\|[A-Za-z]{2,3}\.[A-Za-z]{2})\/)(watch\|embed\/\|vi?\/)?(\?vi?=)?([^#&\?\/]{11}).*$/))&&11=== equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: www.fema.gov

Source: json3.min[1].js.2.dr	String found in binary or memory: http://bestiejs.github.io/json3
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/license
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/license/mit
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://datatables.net/tn/
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://github.com/robloach/jquery-once
Source: stacktable[1].js.2.dr	String found in binary or memory: http://johnpolacek.github.com/stacktable.js
Source: effect-min[1].js.2.dr	String found in binary or memory: http://jqueryui.com
Source: json3.min[1].js.2.dr	String found in binary or memory: http://kit.mit-license.org
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: jquery.once.min[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: wcm_survey[1].js.2.dr	String found in binary or memory: http://stackoverflow.com/questions/2308134/trim-in-javascript-not-working-in-ie
Source: query_string.min[1].js.2.dr	String found in binary or memory: http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters
Source: msapplication.xml.1.dr	String found in binary or memory: http://www.amazon.com/
Source: datatables.min[1].js.2.dr	String found in binary or memory: http://www.datatables.net
Source: msapplication.xml1.1.dr	String found in binary or memory: http://www.google.com/
Source: jquery.colorbox-min[1].js.2.dr	String found in binary or memory: http://www.jacklmoore.com/colorbox
Source: msapplication.xml2.1.dr	String found in binary or memory: http://www.live.com/
Source: msapplication.xml3.1.dr	String found in binary or memory: http://www.nytimes.com/
Source: msapplication.xml4.1.dr	String found in binary or memory: http://www.reddit.com/
Source: msapplication.xml5.1.dr	String found in binary or memory: http://www.twitter.com/
Source: msapplication.xml6.1.dr	String found in binary or memory: http://www.wikipedia.com/
Source: msapplication.xml7.1.dr	String found in binary or memory: http://www.youtube.com/
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://dap.digitalgov.gov/Universal-Federated-Analytics-Min.js?agency=DHS&subagency=FEMA&pu
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/download
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/download/#dt/dt-1.10.20/af-2.3.4/sp-1.0.1
Source: datatables.min[1].js.2.dr	String found in binary or memory: https://datatables.net/tn/11
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://dhs.gov
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://edit.fema.gov/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://edit.fema.gov/sites/default/files/documents/fema_policy_covid-19_funeral_assistance-updated.
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://edit.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance
Source: css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg[1].css.2.dr, css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Poppins:300
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlEw.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfedA.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff)
Source: jquery.cookie[1].js.2.dr	String found in binary or memory: https://github.com/carhartl/jquery-cookie
Source: chosen.jquery.min[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/blob/master/LICENSE.md
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515#issuecomment-104602031
Source: chosen[1].js.2.dr	String found in binary or memory: https://github.com/harvesthq/chosen/issues/515#issuecomment-33214050
Source: stacktable[1].js.2.dr	String found in binary or memory: https://github.com/johnpolacek/stacktable.js/
Source: google_analytics[1].js.2.dr	String found in binary or memory: https://mydomain.com/node/1
Source: gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: fema_search[1].js.2.dr	String found in binary or memory: https://search.usa.gov/search
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: analytics[1].js.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://twitter.com/fema
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://usa.gov
Source: SQ22SSVH.htm.2.dr, coronavirus[1].htm.2.dr	String found in binary or memory: https://www.cdc.gov/coronavirus/2019-ncov/index.html
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.disasterassistance.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.drupal.org)
Source: drupalSettingsLoader[1].js.2.dr	String found in binary or memory: https://www.drupal.org/node/2815083
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.Root
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/about/newsletters
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ar/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/bn/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/d
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responses
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesJCurrent
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesad8_gov/themes/fema_uswds/images/favicon.ico
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disaster-responsesvirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/corRoot
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus
Source: funeral-assistance[1].htm.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance(
Source: funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, funeral-assistance[1].htm.2.dr, funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq#scams
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceLCOVID-19
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceRoot
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeancece
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusTCoronavirus
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusemad8_gov/themes/fema_uswds/images/favicon.ico
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/disasters/coronavirusv
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/e
Source: disaster-responses[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/es/disaster-responses
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq#scams
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistanceance#main-content
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistanceance#main-contents://www.fema.gov/di
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/es/disasters/coronavirus/funeral-assistancenAsistencia
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.fema.gov/es/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/f
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/fRoot
Source: funeral-assistance[2].htm0.2.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistanceTCOVID-19
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistanceance
Source: funeral-assistance[2].htm0.2.dr	String found in binary or memory: https://www.fema.gov/fr/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/h
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/hi/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistanceFAsistans
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ht/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/k
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COV
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COVID-19
Source: funeral-assistance[3].htm.2.dr	String found in binary or memory: https://www.fema.gov/ko/node/613038
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/481051
Source: disaster-responses[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/575622
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/node/613038
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/o/disasters/coronavirus/economic/funeral-assistance
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico~
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/pt-br/disasters/coronavirus/economic/funeral-assistance
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/ru/disasters/coronavirus/economic/funeral-assistance
Source: coronavirus[1].htm.2.dr	String found in binary or memory: https://www.fema.gov/sites/default/files/2020-07/illustration_hero_disasters_corona_2.png
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/sites/default/files/email_white.svg
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/v
Source: funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceDH
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceance
Source: funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.fema.gov/vi/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/z
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/eRoot
Source: funeral-assistance[1].htm1.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance0COVID-19
Source: ~DF8C0B9062984F8D35.TMP.1.dr	String found in binary or memory: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistanceent
Source: funeral-assistance[1].htm1.2.dr	String found in binary or memory: https://www.fema.gov/zh-hans/node/613038
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.h-hans/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isaster-responsesRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.isasters/coronavirusRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.s/disasters/coronavirus/funeral-assistanceance#main-contentRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot
Source: {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.fema.ttps://www.fema.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.floodsmart.gov/
Source: funeral-assistance[1].htm2.2.dr, Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-PNFPGG3
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.instagram.com/fema
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.linkedin.com/company/fema/
Source: funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, disaster-responses[1].htm.2.dr, funeral-assistance[2].htm.2.dr	String found in binary or memory: https://www.oig.dhs.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/cert
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.ready.gov/preparedness-research
Source: funeral-assistance[1].htm2.2.dr	String found in binary or memory: https://www.youtube.com/fema
Source: Universal-Federated-Analytics-Min[1].js.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: funeral-assistance[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=DgvN_9m58Z0
Source: funeral-assistance[1].htm0.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=NGaWq_Hg87I

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756

Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.32.25.62:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49780 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.19:443 -> 192.168.2.4:49779 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/159@7/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7139B2BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFEF6F7E374662853A.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	0%	Virustotal		Browse
http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label	Link
https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot	0%	Avira URL Cloud	safe
https://www.floodsmart.gov/	0%	Virustotal		Browse
https://www.floodsmart.gov/	0%	Avira URL Cloud	safe
https://www.fema.	0%	Avira URL Cloud	safe
https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot	0%	Avira URL Cloud	safe
https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.drupal.org)	0%	Avira URL Cloud	safe
https://www.fema.Root	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.fema.isasters/coronavirusRoot	0%	Avira URL Cloud	safe
https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot	0%	Avira URL Cloud	safe
https://www.fema.ttps://www.fema.gov/	0%	Avira URL Cloud	safe
https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.de	172.217.19.99	true	false	high
stats.l.doubleclick.net	74.125.140.154	true	false	high
d27f3qgc9anoq2.cloudfront.net	13.32.25.62	true	false	high
bam.nr-data.net	162.247.242.19	true	false	unknown
dap.digitalgov.gov	unknown	unknown	false	high
www.fema.gov	unknown	unknown	false	high
js-agent.newrelic.com	unknown	unknown	false	high
stats.g.doubleclick.net	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Reputation
https://www.fema.gov/disasters/coronavirus	false	high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content	false	high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/es/disasters/coronavirus/funeral-assistance	false	high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance	false	high
https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://github.com/harvesthq/chosen/issues/515	chosen[1].js.2.dr	false		high
https://www.fema.gov/disaster-responsesJCurrent	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/o/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.drupal.org/node/2815083	drupalSettingsLoader[1].js.2.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq#scams	funeral-assistance[1].htm0.2.dr	false		high
https://github.com/carhartl/jquery-cookie	jquery.cookie[1].js.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance0COVID-19	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.isasters/coronavirus/economic/funeral-assistanceeanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.floodsmart.gov/	funeral-assistance[1].htm2.2.dr	false	0%, Virustotal, Browse Avira URL Cloud: safe	unknown
https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico~	imagestore.dat.2.dr	false		high
http://johnpolacek.github.com/stacktable.js	stacktable[1].js.2.dr	false		high
https://www.fema.gov/vi/node/613038	funeral-assistance[2].htm.2.dr	false		high
https://edit.fema.gov/sites/default/files/documents/fema_policy_covid-19_funeral_assistance-updated.	funeral-assistance[1].htm1.2.dr	false		high
http://jqueryui.com	effect-min[1].js.2.dr	false		high
https://usa.gov	funeral-assistance[1].htm2.2.dr	false		high
https://www.youtube.com/watch?v=DgvN_9m58Z0	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.gov/es/node/613038	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/zh-hans/node/613038	funeral-assistance[1].htm1.2.dr	false		high
https://www.fema.	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.i/disasters/coronavirus/economic/funeral-assistanceanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.o/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.youtube.com/iframe_api	Universal-Federated-Analytics-Min[1].js.2.dr	false		high
https://search.usa.gov/search	fema_search[1].js.2.dr	false		high
https://www.fema.gov/disasters/coronavirusemad8_gov/themes/fema_uswds/images/favicon.ico	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/es/disasters/coronavirus	coronavirus[1].htm.2.dr	false		high
https://edit.fema.gov/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/disasters/corRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.oig.dhs.gov/	funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, disaster-responses[1].htm.2.dr, funeral-assistance[2].htm.2.dr	false		high
https://dhs.gov	funeral-assistance[1].htm2.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
http://www.datatables.net	datatables.min[1].js.2.dr	false		high
https://datatables.net/download	datatables.min[1].js.2.dr	false		high
https://www.drupal.org)	funeral-assistance[1].htm2.2.dr	false	Avira URL Cloud: safe	low
http://www.reddit.com/	msapplication.xml4.1.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/funeral-assistance	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm1.2.dr, {7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq	funeral-assistance[1].htm2.2.dr, funeral-assistance[3].htm.2.dr, funeral-assistance[1].htm.2.dr, funeral-assistance[1].htm1.2.dr	false		high
https://www.fema.gov/node/575622	disaster-responses[1].htm.2.dr	false		high
https://www.fema.Root	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.instagram.com/fema	funeral-assistance[1].htm2.2.dr	false		high
https://datatables.net/tn/11	datatables.min[1].js.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistanceent	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/d	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/fRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/e	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/pt-br/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/es/disasters/coronavirus/economic/funeral-assistance/faq	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/h	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/f	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirusTCoronavirus	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.youtube.com/watch?v=NGaWq_Hg87I	funeral-assistance[1].htm0.2.dr	false		high
https://www.fema.gov/k	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistanceeance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/about/newsletters	funeral-assistance[1].htm2.2.dr	false		high
http://opensource.org/licenses/GPL-2.0	jquery.once.min[1].js.2.dr	false		high
https://cct.google/taggy/agent.js	gtm[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.fema.isasters/coronavirusRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance/faq#scams	funeral-assistance[1].htm.2.dr	false		high
https://www.fema.r/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/ko/node/613038	funeral-assistance[3].htm.2.dr	false		high
https://www.fema.gov/v	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance2COVID-19	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/z	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://stackoverflow.com/questions/2308134/trim-in-javascript-not-working-in-ie	wcm_survey[1].js.2.dr	false		high
http://www.youtube.com/	msapplication.xml7.1.dr	false		high
https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistanceFAsistans	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.t/disasters/coronavirus/economic/funeral-assistanceRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.disasterassistance.gov/	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/tl/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
http://w3.org/TR/2012/WD-url-20120524/#collect-url-parameters	query_string.min[1].js.2.dr	false		high
https://github.com/harvesthq/chosen/issues/515#issuecomment-33214050	chosen[1].js.2.dr	false		high
https://www.ready.gov/	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/disasters/coronavirusv	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/hi/disasters/coronavirus/economic/funeral-assistance	funeral-assistance[1].htm2.2.dr	false		high
https://www.fema.gov/zh-hans/disasters/coronavirus/eRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.youtube.com/fema	funeral-assistance[1].htm2.2.dr	false		high
https://mydomain.com/node/1	google_analytics[1].js.2.dr	false		high
https://www.fema.gov/disaster-responses	~DF8C0B9062984F8D35.TMP.1.dr	false		high
http://www.amazon.com/	msapplication.xml.1.dr	false		high
https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistanceance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
http://www.twitter.com/	msapplication.xml5.1.dr	false		high
https://www.fema.ttps://www.fema.gov/	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://datatables.net/license	datatables.min[1].js.2.dr	false		high
https://www.fema.isasters/coronavirus/economic/funeral-assistance#main-contentRoot	{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.fema.gov/es/disaster-responses	disaster-responses[1].htm.2.dr	false		high
https://www.cdc.gov/coronavirus/2019-ncov/index.html	SQ22SSVH.htm.2.dr, coronavirus[1].htm.2.dr	false		high
https://www.fema.gov/disaster-responsesvirus/economic/funeral-assistance	~DF8C0B9062984F8D35.TMP.1.dr	false		high
https://www.fema.gov/sites/default/files/email_white.svg	funeral-assistance[1].htm2.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
74.125.140.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
162.247.242.19	bam.nr-data.net	United States	23467	NEWRELIC-AS-1US	false
13.32.25.62	d27f3qgc9anoq2.cloudfront.net	United States	7018	ATT-INTERNET4US	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	389168
Start date:	16.04.2021
Start time:	12:48:51
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 43s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	11
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/159@7/3
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance#main-content Browsing link: https://www.fema.gov/es/disasters/coronavirus/funeral-assistance Browsing link: https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/fr/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ko/disasters/coronavirus/economic/funeral-assistance Browsing link: https://www.fema.gov/ Browsing link: https://www.fema.gov/disaster-responses Browsing link: https://www.fema.gov/disasters/coronavirus
Warnings:	Show All Exclude process from analysis (whitelisted): BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, svchost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 131.253.33.200, 13.107.22.200, 168.61.161.212, 104.42.151.234, 13.64.90.137, 104.43.193.48, 88.221.62.148, 88.221.229.79, 172.217.16.106, 142.250.185.78, 172.217.19.104, 172.217.19.99, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 216.58.214.228, 20.50.102.62, 152.199.19.161, 104.43.139.144, 13.88.21.125, 23.32.238.177, 23.32.238.234, 52.155.217.156 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, consumerrp-displaycatalog-aks2eap-europe.md.mp.microsoft.com.akadns.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, go.microsoft.com, www.googletagmanager.com, www-bing-com.dual-a-0001.a-msedge.net, www.google.com, arc.trafficmanager.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.fema.gov.edgekey.net, www.google-analytics.com, www.bing.com, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, skypedataprdcolwus17.cloudapp.net, fonts.googleapis.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, displaycatalog-rp-europe.md.mp.microsoft.com.akadns.net, www-googletagmanager.l.google.com, f4.shared.global.fastly.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, skypedataprdcolcus15.cloudapp.net, dual-a-0001.dc-msedge.net, a-0001.a-afdentry.net.trafficmanager.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, skypedataprdcolwus16.cloudapp.net, e6485.dsca.akamaiedge.net, skypedataprdcolwus15.cloudapp.net, displaycatalog-rp.md.mp.microsoft.com.akadns.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{7139B2BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.851651258053571
Encrypted:	false
SSDEEP:	192:rwZ7Zl2OWmt2if5XpzMKRBRLDhsfYXEjX:rgt8lmHI4BER
MD5:	DAC8D98ED39117FA23F556D5C5E87817
SHA1:	4D49DC5CE6BA9AA6FEC5CDC3802C20919DE615E6
SHA-256:	B6B8C9E8A683D56118FDB19414301075324EAF09CF751FAE0BD2538B6A46AD94
SHA-512:	97FE08177077D1E51D72F9A138F40CB712EE1F3B65963AE0ECA2288C454388BBD7AB88B554C3DE7E88067093E77BC988D7AD69BDDEA9373B7B53905B8B155B7A
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{7139B2C1-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	179302
Entropy (8bit):	2.540448062016137
Encrypted:	false
SSDEEP:	384:r+82qhg8dXmotRV7j7bG7WqUmR9KDhT91YYpcsdWZgyh2/ewGMmsEupcMxeGIxy8:bPIT
MD5:	68BDD48563BDB2FCE98EDFE7C97D5DA9
SHA1:	3912E1C91078D1F1B645D851B7296CB4ADE1E963
SHA-256:	D56F030F228A671F457D489BA4B1AD9DDE5DFBFFB14EFBF550B0A4CE36E9A0B1
SHA-512:	C4F14981F2DB12D0A2D24F97B5900FFAB7F6155AD65D559D1DAFF34B51D27395FB13D014F134E78BE8FF67E4A1F0DCB3FF463402E537F8AB3B793D7B52F96654
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{779371BF-9EA1-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5632820297221415
Encrypted:	false
SSDEEP:	48:Iw6Gcpr8GwpalG4pQRGrapbSMGQpK2G7HpRicTGIpG:r+Z0Q36hBSEAhTzA
MD5:	7BA7825847627698960CC75BD1BD10F1
SHA1:	5124788A8814051C4EDD56464F0DED3483B814B5
SHA-256:	1DFB2CD39FF81EBCBF08C6ED7FCABBEFD057632DF8B71BFD02D96BDFBB7E5D9C
SHA-512:	BF8D47CC91B1A6A389B9E2287B11CDA11507409507B1FCD87C3E58375E7E7B412D465689E8107FABFDE8A271C3CD0A7F798EF0CAA7103A23E6CA7D0DCEFF0C6C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-17529550060\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1095645895801605
Encrypted:	false
SSDEEP:	12:TMHdNMNxOEVsoWzsoW5nWimI002EtM3MHdNMNxOEVsoWzsoW5nWimI00OYGVbkEs:2d6NxOsWXW5SZHKd6NxOsWXW5SZ7YLb
MD5:	011E613941AA8EE2D096CC472A1F3421
SHA1:	4502405E71CF90AE2C8372FE31ED379215DA04DF
SHA-256:	5D0BF867ED48C49C09716D1ED38F9CC63CD120DAE2D6BD09F5073152C739B638
SHA-512:	67B8B93A5DB2106C39E5E86FDF7CBCF0B42A0C2403BEC04B76D1037C452FD0090795182C2B7BF213936D418A4919028B2496767E79D1CE5658E59846B277CAE2
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.twitter.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Twitter.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-18270793970\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.130261332279621
Encrypted:	false
SSDEEP:	12:TMHdNMNxe2kIWmW5nWimI002EtM3MHdNMNxe2kIWsYW5nWimI00OYGkak6EtMb:2d6NxrRWmW5SZHKd6NxrRWLW5SZ7Yzan
MD5:	F15BEE81708A8C4A1EE8E87457ADD0A8
SHA1:	C46AE2FE824C1588A3C838D72C9844EDE18EEB84
SHA-256:	C0EFCCEF71A3716747A7157ACA670E24BABBC1686BEF84056C430294E642CDAD
SHA-512:	E655D9D824BCE5EFE282EA19350762C0B1D20C9BA5AEAAFBFF352933BDBCC09FA9F0C9385BB08A469570515A51FF68E4CA3AA0AD7FABC25C56254D0636646883
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5b8585f4,0x01d732ae</date><accdate>0x5b8585f4,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.amazon.com/"/><date>0x5b8585f4,0x01d732ae</date><accdate>0x5b87e85d,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Amazon.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-21706820\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	662
Entropy (8bit):	5.1340204602927315
Encrypted:	false
SSDEEP:	12:TMHdNMNxvLPaVa5nWimI002EtM3MHdNMNxvLPaVa5nWimI00OYGmZEtMb:2d6NxveY5SZHKd6NxveY5SZ7Yjb
MD5:	94FD5CE361B6B1D1E8F07608608BC5FA
SHA1:	DB6149AF7908DF224BE7935B923D92CB789BEE89
SHA-256:	4B3B1A1C5A9F9BC65CCC748DCDA9E0CFC2F77407A00FB39799731181C1A68B97
SHA-512:	66DDD4D5839DF6B160995BEAC9968A3200F8347C601632CE6C6690071F28E66571F7389DECA704963F4926D38BF6C75FF4AD7FCE47794E928754EDB5A1809704
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.wikipedia.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Wikipedia.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-4759708130\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	647
Entropy (8bit):	5.104902424874061
Encrypted:	false
SSDEEP:	12:TMHdNMNxiQW+W5nWimI002EtM3MHdNMNxiQWR5nWimI00OYGd5EtMb:2d6Nxqb5SZHKd6NxqR5SZ7YEjb
MD5:	005B5A1F5438EEF7F4559DE746FDDD39
SHA1:	4EB674B03DFF4F3DEC22BCAA32CEFD54CAE38282
SHA-256:	F3384253818584FF32BA3F34C7307520850F2323659FDA002587CE577ABCB075
SHA-512:	91F5E82760DB8A970C4803F2BE5F04E305F9951179237E60C797E6B1CA55D7622172AA460A541B90B09E72DC01BEA5CE2828F3E85244B1CEFE259A7489EC55B4
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.live.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Live.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-6757900\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.1497701360762145
Encrypted:	false
SSDEEP:	12:TMHdNMNxhGwPaVa5nWimI002EtM3MHdNMNxhGwPaAIb5nWimI00OYG8K075EtMb:2d6NxQHY5SZHKd6NxQHj5SZ7YrKajb
MD5:	7C918827FD9D662DF3D3B8BEA2310D0B
SHA1:	CB39E414FC58FDF22FDA53324667FA2C11BD124A
SHA-256:	DFB6D4120B5FFC09B2370BA1D1BCF733704B86558DEDD9FF21357BA30B55F3A2
SHA-512:	63BEAD4454DF9703624308DCA23952998128D77B6B84784286CF955206DB4F5CF8B64AB1258FDAB26368A1E27B10A695787EFAC3C56DBFA144DC6C2F74579F75
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b963661,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.youtube.com/"/><date>0x5b963661,0x01d732ae</date><accdate>0x5b9898aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Youtube.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin-8760897390\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.11084830353492
Encrypted:	false
SSDEEP:	12:TMHdNMNx0nVsoWzsoW5nWimI002EtM3MHdNMNx0nVsoWzsoW5nWimI00OYGxEtMb:2d6Nx0pWXW5SZHKd6Nx0pWXW5SZ7Ygb
MD5:	508207BC5945EE02C731B48F4F81663A
SHA1:	5FA0A7D297AA17D629CB1C363676E04DAE23729B
SHA-256:	602B9A22629166D1DAE9CDB2A4B1BF344C5B715636FE5A8B3883587B455AC3F8
SHA-512:	64F792A6B9124FA5DADD251083566460E63B5C588486BA55B2634608C5E9AB44450411F3DB274EEB8B499A05EEA419020D28404EC944C3136A943576975AAA3E
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.reddit.com/"/><date>0x5b93d414,0x01d732ae</date><accdate>0x5b93d414,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Reddit.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20259167780\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	656
Entropy (8bit):	5.106881769246928
Encrypted:	false
SSDEEP:	12:TMHdNMNxxnR5nWimI002EtM3MHdNMNxxnR5nWimI00OYG6Kq5EtMb:2d6Nx1R5SZHKd6Nx1R5SZ7Yhb
MD5:	98718560F9B4B820CB919E111675A65F
SHA1:	8C28BBE129AEAE621E4EA0CCC85CE647ACDBED73
SHA-256:	361FB7B096EA7CC4C2F5CFEEBF89924D1EC3D31B973FC80C7F3D73ED59090639
SHA-512:	DF8297406FF1169DF3E7686ECA3893F78859C50E666BEA678E2852847EFE3F2562E21A0924B4AB09B20D34D5F01B602A435A3931C60A5A1D2C65173ECEEFFB86
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x5b9171aa,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.nytimes.com/"/><date>0x5b9171aa,0x01d732ae</date><accdate>0x5b9171aa,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\NYTimes.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin20332743330\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	659
Entropy (8bit):	5.079266666359399
Encrypted:	false
SSDEEP:	12:TMHdNMNxc+BWABW5nWimI002EtM3MHdNMNxc+BWABW5nWimI00OYGVEtMb:2d6NxQL5SZHKd6NxQL5SZ7Ykb
MD5:	849F41C6B50116ACE123DF373C195A6B
SHA1:	B2C0C26664A901B30961925E16E10A0E876A1CD5
SHA-256:	2EAE7E4AC932FBA2BB7884A5691008A1064FA8767FEE886895C9042B3672DA89
SHA-512:	7FDB44A0EDBA9C008ADF8E452ACF5CE9C87713DFC8E662EBBBCE0C672B0C8399D773D4448524CF1400EBF77D0CE7A42DFA9882146F5C9ACDEB7848255BE2B5FB
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.facebook.com/"/><date>0x5b8cace6,0x01d732ae</date><accdate>0x5b8cace6,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Facebook.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Tiles\pin8215062560\msapplication.xml Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	653
Entropy (8bit):	5.085609648608946
Encrypted:	false
SSDEEP:	12:TMHdNMNxfnQW+W5nWimI002EtM3MHdNMNxfnQW+W5nWimI00OYGe5EtMb:2d6Nxpb5SZHKd6Nxpb5SZ7YLjb
MD5:	778F1E9FBA4CC94C266D8025ED4345ED
SHA1:	0FE97DBDB471927C93B96E1A4CB7D5F4D5E5FE4B
SHA-256:	7954909253C1190FFE09561E27E5E5B8C364E100741EE04A00CB784499D83AAB
SHA-512:	D65C00E598F3B966F786FD06969AF5157BB56C33CB04163D2753AA9C0BFE1BF4113FE49469E4A8540D68BF25054333EAECC6519BC622813CC808F1A1B9442246
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/></tile></msapplication></browserconfig>..<?xml version="1.0" encoding="utf-8"?>..<browserconfig><msapplication><config><site src="http://www.google.com/"/><date>0x5b8f0f4f,0x01d732ae</date><accdate>0x5b8f0f4f,0x01d732ae</accdate></config><tile><wide310x150logo/><square310x310logo/><square70x70logo/><favorite src="C:\Users\user\Favorites\Google.url"/></tile></msapplication></browserconfig>..

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	48190
Entropy (8bit):	3.6485027060946345
Encrypted:	false
SSDEEP:	384:SUP1rUUmpmH5B+uTdrFiJAVQJJJJJJJjJJTIJSJJCWJJJ8mJJJJvs0JJJJJJJJdY:SUP1AUOKNCTY
MD5:	D45B47EF8E79ECAFC3E02CEE8B3BC0EB
SHA1:	613B52ECB23C4ED06EFBFB692C61D22B1A20DE2D
SHA-256:	FCA4C24DE7AB70CE1568363FBD820F76053080D89725CF5E74666A6E92AC68CF
SHA-512:	FBCD0BA0B34DBBDA4D2EF28C9F403DECAE72E0517FFD74B90B1DFEE7C0E0F59CCAEF2CBE574E46BD8A0C5107EE64F81450ACD6BB7B919589045730CD51A47E7E
Malicious:	false
Reputation:	low
Preview:	M.h.t.t.p.s.:././.w.w.w...f.e.m.a...g.o.v./.p.r.o.f.i.l.e.s./.f.e.m.a.d.8._.g.o.v./.t.h.e.m.e.s./.f.e.m.a._.u.s.w.d.s./.i.m.a.g.e.s./.f.a.v.i.c.o.n...i.c.o.~.........lk.... .h.......(...l......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20180, version 1.1
Category:	downloaded
Size (bytes):	20180
Entropy (8bit):	7.97320012816743
Encrypted:	false
SSDEEP:	384:S3ECNC9EU5uXBx/d17jzOBmhUXQOTF3IHrYZEFeWXU5ebGLtCjUdtjVOTg:S3EC2rMXBdjzOBRx3IHrYOFeWLotCYL7
MD5:	5CC3AAE674EA3B199313B3B83BD795BC
SHA1:	993DB0EC4347B0CC53128CFDCBB767606D8A3576
SHA-256:	38399EFE707A8FFC12359A0086E7340315B42194A10FD2E1D1288BE12DA9E39C
SHA-512:	2346622E53705ABB58BDC45818D497CB17E9F9869B546CAF298D1E4D4A2D7E15B5A3C3EE8E6779D64C4C4BB0F98A58216A394BCA81F6660AE137FC6326B48955
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff
Preview:	wOFF......N.................................GDEF.......6...F....GPOS...........f.x.{GSUB.......{... J.c.OS/2...8...V...`[.t.cmap..............3cvt ..........."..fpgm...........s.Y.7gasp................glyf......4...f.....head..E....6...6....hhea..F.... ...$....hmtx..F .......P.=).loca..H4..."....s.Tmaxp..JX... ... .3.zname..Jx...A....[.s.post..K.........SF.prep..N....S...V.c..x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x....a.......f.]C..fe.5fs...m.a<]Cv}...7..NG..7l.#.}&..J........^c.S.....>..yv.<{.C...N...p@...>....$..!......:...BH...p.C.}).O/..M...t...TB....E....t.....s..L.H _..G3.l.....l?..y.`..............=.....Q.6.e....v.n.]T.........}w..iz..czc;.....C....Z6...m.2G\|....b.8....x\|I'T..Lb%.xI'Q.H.p.%..."UbH.$.%..I&SR.&.4.$...RP2($a..4JJ.e$...M9...DSA..(.T.<S.xjI:Mh..vD.^.. !t..)t.'i../..`....&.1.%..L".)L.a.8.....#...@\|...".Y....J..$.....f%k.a.d.N<...r..6.#...}.gf~S.9......A.A..affff~.......Y.TZ..j....E..N...pO.l..Ze)......`.V..[.c.W.10./.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20096, version 1.1
Category:	downloaded
Size (bytes):	20096
Entropy (8bit):	7.976739163404447
Encrypted:	false
SSDEEP:	384:pKEBfGHU8uXBvkV+PzO1hBPplViLe21Fyb5MXJL/HT0AvAOhFVOT3:pKCfG0pXBU+7g7lVAe21Yb5y7T0PmFVq
MD5:	A75563D7B9E5B1DB163971B9A2E66216
SHA1:	F52CCC0BBCE9D1E550790EA02639B36326764349
SHA-256:	C08EFA91781865D1A2E9FCB030F8AC55C2D8EADBF8822C2EA251556333F99D9C
SHA-512:	2ADD03FA487983BBF4E098E08BF87A6DCC0AF603B0A9F54CBB72452C5D410D45950155C106AF0C93C13C03D3EF1AC9A2C4A15EBF1F87699393F4350B5851F15C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i54rwlxdo.woff
Preview:	wOFF......N........\........................GDEF.......6...F....GPOS...........T...zGSUB.......{... J.c.OS/2...<...T...`[.u.cmap..............3cvt ...........X..fpgm...........s.Y.7gasp................glyf......4...e..,..head..Ex...6...6....hhea..E.... ...$....hmtx..E........P.7%.loca..G............maxp..J.... ... .3.pname..J(...@....X.qEpost..Kh........SF.prep..N,...S...VS..8x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x..WUpc9.lC.af8ffff..cf..>fffffff/o`_..l.....R=?..f.o.K.'i..I-0B..p..Bt.=.;.u'^~.YX...N>...u.E.`.D!!....R...w..3O....ej@...a@...En..A%e.Ai...m...LA56..=.U8....xT...d#..kP.."..Q.V8I).zP..=....X...R.v....Mv2._.T>..bQ..&.[)...bD..&.{...`.gb.d3>......Q...[.?...O..?.......).S6\|..W.B.n..xDk.<.PN..f!.G...... v..aA...#.!_h@.P.2...B9.<T.....Q#..V.D.P.z...B....jV.j.....z...b.......Hh..B.6....P...l...-..b.^..._....H..Jq.0...H.=....q.\|....}..P...".v).W<W..!\/.p...-..Y.M..v!.;.......w...aE.+d.>aE./d..<..).c@.`P.^,.S.E..F.>.nz.sX.S..`..z.........H.G

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 19896, version 1.1
Category:	downloaded
Size (bytes):	19896
Entropy (8bit):	7.973207257576149
Encrypted:	false
SSDEEP:	384:vi9GdFUguXBNV01KI0EhV+xnP+gu9ZLpanYwJz1aRRxaFsq+6LVnQVOTa:vi94iVXBYQnmUYwJz87kLhxnQVOTa
MD5:	B03F2EC28F8E60E61974DD8C57610E5B
SHA1:	DFF9B2C95F626F894185C98CFBB976BB98B50F33
SHA-256:	D8DD0DE638293EB62DBA15A6E410FB0AF9A5B36C35DF226237B1B609D573C63E
SHA-512:	A585B769AA7CD7311FB4075DB5EEBE09E65A46CEA773639482DE0EAAD248C0BCDC571BEF16BCC9EE1196596014871FF39541AF66C1A53FA8B026A82C0F00904D
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3ig4vwlxdo.woff
Preview:	wOFF......M.................................GDEF.......6...F....GPOS...........f.o..GSUB.......{... J.c.OS/2...,...V...`\?v.cmap..............3cvt .............9fpgm...........s.Y.7gasp................glyf......3...e.q.B4head..D....6...6....hhea..D.... ...$....hmtx..E........P.k!Nloca..G(........].(maxp..IH... ... .3.rname..Ih...8....X.p.post..J.........SF.prep..Md...R...V2...x....@....{..::#0.ZGK..`....R...^qT..qW<^...../....x.....]...w.jm{..m....m...m.F1.n....\|.........8....w..Uj.6oWkX......?..0.{...{3....4.K..pP....(.{.%..!./(.x....}C.d.`.....29x.@...+.!.......Q...T..+]g.^p.9....x.agI.W[jg.m.K........-.c.E.D......6..r...!.7>.......X+.ok..+7k.o.yj.%..<.uw.*....v.N...>...L`.....x...&..I.......4B$.p. F..4.$.D.#I.I.HR$.TI$MbI.$2$.,rH%WR...t.P.T>.T>.L>.,>..>.(........\.....I......)B8E%.b....H.4.I...I..u4.!Y4.114..)..=.....t..>z..^.x.#^.........3Pr.$~.3.l.H:......FmS%.R....#.S..cvE...6^[...v....Z..`A..]R.hg.\S../w.([.s.n..y.{.....osc....At.....x.%Q

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[4].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\877b02039c[5].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	modified
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\Latin-Merriweather-BoldItalic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 24464, version 0.0
Category:	downloaded
Size (bytes):	24464
Entropy (8bit):	7.980368563514149
Encrypted:	false
SSDEEP:	384:1P93TGqXqtPIbW/ANhv2vXfXd9hVYOZBdHViiPHzgTkywyZFHcpw76eTIb9smLx9:1P93T/6pIb/J2vFHVYOZB1V9sTZw0cp/
MD5:	69DEBB55BA07CD17F2730F71CAF77339
SHA1:	0418038D16872C6CB6D70FF800DA1FABEDDD641F
SHA-256:	744A8B2D072D7B01617680B18FD829933B4F316A71BF971B7364539602F180D1
SHA-512:	E92EDC00DD7AB2328644E10B82111B447FC18A90A8A6E3619B1FDADAF7BB7109CEBB6B4E34329F20049AD2FA2DCDC5DF113E2A4F760692EAA2C7436311ED12BA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-BoldItalic.woff
Preview:	wOFF......_.................................GDEF..]....=...F.I..GPOS..^.............GSUB..^.........(..vOS/2..Pl...R...`W...cmap..P............Rcvt ..X0...A....5..2fpgm..Q\...<....vd.zgasp..].............glyf......I...z..n&6head..M\|...6...6...hhea..PH..."...$....hmtx..M..........8..loca..K..........n.maxp..Kp... ... .k.bname..Xt........!...post..[\|...G.....k.8prep..W..........0.hx...\|dG./\U7u.9...j.[Y...h4....f<.8.=3..0.3.6...x..cl0.lX..`.v..,y...g0.0&.......ROp....7..T..U.N..S.T#..#...i.!=R<..1"...1h...x!..%.t.<u...'.\|...O.=.89}f.....d.S.;.\|....2.....x....&..!B...q.n,.2.x.#e.qa1.k.Y-b8.k..;.....@S.....y....&..ml.C.....!.&..!5z..LP.>N......`.O.<.......`..7....Rc...ju\=..x.....v9.vx..d,.3...T!\..r..O....../....(.\{...e.=.%...b.~.!.N..]............O.=..S.'... ..=$......sc..1.....>...Q."...........).b7.$nE....E...+.........e...`.......8^..}8.oj....1.s.....pH.Z\|.....q.k.kz..`i...v.5..:.../f...h{./...v.qZ....4.:...u.......%.w.....)...V.v]...4.\|......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\back_to_top[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1218
Entropy (8bit):	4.565469135050744
Encrypted:	false
SSDEEP:	24:2v/WFCy5VKm2WNcklMHdl2W9cnxcm4LAwiecnxcmqS/cuDlPWSlFGlxqaunv:F5MmOka9nKd4EwFKdX/pdPGyaG
MD5:	01B303BD7F0651408E97AD668D6C363B
SHA1:	A7E9D3CE2305795C4334A2F9B5E038AEA3A62A0F
SHA-256:	260BC459CB0ECD15ECF5E32A19FFFD475166B4BC3E39197568E0FEC6B5B8B3B8
SHA-512:	D2F4AD43C4E1B69555F08F11370CC54892429BD120DAA1F24EB2D7BE1938292F0F3027E781F765FFBBFB568E5A86ADC649308FAEED5AA18972E2B1AD1B91E58F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/modules/custom/back_to_top/js/back_to_top.js?v=8.9.13
Preview:	(function ($) {. Drupal.behaviors.backtotop = {. attach: function (context, settings) {. var exist = $('#backtotop').length;. if (exist == 0) {. $("body", context).once('backtotop').each(function () {. $('body').append("<button id='backtotop'>" + settings.back_to_top.back_to_top_button_text + "</button>");. });. }.. backToTop();. $(window).scroll(function () {. backToTop();. });.. $('#backtotop', context).once('backtotop').each(function () {. $(this).click(function () {. $("html, body").bind("scroll mousedown DOMMouseScroll mousewheel keyup", function () {. $('html, body').stop();. });. $('html,body').animate({scrollTop: 0}, 0, function () {. $("html, body").unbind("scroll mousedown DOMMouseScroll mousewheel keyup");. });. return false;. });. });.. /*. Hide show back to top links.. */. function backToTop() {.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\chosen.jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	29004
Entropy (8bit):	4.912069363278223
Encrypted:	false
SSDEEP:	768:UOtj9+umwoSfCoxHNfhvwITdGWb0DvHrTgtV:UORjSoxHNfh1TdGWb0DPXgtV
MD5:	198860BE177A85C5D9FB224A2700FAE2
SHA1:	7BB8E837E5D49E9ACC0290EB4330209672E66933
SHA-256:	8FDC973AA28E9462A401EAD3CFFE8A0A595E92658FDCAB776BBB01BCC2BC2062
SHA-512:	8E046751DB3C27A9D8C70CC41DC3F37C54D6C22EA8569AA580A0EC3D16AC9C351AC43D76F919FC193170C193FDED8D02E3E2D2D09E19FD6D00249A0DC538E999
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/libraries/chosen/chosen.jquery.min.js?v=1.8.7
Preview:	/* Chosen v1.8.2 \| (c) 2011-2017 by Harvest \| MIT License, https://github.com/harvesthq/chosen/blob/master/LICENSE.md */..(function(){var t,e,s,i,n=function(t,e){return function(){return t.apply(e,arguments)}},r=function(t,e){function s(){this.constructor=t}for(var i in e)o.call(e,i)&&(t[i]=e[i]);return s.prototype=e.prototype,t.prototype=new s,t.__super__=e.prototype,t},o={}.hasOwnProperty;(i=function(){function t(){this.options_index=0,this.parsed=[]}return t.prototype.add_node=function(t){return"OPTGROUP"===t.nodeName.toUpperCase()?this.add_group(t):this.add_option(t)},t.prototype.add_group=function(t){var e,s,i,n,r,o;for(e=this.parsed.length,this.parsed.push({array_index:e,group:!0,label:t.label,title:t.title?t.title:void 0,children:0,disabled:t.disabled,classes:t.className}),o=[],s=0,i=(r=t.childNodes).length;s<i;s++)n=r[s],o.push(this.add_option(n,e,t.disabled));return o},t.prototype.add_option=function(t,e,s){if("OPTION"===t.nodeName.toUpperCase())return""!==t.text?(null!=e&&(th

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\chosen[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6506
Entropy (8bit):	4.624047268553028
Encrypted:	false
SSDEEP:	192:wXliBQ0yIF1U+KWeQs/vz/7262vm75Uaox2MJvTk8J3zjTUKvZiRRf:w1Uya1UV332vm7Ns2MJvY8J3q
MD5:	D21675ECE8A8AE3A9CF43F871F64FF9C
SHA1:	3752994EB4698A89308B15D471E569E4644EE1FA
SHA-256:	0ED321FBBE1966DE3C3C3D5E9074DA59C56CB53FF486DED6DA66E12D00C78411
SHA-512:	A6860EF93213AF8BC4BEA752D5868D35A2BDABCF1112CDA6DB245DA86EA200CD5A1899D5297D509C1F43C56819C576DD42087E48BABC9EA73063B8110D263652
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/chosen/js/chosen.js?v=1.7.0
Preview:	/*. @file. * Attaches behaviors for the Chosen module.. */..(function($, Drupal, drupalSettings) {. 'use strict';.. // Temporal workaround while https://github.com/harvesthq/chosen/issues/515. // is fixed. This fix was taken from:. // https://github.com/harvesthq/chosen/issues/515#issuecomment-104602031. $.fn.oldChosen = $.fn.chosen;. $.fn.chosen = function(options) {. var select = $(this). , is_creating_chosen = !!options;.. if (is_creating_chosen && select.css('position') === 'absolute') {. // if we are creating a chosen and the select already has the appropriate styles added. // we remove those (so that the select hasn't got a crazy width), then create the chosen. // then we re-add them later. select.removeAttr('style');. }.. var ret = select.oldChosen(options);.. // only act if the select has display: none, otherwise chosen is unsupported (iPhone, etc). if (is_creating_chosen && select.css('display') === 'none') {. // https:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\close-blue-60v-alt[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	254
Entropy (8bit):	5.103723313646496
Encrypted:	false
SSDEEP:	6:tI9mc4slzbtHqUNRtj9/ymqZlZkUq0vdGoAK+:t4LHqefjYhlLq0D+
MD5:	6EB4510EB4CF4022687A599D0E22CE75
SHA1:	2282CDDA6254F152D695143C653F59181F0EE425
SHA-256:	3CD4AAD8CD5F774DF3A6B8D73B8A76277AB0D5C0C42CE749A635CECAFCB8D66E
SHA-512:	8AF5E7076D973DA756A67408C1BA747083B5F4322CB5D860F941C913CC457231CB12F691C41F20C3C896A6CBE1CF20AB61FFCA421534B0E441BD081766E97F69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/close-blue-60v-alt.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="15" height="15" viewBox="0 0 15 15">. <path fill="none" stroke="#005EA2" stroke-linecap="round" stroke-width="2" d="M0 13.0332964L13.0332964 0M13.0332964 13.0332964L0 0" transform="translate(1 1)"/>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\drupal[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6312
Entropy (8bit):	4.829027756516979
Encrypted:	false
SSDEEP:	192:8y7EabGSafu+3GfZqnWHMZxObyQEvShbIMPr8MZScmtCsLPIjj99Iuerd1:ttzjyIvTS
MD5:	2D083E808846C9D9780ADB0B098027D9
SHA1:	D5B5D83F9C911BD862A4977DE0F41D1BE9BFBAD7
SHA-256:	990FDA61C1303A87F6317B47FEF824552D611209F0537BD4FAAA9648D3DE1363
SHA-512:	827AF9DB47C3D27A27CF0C4BA70BB3C4A59D65DA05A2A6AFF0E8BC03F934E1CF5219AAD1D006D60F215104EA93C0FD034255AB7C977FF0B53D6A30CC8F1B9C12
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupal.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..window.Drupal = { behaviors: {}, locale: {} };..(function (Drupal, drupalSettings, drupalTranslations, console, Proxy, Reflect) {. Drupal.throwError = function (error) {. setTimeout(function () {. throw error;. }, 0);. };.. Drupal.attachBehaviors = function (context, settings) {. context = context \|\| document;. settings = settings \|\| drupalSettings;. var behaviors = Drupal.behaviors;.. Object.keys(behaviors \|\| {}).forEach(function (i) {. if (typeof behaviors[i].attach === 'function') {. try {. behaviors[i].attach(context, settings);. } catch (e) {. Drupal.throwError(e);. }. }. });. };.. Drupal.detachBehaviors = function (context, settings, trigger) {. context = context \|\| document;. settings = settings \|\| drupalSettings;. trigger = trigger \|\| 'unload';. var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema-logo-blue[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	30633
Entropy (8bit):	4.329100777319275
Encrypted:	false
SSDEEP:	768:HxJI7xcphSN2UwpMjXTtdN2lxkA3gA18J:38iC9wpKXbFAZ4
MD5:	3368EA7515DEE377CBB955D0C7D575B6
SHA1:	981087254B98E6786EA4C5C825169806A1776D2F
SHA-256:	1936633A2C23D0A260CC1750BFF59E8923D9A08C9D53274CF1D6BE6105412D19
SHA-512:	DDF4261D28689EACB5E277B0278C94637129EBBC421E95F25F4AD3149DA27F94EEEFB04B064C0DCAA9A3C2D6C9D0BCA82E33FE370DFBC8AB3DF427869E373318
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/fema-logo-blue.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 22.1.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 310 110" style="enable-background:new 0 0 310 110;" xml:space="preserve">.<style type="text/css">...st0{fill:#045388;}...st1{fill:#FFFFFF;}...st2{fill:#C42032;}...st3{fill:#C0C2C4;}...st4{fill:#0778AE;}...st5{fill:#5E9841;}.</style>.<g id="FEMA_logo_2_">..<polygon class="st0" points="127.1,76.4 133.5,76.4 133.5,37.1 127.1,37.1 127.1,33.2 159.9,33.2 159.9,43.4 155.9,43.4 ...155.9,37.1 141.1,37.1 141.1,54.7 152.6,54.7 152.6,49 156.5,49 156.5,65.4 152.6,65.4 152.6,58.6 141.1,58.6 141.1,76.4 ...147.6,76.4 147.6,80.3 127.1,80.3 ."/>..<polygon class="st0" points="164,76.4 170.3,76.4 170.3,37.1 164,37.1 164,33.2 196.9,33.2 196.9,43.4 192.9,43.4 192.9,37.1 ...177.9,37.1 177.9,54.1 189.5,54.1 189.5,48.4 193.4,48.4 193.4,64.8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_tables[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3111
Entropy (8bit):	4.581822386121126
Encrypted:	false
SSDEEP:	96:kfPO6vaF7kaBC/dRSvijO3mCtWveujO3lpAOA8Z1jOJXKb1jORXFsL:kfPOIaF7kaBC/fSvijCmCtWWujCleSZP
MD5:	4673C6527A891D7B84075552B86A330B
SHA1:	95B55BDF04B5B15318071BF74CE58A3A3A8CDE80
SHA-256:	8F22C43D5E58AE5469340440E2B9A70993B878C537BC76EADB8DBA25F53CFD7F
SHA-512:	1BCDC9CE6A1EACF5BB181946314B91F61A5A7AD1A1AB5D64D2909DB58FAEDDE36065DE051E4263C1B89686CC4101B55ED8E9D79883014B5FAC371582279A730B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_tables.js?v=1.x
Preview:	jQuery(document).ready(function() {.. function createDataTables() {. //targeting table with class datatable. // add "aaSorting" to disable default sort. jQuery('table.datatable, div.field-name-field-data-table-csv table, div.datatable table.views-table').DataTable({. aaSorting: [],. retrieve:true. });. //508 compliance calls and set title attributes. jQuery('th').attr('scope', 'col');. jQuery('td').removeAttr('tabindex');. jQuery('tfoot').remove();. jQuery('.sorting_asc').attr('title','This is a sortable column in a HTML data table that is sorted ascending.');. jQuery('.sorting').attr('title','No sort applied to this column.');. jQuery('.dataTables_filter').find('label').attr('for','datatables_search');. jQuery('.dataTables_filter').find('input').attr('id','datatables_search');.. //this applies the default sort arrows to our datatable. jQuery('.datatable th:nth-chi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_uswds[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text
Category:	downloaded
Size (bytes):	5819
Entropy (8bit):	5.119571476630061
Encrypted:	false
SSDEEP:	96:7yTWKvvqn8kaY1G59/CcRznSdYXCVVwEvOwCHnl7YXCVVwEvau/Q:7yEyC+SdYYCHl7Yq/Q
MD5:	176C9B3EA22B14902286F99CF01356C7
SHA1:	3572773FC1BF92C598C685DF143CFD76DE6D7669
SHA-256:	6F89CE0749E80BDEA53EB50B24CD88BECDB16ED66BD51FD498EF2AF70F789726
SHA-512:	E6B48D15950F9A65A5B7DC111D90A0165F05D828BF2262DF05D7F484D2571BB5F76B39A63165098A4A2433EBB2CB4C7AB818C6E894832C3C893BB0A2B353920B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_uswds.js?v=1.x
Preview:	jQuery(document).ready( function () {...var langCode = drupalSettings.path.currentLanguage;...// adds datatable functionality to .datatable class..jQuery('.datatable').DataTable();...// adds an hr after every h2 in the content region..jQuery('.region-content h2').append('<hr />');...// hiding dropdown menu until page is loaded..jQuery('ul.hide-on-load').removeClass('hide-on-load');..jQuery('div.usa-banner__content.usa-accordion__content').removeClass('hide-on-load');...jQuery( "#edit-dhlocation" ).focus(function() {...if (jQuery('#edit-dhlocation').val() == 'Enter your city and state, or ZIP code') {....jQuery( "#edit-dhlocation" ).val("");...}...if (jQuery('#edit-dhlocation').val() == 'Ingrese su ciudad y estado, o c.digo postal') {....jQuery( "#edit-dhlocation" ).val("");...}..});...jQuery( "#edit-dhlocation" ).focusout(function() {...if (jQuery('#edit-dhlocation').val() == '') {....if (langCode == 'es') {.....jQuery( "#edit-dhlocation" ).val("Ingrese su ciudad y estado, o c.digo p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fema_vaccine_graphic[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 2400 x 2400, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	49856
Entropy (8bit):	5.715861693099527
Encrypted:	false
SSDEEP:	768:TEjHH480CQQtKMoo2VdVJTPWUx5WKBsKs4upV:TWHl0CQoKpo2VdVJTPP5RHu7
MD5:	994FCB68D0A44BA492D6E45D2CDF8425
SHA1:	C336913DC78ADC208A2F23B00E63652009BBE0AC
SHA-256:	1BD499F7E813FE779127F7A05633822EAA3A2DA7C83DEDF101EBAA65C459D3C3
SHA-512:	48ED23FB8FB5C10D0C423E69306B887AAE2B1711BED6BB48F2FA571E73BCE3685C208384A39884487213A40BCD5AFF40EDAD3D62DCC8B68B8085F094607D9F69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/fema_vaccine_graphic.png
Preview:	.PNG........IHDR...`...`......M.n....pHYs...#...#.x.?v....iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:tiff="http://ns.adobe.com/tiff/1.0/" xmlns:exif="http://ns.adobe.com/exif/1.0/" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmp:CreateDate="2021-02-08T18:33-05:00" xmp:MetadataDate="2021-02-17T16:42:50-05:00" xmp:ModifyDate="2021-02-17T16:42:50-05:00" dc:format="image/png" xmpMM:InstanceID="xmp.iid:116b3adc-d787-4783-b9a0-dde9633c7e8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	93965
Entropy (8bit):	4.431489842824501
Encrypted:	false
SSDEEP:	1536:QltYqJ6Gj9eOof8QvtKvbkDQIrAm5vMbViBsCUAz1fPJl9zQFGcQ8TlP3GVSB2ny:2q/9QIUNZAz1fPJl9zQFGcQ8TlP3GVS3
MD5:	50B314824C9A731926E6FC78855C6587
SHA1:	2800E259C7E5C2B8267BA738F4D1569EB09ACAC1
SHA-256:	88820D254438BEA10483CEBB78660724E01A9E56CA75B5B7DBE76DEC3ADF52D1
SHA-512:	B786F201620E9FC3CD0C1E7171134854AB787219E8AC79FC6BB970D1CB70C4DB71DBD86F7B8E076D7FA6BABFD45FD6BAAF2EB1CE56B2EC59C28EEDD5386A870B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/ht/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="ht" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\hp-search-arrow[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 28 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	419
Entropy (8bit):	7.194954019543332
Encrypted:	false
SSDEEP:	12:6v/7ODgcAkt6OWN3j7CkU5zUI7byD4ygsrvJjut9ELseob7tyy:Qc5AOWwkU5gAbyRxN09EgPb7f
MD5:	AA44487BF605BD480C3EF049E2BF37CF
SHA1:	3D2BE80DA054E1CE9ACC844203FD4A0CE86BCD29
SHA-256:	71B87E54B25D094E0631ED156506E72796A0549F1E9673BFACDA5CB3D887E91A
SHA-512:	786C47C91862BCD27693A6CA924A2898EDC3D932213BB1066E974631A65BA0A082359F8DC5D1C140B9A6F1BFFAA2B2597C230CAC5366E734DBC8A82B7D79FD69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/hp-search-arrow.png
Preview:	.PNG........IHDR.......0......c......pHYs...%...%.IR$....UIDATX...1N.0.............&..8.+9@.......H%'(...AG.b.*'r...../y.....Gz....&eU..l7...J)....;.eU.UA.=..&z.ws.bM........f._I.V...R....s.........E..p;9..\|@.....NP...Zh..@{Ait.(.....(P....h..A..T....'e"'v....g.z.%{.NV.....!....]y..t....`l0.c.)X2..%..,..bQ..6......X/(..A...ja..&v.jc'`...sa....`.96....Wq.c....`..L,.zj..-.......5u........Q...v.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-dot-gov[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	651
Entropy (8bit):	5.121889669293397
Encrypted:	false
SSDEEP:	12:tvG1XHb+zu/rADafPxfjOBj2GwxujyrIT0px4Q0y8jbjagcjawm8HlP:tu1XglsxfjQj2yjyry6RP8jbjejXmaP
MD5:	D1C68805B39204BD12C74FB89CF46B5A
SHA1:	0D6AA00FB19A3F2A40D07C764950C3DEA1BE2208
SHA-256:	8D5D08018C88AD2FA2608E080EE8D7B994FCE4CE311BC65077A95469355BDD04
SHA-512:	A13FA3525453F52393FA7E53888A6F671794F5460BB4E02BD8E4D3AAFA33341D3F71024896F8CB82C85F6E0B3A98871AE40BE4BB6206FE13CA098F5E8E0C3F6E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/icon-dot-gov.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 54"><defs><style>.cls-1{fill:#2378c3;}.cls-2{fill:none;stroke:#005ea2;stroke-miterlimit:10;}</style></defs><title>dot gov icon</title><path class="cls-1" d="M36.5,20.91v1.36H35.15a0.71,0.71,0,0,1-.73.68H18.23a0.71,0.71,0,0,1-.73-0.68H16.14V20.91l10.18-4.07Zm0,13.57v1.36H16.14V34.48a0.71,0.71,0,0,1,.73-0.68h18.9A0.71,0.71,0,0,1,36.5,34.48ZM21.57,23.62v8.14h1.36V23.62h2.71v8.14H27V23.62h2.71v8.14h1.36V23.62h2.71v8.14h0.63a0.71,0.71,0,0,1,.73.68v0.68H17.5V32.45a0.71,0.71,0,0,1,.73-0.68h0.63V23.62h2.71Z"/><circle class="cls-2" cx="27" cy="27.12" r="26"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon-https[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	518
Entropy (8bit):	5.18608229395607
Encrypted:	false
SSDEEP:	12:tvG1XHb+zGfrAUaTRbknUNDnUN5arnUatY3yWnUa6S+k8HlP:tu1XgGvIRbkUxUarUjU/MaP
MD5:	E012DECA8C4F6E0FC9E2E269F06E16C1
SHA1:	31997B49330EA1FC6B2A68DFCE1A885994CB5494
SHA-256:	C4FBE61CB398B85C01CD675F6A554F1845BC342F568B59297DE3C126A5E7F5F8
SHA-512:	718E35A5E2FFF62AC3D2ECE80C08E528B2BF57E4A73D0E9EAC98A6CD32DA3B354985667611B3128CBD4CE55CB4528E00575EF7CEDDBA0BB2018648CA843D379A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/icon-https.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 54 54"><defs><style>.cls-1{fill:#719f2a;}.cls-2{fill:none;stroke:#538200;stroke-miterlimit:10;}</style></defs><title>https icon</title><path class="cls-1" d="M34.72,34.84a1.29,1.29,0,0,1-1.29,1.29H20.57a1.29,1.29,0,0,1-1.29-1.29V27.12a1.29,1.29,0,0,1,1.29-1.29H21V23.26a6,6,0,0,1,12,0v2.57h0.43a1.29,1.29,0,0,1,1.29,1.29v7.72Zm-4.29-9V23.26a3.43,3.43,0,0,0-6.86,0v2.57h6.86Z"/><circle class="cls-2" cx="27" cy="27.12" r="26"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_disasters[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 100 x 133, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	941
Entropy (8bit):	7.401829576800934
Encrypted:	false
SSDEEP:	12:6v/7KgbIpuNvt72+QEaHMmxhwzI3ULhBZI+9z3TH2urKBJevWfAASdx3Epfpdzy2:zg5DjaHbxN3yZI+9z3THTesVzQh4YVJ
MD5:	01705151B2F2245471AB727C7C7CCA88
SHA1:	C70A5F62FD793812F20CD4359319C3E3EC0E156B
SHA-256:	06F93EDDF2435717426A15156EB086CE4D65D3DE3DAEEA757B0DCC9D6AF52782
SHA-512:	DB2B0E0372C847E40B881535ED70544A23CCCC50628CA384FE271259918843E8237635480CA77ECAD1C4784A5A335D9A83E93F35A7EFA05418C3DF4F01A03DDC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/icon_disasters.png
Preview:	.PNG........IHDR...d...........]s....pHYs..!...!....e...._IDATx...?h.a...G-.R.C1up..op....I.Q.....S..A(... ....X..`.8T.C..A...j..EA".IImr.....~?.!!wy{_...M.......P...#6^..~.H...Gh1.....hg....b<.A..+.Aj.#.Aj.:.A.... ...B..BD!HJ.Q...3.A.xE!.#.(.q.6.A.H.. .$.B...D!H`.F!H..D!H$.F!HD.D!HdsE!H.... ..-JCV......I.}.._...F...e..g`...p.......af..Y.J/_..!..&k.H.......3E"...6..=.[N^u.O...\....).DY[>../...1..C.1..#1... z.I..\........U=..t.....U...N.....=..y?6....j......cI.9D.A..D...I..Ce.O.\|d.o>e6........vs......,1..C.1..#1.._M..+>.....7...`T....C.1..#1..=w.......w......4.lp..!....!.........n.-..l,.H....W=.%. b.".u..!o]...n.5...2~.]..,1..C.1..C.1..C.1..C.1..C.1..C.1..C.1......./.{8....KbGwoM.=g....!....!....$.3D.A..D.A..D.A..D..j..._6>9U..%......w.R...;..u. b.". b\'...K..9....5...g..~LS.%. b.". b.". b."..wg,..a....D.A..D...bX~..%K.A..D.A..D.A..D.A..D.A..D.A..D.A..D.A..D.A..?.af}..@H0..iq.:z.!4....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_factsheet[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	709
Entropy (8bit):	4.985154720732652
Encrypted:	false
SSDEEP:	12:tvG1W7x7dXAKdGcdVeNSR5jxjHc0zVeEjxjHc0pAvZVeUeo5jxjHc0FSUnFcUaju:tu18dtF4NSR5jxjHc0z4EjxjHc0WvZ4A
MD5:	BB4DB2261C36D95C4BAF6CD77FDAA6B0
SHA1:	D0575AE32338FD2AA915B45672F40785D7FF6EBA
SHA-256:	F941CB25678894316914F28DF67F6FF654BAEEE0DF2050A617FBEDA817071134
SHA-512:	A07518569850592E4C1DB7B8B58A441ED198E0562E475CCA2B2B5D58F31336855AE45E5ECDBF3F7EFD1C356D8F42F31F31C1B34ECBD80F400283CBD14DD8B278
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icons/node-icons/icon_factsheet.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33.502 44.3623"><rect width="33.502" height="44.3623" fill="#d6e3ec"/><line x1="6.001" y1="36.6795" x2="27.501" y2="36.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.001" y1="31.6795" x2="27.501" y2="31.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><circle cx="12.9747" cy="14.4882" r="6.806" fill="#005287"/><line x1="6.001" y1="26.6795" x2="27.501" y2="26.6795" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><polyline points="9.57 15.015 11.595 17.151 16.934 12.033" fill="none" stroke="#f5f8fa" stroke-miterlimit="10"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\icon_webpage[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	789
Entropy (8bit):	4.932324967389328
Encrypted:	false
SSDEEP:	24:tu18dtcijxjHc0gsjxjHc0KQNjxjHc0LtljFR6HcPYNtjxjHc0Y:083zVpzVK0zVLJRe0OzVY
MD5:	8B2D1AAA07B7FE8DB4C23719B79B9C6C
SHA1:	52B2BB8AC728FF345E2851B3F9A2512C85A913CF
SHA-256:	C3B193FEE67BB8C4B5C631F672AB5A1A8F32555E3414F1AC48B4603883271F62
SHA-512:	DC4A8AE4B6585DD9D7B15572DE1C9970E7A2F6AD50E45676290FFAA377BBC99FE9D3028541C2772951BC06E4A26397025E3330D7660D38B7E040C8E8C924D889
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icons/node-icons/icon_webpage.svg
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 33.502 44.3623"><rect width="33.502" height="44.3623" fill="#d6e3ec"/><line x1="6.3157" y1="38.7079" x2="27.8157" y2="38.7079" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="33.4767" x2="27.8157" y2="33.4767" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="28.281" x2="27.8157" y2="28.281" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/><line x1="6.3157" y1="9.453" x2="27.8157" y2="9.453" fill="none" stroke="#005288" stroke-miterlimit="10" stroke-width="4"/><line x1="6.3157" y1="22.881" x2="27.8157" y2="22.881" fill="none" stroke="#7aa5c1" stroke-miterlimit="10" stroke-width="2"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\illustration_featuredmini_covid_careers[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2618
Entropy (8bit):	7.834641138650524
Encrypted:	false
SSDEEP:	48:k1sFC917mXpfKy0geuEl0R4AmEMo7XsaQvVNR2OrlMMYedxhfk1DeSJlXGIIs97:k1sQ917mhKyjeX1EMo0RBiMYeZ+iSJlJ
MD5:	55CB16CDB54A00354780BB1FD75B7596
SHA1:	2E4E8BE7EADE833999F4EC19738ADDF4B2884BC9
SHA-256:	1C61AFE9D4BF3E72E9E4F16205F0401623DF62529D01F6731FF4A88042C2BFD6
SHA-512:	6CCFF5AFB29707732847731492943301D8614C52D6D9823676DE584AC447BC4F21AE3458DE8DBC5BE2CE8B81278D906EB81C9865FBCD3842DB4704A7CCEF1359
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_careers.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx...oLU..........GP@.V.........6)..[...i..i..o.W...L..Y...4.kS.W.I...U...6..Z&uiQ..z... (.....{.s..=.9.Or_(.{....<.<...011A.R.._.$!. ...Q. .B.A.....@....~g...e..3D.....(@D]Dt...n?.z4../....@..6.......q{....x.......m....P.I.NB......mMD..#o.Qq...~-NB...Q..Q......p..o4.+..]...B..krpl`...I..}..V`.!. ...Q. .B.A.....@....(.cut.../.('......+VUwt.]-.....l..x@~..(..\.CN.X....kuBsK.....(..D!. ...Q. .B.A.....@....._..x. .6q.....]_.+Xr=!...lX.t........TP_V@u....\|......49.} ....\I.E..N^.h..C.....9...r.....wQgo..3>.f.<..7...~..:.7%..U.&.D!. ...Q. .B.A.......PO. ...M.Iz.b/.........w...t.......O.d....<.T.g............4-...;......\|...z...z\|..K])[..Y...L.p.\..~.+z..Wak9U\..n...M.Z... ............x..D. ......[...z..e.Ytdg.67/^...0..yO..=..=}..K.r.......vO..H....<%^./.......\|.AI......].....:./....5..t..@.........kV..........S...Q...KM.`.T.....coK...QG.)K.....Qz....;_\R...6x.q.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\illustration_featuredmini_covid_economic[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	3116
Entropy (8bit):	7.863078074083735
Encrypted:	false
SSDEEP:	48:3CpmHV999WxIRzrO4t28QFhUN2TNRoWqODef6Nq1yzLOyKP+9x:HpBtpxigODer8GQ
MD5:	103DA5E25E66933B4CC94AD667F48B4E
SHA1:	EBDA1A264DCAF66CC30E28B57FA2B63AE9988011
SHA-256:	017A134A45ADC0F540F661F27C01CE99ED2B84E7977565C5BD3BE45CED4876C9
SHA-512:	CFABF2B688C022153B38DC192C2B00BF9ECF3CD7B69998E0CA084D6F1127808A3C8132FC7B48600DF126697A40070B935959B7B9512C5B5780FE4BECDFF7A1ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_economic.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx.._lT.........6`..vP0..;B...b.R.Fi...jE...%H}.B.EU.>V"y.CK..R..F..Zp.ZHk..............]}..^v.]{....~...^....g..Y4==m...g.hB..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HT.... Q..$.P.D....B..U(@...HTY..7....1..r.0Z..wg.')c.....O$..LT.... Q..$.P.D..D.y...)3<:a.......fht\|.t./]l.....K.M..BS...6.x...{.}...............3h.-,(0.E....T.XFA..g%.X.......-395..{...".........R. .......3...fY2......K=...r...Xa.....k..N.6.]}N...,.'....aS..,.-b.....B.blb.tt.Y!..T.(..q"w7....62.ui.n.~.8....\.a..\....5.....+..=.u..*.c.q...w..(..uB ..l5...g..p....>..D...+.a.7...Mp..c..@}u.y..~g.....6..u...y\|A-p..}.ut..D.8..P\|.K...d..o....D.X.je...k.H~\.@\|Z.v..+.. P<....s1.C.N..6...z....;z....O........$...t.@...9....;L...%oM.....I.3p...GE&A.........?..}{.g....j..^...>_.H...GA...@.L..,.../v..........Q.a7...............h..\..6..]vr..y@.(.>...e..g`..=..H...`]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery.colorbox-min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	20186
Entropy (8bit):	5.099467750395556
Encrypted:	false
SSDEEP:	384:D67gfC8BC9dwlGLqZCf/rQ5O38UxH7nHuUV/b:DRfC8BC9dwvsbQA38Mx/b
MD5:	4A85AD65F7F3C9A3FECFED3F3718B9B6
SHA1:	EE0CF4711566A9576B31FFE152F9152D69A89E99
SHA-256:	5A3CC48D900A5D6C3FE74EFE54186C088F7C5CD0F996DC3D97F4C6C981427BE8
SHA-512:	6D5997C4CA3E4F2A59C1DFEA7D34B93EEDC498535C737918AE8604248252EED3FDD6BFC3D159D47741747C5013653D01DD474BF865FA6269773767DFDB62481F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/libraries/colorbox/jquery.colorbox-min.js?v=8.9.13
Preview:	/!..Colorbox 1.6.4..license: MIT..http://www.jacklmoore.com/colorbox./.(function($,document,window){var defaults={html:false,photo:false,iframe:false,inline:false,transition:"elastic",speed:300,fadeOut:300,width:false,initialWidth:"600",innerWidth:false,maxWidth:false,height:false,initialHeight:"450",innerHeight:false,maxHeight:false,scalePhotos:true,scrolling:true,opacity:.9,preloading:true,className:false,overlayClose:true,escKey:true,arrowKey:true,top:false,bottom:false,left:false,right:false,fixed:false,data:undefined,closeButton:true,fastIframe:true,open:false,reposition:true,loop:true,slideshow:false,slideshowAuto:true,slideshowSpeed:2500,slideshowStart:"start slideshow",slideshowStop:"stop slideshow",photoRegex:/\.(gif\|png\|jp(e\|g\|eg)\|bmp\|ico\|webp\|jxr\|svg)((#\|\?).*)?$/i,retinaImage:false,retinaUrl:false,retinaSuffix:"@2x.$1",current:"image {current} of {total}",previous:"previous",next:"next",close:"close",xhrError:"This content failed to load.",imgError:"This image failed to l

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\jquery.cookie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3681
Entropy (8bit):	4.432977644958858
Encrypted:	false
SSDEEP:	48:NLocEG3yLTvBekpI9hutXoaRXOEouRKgCyB/ys9Xcmt:OTAyLTvckpILutXoahOEJKaBqismt
MD5:	56B9F5C33F0E746A063D7005855B91AB
SHA1:	71079911CE51C3FF517989A59A756A7AF133350F
SHA-256:	6A7A9B49222B7364759C2CEFDA3AD1193E0BE467146206CE70B80DAED7A8A563
SHA-512:	8A3ACD09EAA869777197B7089C450980B3EFD136CFCBDEE2F1F7896E81464A4F3887B25D6C6E954CC073F1F5B5727B8864B9763D483C1BCBA9BACBBB0EA301A4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/wcm_survey/js/jquery.cookie.js?v=1.x
Preview:	/!. jQuery Cookie Plugin v1.4.0. * https://github.com/carhartl/jquery-cookie. . Copyright 2013 Klaus Hartl. * Released under the MIT license. */.(function (factory) {. if (typeof define === 'function' && define.amd) {. // AMD. Register as anonymous module.. define(['jquery'], factory);. } else {. // Browser globals.. factory(jQuery);. }.}(function ($) {.. var pluses = /\+/g;.. function encode(s) {. return config.raw ? s : encodeURIComponent(s);. }.. function decode(s) {. return config.raw ? s : decodeURIComponent(s);. }.. function stringifyCookieValue(value) {. return encode(config.json ? JSON.stringify(value) : String(value));. }.. function parseCookieValue(s) {. if (s.indexOf('"') === 0) {. // This is a quoted cookie as according to RFC2068, unescape.... s = s.slice(1, -1).replace(/\\"/g, '"').replace(/\\\\/g, '\\');. }.. try {. // Replace serv

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\sourcesanspro-lightitalic-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 20256, version 1.95
Category:	downloaded
Size (bytes):	20256
Entropy (8bit):	7.974658775886973
Encrypted:	false
SSDEEP:	384:YlahT1K8Pxv77e+3FRgBQ9MJIZb7CxkPnpWHbpkzg2XBg+lKvh83:Y4bK81MBYmIB7C2PncnIgG2U
MD5:	3FA6EBB831989F031E8BF92297A412BB
SHA1:	E797489A945F0C06A17F56A0B1F3F0AA891572A4
SHA-256:	AE4AA077E7150A6A2F01797C2C0B56850BFBAB1B334CFC61019B0E80DA44608A
SHA-512:	BDF528C153E07088E808CB377F40A5E8E8FF8EFCFF8B68486F85264F9F61BF056A09F74C5266A588FCB2E9261190DD0FB89AEE6F13FBF19A100AD4A805C8ACA9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-lightitalic-webfont.woff
Preview:	wOFF......O ..........._....................BASE..E....F...Fe.].GDEF..E....^........GPOS..F<...e...j...EGSUB..M....\|.....s.OS/2..8\...Y...`Z.oecmap..8....o...v.._.glyf...D..1...S.aZ(/head..5D...6...6....hhea..88...$...$.v.#hmtx..5\|........g%5.loca..2l.........J.-maxp..2P....... ....name..>(........-.i.post..A@...T....8(..x.....\..?..m......{.{..{...\|....{.7...PC1=.`....w.......!\|Sqz......mR..}.<if4..F#....."+..Cu... =Bi.........~^..rZ-.8..w.6.....O.p.W.....~.....3{..u'N...}.U...3.'...)?......hk...~...+....<P.A...r....3.;>....\|.#.}.=.nr.....@6?H..tZ..y...A.S(.z...<.N.....O.c'.n....\|..+&...3.j..w.....5...dJ.-8.6./......{..:.B.....@N..../..$....xO..4..Q..}1.nNEW..h.3......~.twlT0..../.....x.g.D..\....q.<~DX..L7.....t.....{..S.<x...+......n=t.S......\.R2............cx....4&.2.v...[.^.....p.#....._....z.......<.Os..~b{&:..t.8.Et.....`d..._...g......{..I....i.?#.......V......T.p...._..+....U......c.OT..A....u.Q.7..g.!x......Z.a...:.1..yCC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\wcm_survey[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	14633
Entropy (8bit):	4.315278643828363
Encrypted:	false
SSDEEP:	192:LixiNakySlg+dGIwaSJTCjbeyNccTbAgvPN6CBaZrLYLJgOWWlOatE6VyxZb/VLU:M/IbykMvH8pE8KUaG
MD5:	C616323DB283DF039A1D28E2D1C011D6
SHA1:	A0CA16CC5166E11D7A0CA544BF415D1D16933588
SHA-256:	E10C3593CCE4DE5AEFDF6D3516536A918F7C44FD6A22D4BA1637784B198AC55C
SHA-512:	3B6C9FB2519B0DFC13194A89784C08E151915D3C15780AB4B8F5532F50543BB901C211D6BD4F1509015534E9A9588201534F35C5C830B4DC82C4F24BE1AD5171
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/wcm_survey/js/wcm_survey.js?v=1.x
Preview:	/*. @file. . javascript to cause a popup to appear to invite the user to take a survey. /..var wcmSurveyPopupProcessed = false;.var wcmSurveyBypassSurvey = false;.var wcmSurveyPlacedInFooter = false;..(function ($) {.. /. Log to the console.. /. function log(variable, label) {. if (typeof drupalSettings.wcmSurvey === 'undefined' \|\|. typeof drupalSettings.wcmSurvey.debugMode === 'undefined' \|\|. !drupalSettings.wcmSurvey.debugMode) {. return;. }. if (typeof console !== 'undefined' &&. typeof console.log !== 'undefined') {. if (typeof label !== 'undefined') {. console.log(label + ' =>');. }. console.log(variable);. }. return;. }.. /. place the survey markup in the footer. */. function wcmSurveyPlaceInFooter() {. if (wcmSurveyPlacedInFooter) {. // this only needs to be done once. return;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\world-icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 300 x 300, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11652
Entropy (8bit):	7.870294742412392
Encrypted:	false
SSDEEP:	192:Iavo3gMbRfmSGLfhpETA4w92P/U3KoYQNXIvlsAEjlo2GnYQFnhr:fCsSST1QU3jNysdloZY4B
MD5:	4C5FEFB79E028D093197BA23959AA070
SHA1:	7A646F38446D99640862271ABF13328551D2E592
SHA-256:	EE10D15710AF3D9ADF7A349EDCA757B35C5DE9279BDD7FC9FA7448506C707FD1
SHA-512:	35F11A3604F96CC1786A4BBB40E037D1FA478F301917F6C2CC14B58B3F86F8AC69D0B3D73285D9917D83935D7609DD028CE4C4A92AEDF4803EC60BBC878E774D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/world-icon.png
Preview:	.PNG........IHDR...,...,.....y}.u....sRGB.......->IDATx.....U.....;....@d.....T.qF...-0....k.l2....."[.K.... .....D6A.AvY.d.dIH.Izyu.....u.[.T.{U.........=...u....!...............................................................................................................................................................................................................................................................................................................................................................................................................).V(.....u4..OP..#.....f2..$..J.O"......T/...."..r._...~9...]%.....J"~)...y........u...K..+/.D.4.t.'....[.....8....a.H:/..{B.>N.y........7.......Jj.8t^..`>G.:P.. ../.c.....^%..w.<.#r..!...?...2...3.X......Pr....."Nj.X........;..[i.......kT.U7.8......7..(}....%-.]KG.F.~V^.o .......I..%..U...8ogrR..c.%.[-f.p..i....O..L.Z..aUk..{ZG=M.\|8.3[...d.-g;..>...z....~.D.r...U^xY.g...R..7S\..f.0...0.....w>-.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\877b02039c[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Bold[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26892, version 0.0
Category:	downloaded
Size (bytes):	26892
Entropy (8bit):	7.981580169302439
Encrypted:	false
SSDEEP:	384:j7eBYLLHasHoQKD1ZD4CsYl+i3leazBvwqNgXBad5aTIe9MxxSH+wXTATm8PhY5:LLLHv6djl+i3XeqKRanajKxx6+wXTn8W
MD5:	704B3917B84CEA21AE1466CE46C61F69
SHA1:	27DA5AFDBF4CABDCAB9DB0D59BCC77944090ED85
SHA-256:	31AC3086C758E8082B42C188A4028EA782DFA0C9C39A9C134242479B148C7812
SHA-512:	063467896F3DB0A87E0E9B183C5FF276AAF8F2657417CA36B5365D2B7867E9493F93E9F65EF61DB64F7ED5FEBCDDF780E0A7977D2EA26B379B05DF866D44B7B2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Bold.woff
Preview:	wOFF......i........\|........................GDEF..g,...D...L.G..GPOS..gp...V...`...GSUB..g....A.....S.fOS/2..Y....P...`W...cmap..Y............jcvt ..ad...A....6h..fpgm..Z....<....vd.zgasp..g$............glyf......S....n..W<head..V....6...6.A.fhhea..Y.... ...$.0.2hmtx..V.........b..&loca..T.........O.).maxp..T.... ... .m..name..a.........)...post..d....}......t.prep..`..........0.hx...`.W.8.......{_m.v...ZU..m.Rd[.Kd..N..8q.8..)...!.H...I...; ...G98.;8.... .h...Yie......y3..}...7..).85y.q..).......6...^...b\..vN.8.g.S~..G.m}.}....q.l.....m...m.y....i.e...a..VB<......!....7..N#.0.3.Jk.sa.T.mV.".......hM&r..`.;.x.9...M.d...'..O.37..hh.i..K....g...0N.1w......A4.C0....x.!^.E...B.!...k..?..........O\.S..y.........#.Y.O.^.....AI.A..Tj...b.:..Y.}^.\.v9.v.........0.+..5,..a1\....c....O..2.....2..g.'Mw................?..I...A....Md.....J.......#.c.~.i5.).."...4".H...=..E<......!;.+...p.....G7_h.LE.6.=!..TzR.E....8^..m.\|...fq.......]...pHa.......#....<.T.p..i...:{t...^A

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Italic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 24152, version 0.0
Category:	downloaded
Size (bytes):	24152
Entropy (8bit):	7.979130802237579
Encrypted:	false
SSDEEP:	384:JjXSaOhNuT+vSmZgppmsRM1RRedVQCQ+JOnqT4kfoljvPFwFqiaqgd7LIZh+gC9r:JjTQNM8AjdRM1RRMxSnqUk2rP+ad78ZA
MD5:	B85B8AE5763647FDDAC32F6843FCE5D0
SHA1:	077E9F2E1BF04794AF8FA55133F90162B74F6401
SHA-256:	99C4FCC227BC330F02658F5A77F4DE0DE380E9053B3377C01DC313C8D1491C45
SHA-512:	444171E83CC75046AC2A569E7D9A9ECDFC82A679D399A3DC96CDC49CDD498D458E538176256C9D57004374F13EA156B5CAFACB54A7AABDA968248F3734B31A3B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Italic.woff
Preview:	wOFF......^X.......8........................GDEF..\....=...F.I..GPOS..\.............GSUB..]X........(..vOS/2..OD...R...`U.cmap..O............Rcvt ..W....A....5:..fpgm..P4...<....vd.zgasp..\.............glyf......H...w..&..head..LT...6...6..ghhea..O ..."...$....hmtx..L..........\| .loca..Jh...........hmaxp..JH... ... .^.kname..WL..........$+post..ZD...H.....k.4prep..Vp.........0.hx...\|\Wu?~.}..}....".h4.v..].,K.l.l.v...8.c.8!.Y..$-....@......B[.......J.... ....%...oF........+.Hs...=.,.s.9w.AG...i.!.R>..1"..)d...E.(......'...'Z?...G.k{.q....cO=.....O=........p3...'P."..Y..>.....e..h.d..%.E..\|..fUD.....)$=nw.g.p....u^G4.u...k...\.1.4<2rH...!x^.^......P._.y.?+...+...9`4.8.U...hE.5.I3..z....q...x..l...MJ_..)......../R..1x...p8x...{...w.s.?.:".......`_...S._....t\|...z.._.dH.......zK.~...c.a.s.....3.G.4.....aA...ca..X..Dl..U.t...,...?.7....M.47u.n....!F......f.w~..5..7[w....m(.;Rhh.kh[.....,.V..=..NK.MM.....F.Kw..:..+&}....]M....;.Sgp...Z..@.h.....H@..A[.`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-LightItalic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23808, version 0.0
Category:	downloaded
Size (bytes):	23808
Entropy (8bit):	7.980219682523817
Encrypted:	false
SSDEEP:	384:PAc1Z+BQuy+CFwQM4ndVsuFTDU7FaY37A07FZ87hmJchPM3kP+r9smE1QztN9:Ph1Z+Ouy+itnddRDO77e7kqhPjPyE1gB
MD5:	AF8E7E14F7CDD26EA1024D2CF618B58E
SHA1:	5CB3474CECDB40DC5C6320030258A493E2DEABF6
SHA-256:	1275C33F64E5332F0C1C6CCE7BF78C7AFE715746248493780E15187D54557B15
SHA-512:	02FE231C55DF03D31EDD2881E531C3AB16B2688AFCAC7F46AB64DBE9220E1F1641AAD8F7BCFA2D7F4BE62EC610D509ECC3737B9282BF45C457345476F522F56E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-LightItalic.woff
Preview:	wOFF......]........ ........................GDEF..[@...=...F.I..GPOS..[............3GSUB..\.........(..vOS/2..M....Q...`U...cmap..N............Rcvt ..U\|...J....4..Lfpgm..N....<....vd.zgasp..[8............glyf......GO..v<...%head..J....6...6..Ihhea..M...."...$....hmtx..K....~......%Qloca..H............maxp..H.... ... .`.Nname..U....&...n.;.post..X....G.....k..prep..T..........0.hx...`\W.?\|.}mz.WI#.H3...j..$.l..8....I.8..$.J.$...O..i.e..XvY.,l............?x..{.4...~_".4w.{..sO..s...:...$g...H.Y....O.Ac.`/..q).........<....[..;r..#O<.....?...}.....p...../z..........- ..pc....+.is....\.f...P..[.76F.v[.e.s{...X.f..m..et..1.=.l.!....R........$.0r#?.,.....k$.p:.!.#..z%.5*.....b.:...x<~...u...;<.l2..3...t!\..9....._.........A.bW...N.Q......w..i.;.D..?..Y.^./....O<.....q....P3.-..^...#@......I..#\|.L...... ....0..,lh.........[.^...s.N..X.3..45v....\|....u8..a.......z..~~...l.c..X>c.u..j....L....'.....-]...Ec..wj.[4Y.=...G...d.6..s.]{......[#.P.`}.....h.xi..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\Latin-Merriweather-Regular[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 27512, version 0.0
Category:	downloaded
Size (bytes):	27512
Entropy (8bit):	7.982147322572132
Encrypted:	false
SSDEEP:	384:RpLxI9raOnIJQihEbb7UqsnkjBKUr4lH97ErEs6vlyov79ZE418IKkkjTm0MmpYH:3VONaEbvEkjBKUr4hVYaVPCrk507s
MD5:	73C28F4EC1AA47641399DA34948DB75C
SHA1:	7FA7EBE77D5A0A6F3193E224399D579BD00DBB15
SHA-256:	BF534A2BA29317B46AD1FCAB142105C1D0E1A70191EF55F4E1B29C786C8AD824
SHA-512:	9B0F3FA2F3C0EA06964B8B8946986910F20027079A71712445E6CEC310DE5EED17851107D4CED65F504FCE7B90DEE3F3AF3B9761CFC07E16381575EBBFF47343
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/merriweather/Latin-Merriweather-Regular.woff
Preview:	wOFF......kx.......L........................GDEF..i....D...L.G..GPOS..i....V...`...GSUB..j4...A.....S.fOS/2..\....O...`U..cmap..\\...........jcvt ..c....A....5...fpgm..\....<....vd.zgasp..i.............glyf......U[....W.8.head..X....6...6.1.Xhhea..[.... ...$.!..hmtx..Y4........X.&.loca..V..........H..maxp..V.... ... .j..name..d.........2.post..g....}......t.prep..c4.........0.hx..y`dE..^U.u...+}.Nw..t.;w^2...$..$sefBf....a........D...A9D.Y...X...........".....z.;.L.......t.{U........!..".i..CF...V..iHas...D1!$....4Kcx.#...o{.G.i#O/...K'.(>.P..h...z.A./.../w.....<........n.q\..CH....3+T....p..kr.m.H8...g0.e..h&...,.%W..b..%c^:.).5.[....h`.I.Y.H0Bx...9.k.Gt..pq.t..&.....G..xA)MA)O!..~e.....~;.Y:......'..G.........nP......}F.A&..Sk.zQ.5...V.......q9aqVs.?./UL.\|....?{.....?.?6.....gM.1....r...[M..g-..Q.COv}.....>.......T4..v...@..Q.x...aA..0]X;?2...`.x....)."(.iD8.p.@w.."AP.#."3.;...Z..yF..B.....3.n.5...-......../...g.......6l1.#V.U..J#..38Q.9.8.T.7...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	48759
Entropy (8bit):	5.5215063523389265
Encrypted:	false
SSDEEP:	768:/yR3fYFBLbfsce5XqY1TyPnHpX/KWY3SoavPVRhwmCgYUD0lgEw0stZc:/y9gZfA5h1UHpXxY3Soiuw0sU
MD5:	0A4E309B5F2D7439B4F8876B19F37FC7
SHA1:	7AC30F933A2B889EDBE5D3449F4EC90049B0E2A9
SHA-256:	F79723478F4C48501CD49AC52B81D6244A6562B9D3F08CE8AB208A8B8878D4C4
SHA-512:	891337D9CD308331BD0166BAA7C99C2B856D47F0ADE8AF596F71AFFC962546BBE0952554C51CC9A10E28BB4CEE3648AEC819D83A8935E69E95F53F5CBF141C44
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\angle-arrow-down-primary[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	536
Entropy (8bit):	4.458359665373743
Encrypted:	false
SSDEEP:	12:t4zSMMZI4bfUgkju1LPAuLCdVISuSSWFF0b080/tLvSGABb:t4zSbZIVTjmYuLCdVIlSfnvK5
MD5:	D0652B4DB22232AE88D5615B6C8AD13D
SHA1:	D37BFD0D5AA3C84956E14F7068DB34F0E6B8491C
SHA-256:	AFAEE6EB7874BC5367742AF8802FBCCE763860FC67BBE9E9890368D7A405D542
SHA-512:	3F71D0EA83ECC0B79D557DE3C26AFFDBB0DF705FB861CF7FB33CAC4A964475A89C1B6836449FCA56C5C0F756289EC5052E4652BC47B3F1446B66CA6BC3451A69
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/img/angle-arrow-down-primary.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="512" height="512" viewBox="0 0 284.929 284.929"><path d="M282.082 76.51L267.808 62.24c-1.902-1.906-4.093-2.856-6.57-2.856-2.47 0-4.66.95-6.563 2.856L142.465 174.44 30.263 62.24c-1.903-1.905-4.093-2.855-6.567-2.855-2.475 0-4.665.95-6.567 2.856L2.856 76.516C.95 78.417 0 80.607 0 83.082c0 2.473.953 4.663 2.856 6.565L135.9 222.693c1.9 1.903 4.092 2.854 6.566 2.854s4.66-.95 6.562-2.854L282.082 89.647c1.902-1.903 2.847-4.093 2.847-6.565 0-2.475-.946-4.665-2.848-6.57z" fill="#005ea2"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89091
Entropy (8bit):	5.033695363472416
Encrypted:	false
SSDEEP:	1536:wr3XMXd+AwljF+vg7LD81XaFKvrfefa2J:r+AwljF+vg7LDafefD
MD5:	39B4468AA9D64F68CADB5A6ECF24695F
SHA1:	706C585B5610659FD9718B853C91710F849702CE
SHA-256:	54D80B9361125322C09703EB1081D8B4E714A58366EADA5D87F9BA8460C53338
SHA-512:	544C5B48FC6A03906F58252BD891F5EE37CDAD9A3E158DA2E932A19F979185CA7CD061BC3D395CDC7D83A94C7FF77BF2D0ED02B0B1E695AA35A991994E57CCFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_VNgLk2ESUyLAlwPrEIHYtOcUpYNm6tpdh_m6hGDFMzg.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}fig

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\css_grh0buQF8qNvIccuqzcF5vMhz2awV1fMgFle-uW9IwA[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	22326
Entropy (8bit):	5.05208449988245
Encrypted:	false
SSDEEP:	192:hEXJR92FTkLzRYiJayDysyvaAMFt1JgxA/S8oLXl686czKXE5HY/LuJQw07GTeR3:/mZrXXrlCWnW7h/ylD
MD5:	645DE6BFEC028909D15A2DE5C98735F8
SHA1:	0734B2C1869C9E7AF94973FC0EE3D736A5764233
SHA-256:	82B8746EE405F2A36F21C72EAB3705E6F321CF66B05757CC80595EFAE5BD2300
SHA-512:	1E2141F0C68E107EACBBA9BE59BA3CAD3E3336DDC3A7FB6A12A64856580D9A31843AA10BA3B999FCEF5ACBC84A77A008B76424ACAA24163F9AB360A26C24E96E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_grh0buQF8qNvIccuqzcF5vMhz2awV1fMgFle-uW9IwA.css
Preview:	html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}figure{margin:1em 40px;}hr{box-sizing:content-box;height:0;}pre{overflow:auto;}code,kbd,pre,samp{font-family:monospace,monospace;font-size:1em;}button,input,optgroup,select,textarea{color:inherit;font:inherit;margin:0;}button{overflow:visible;}bu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\drupal.init[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	727
Entropy (8bit):	4.98666298065344
Encrypted:	false
SSDEEP:	12:UkaFN0fw0PXlDlk91R6omRVARZrmEKsyAu4W31oUfCSoUfMPc9VwmWhpmf:SXT8lTomRVA13yrx31j5jM6d
MD5:	561D5E5F6F76F15FD1375A9A1C2A18F1
SHA1:	7F5514D8BDFF39269C12134505B9722484ED6CE7
SHA-256:	41683E0BDFED00E74DE14D86441E289271CA70B2A94C721653B9A49DC32FB24E
SHA-512:	B6FFCCAE5515BD354677128CEC38F5C45B4C806D72463C695673D7582C46DD5F718776C16D604D82210ACDAEEA35209DC04F3B628BB9EFD56A930E6714E31E2B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupal.init.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..if (window.jQuery) {. jQuery.noConflict();.}..document.documentElement.className += ' js';..(function (Drupal, drupalSettings) {. var domReady = function domReady(callback) {. if (document.readyState !== 'loading') {. callback();. } else {. var listener = function listener() {. callback();. document.removeEventListener('DOMContentLoaded', listener);. };. document.addEventListener('DOMContentLoaded', listener);. }. };.. domReady(function () {. Drupal.attachBehaviors(document, drupalSettings);. });.})(Drupal, window.drupalSettings);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\drupalSettingsLoader[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	519
Entropy (8bit):	5.161310412773144
Encrypted:	false
SSDEEP:	6:Uwq4VCi+5cGMKN0fGLB0PQwPoj/LR7nadOXCuhtdz2mySYuhtdz2myGy5mpq3Wja:UkaFN0fw0PKjNWdAbZbomvNXmirN5fgn
MD5:	49DBE4BAC61E9CA48A5951BCBE0D03E9
SHA1:	020EFEBBF1F6E97D39DDCDDC5262F34C1DB7807F
SHA-256:	5F8F69EC521F7998AF455985A8EDE6D8DCF3527B43795FE3D26F1F1B57A5A554
SHA-512:	C184CC753599864802BC90582698CF0D66E2E782D34ACD2E1EE26CA3F03BBA8C9D4FB2DB40E9B13FE0568DD9ABFE147EDC8A86FDD1B8EB5483AFA867C039C375
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/misc/drupalSettingsLoader.js?v=8.9.13
Preview:	/*. DO NOT EDIT THIS FILE..* See the following change record for more information,.* https://www.drupal.org/node/2815083.* @preserve.**/..(function () {. var settingsElement = document.querySelector('head > script[type="application/json"][data-drupal-selector="drupal-settings-json"], body > script[type="application/json"][data-drupal-selector="drupal-settings-json"]');.. window.drupalSettings = {};.. if (settingsElement !== null) {. window.drupalSettings = JSON.parse(settingsElement.textContent);. }.})();

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 108x107, 32 bits/pixel
Category:	downloaded
Size (bytes):	47998
Entropy (8bit):	3.6375882047289023
Encrypted:	false
SSDEEP:	384:8UP1rUUmpmH5B+uTdrFiJAVQJJJJJJJjJJTIJSJJCWJJJ8mJJJJvs0JJJJJJJJd6:8UP1AUOKNCT6
MD5:	0610064CB73C5B9BC9B13ECC32916BAB
SHA1:	C1C20C329913255E49173EC60ECAE74D8EABC21D
SHA-256:	4F480AE00061AE87D1C9EFE6BE1B88766670EC8B43314765CABF3B587BD64BB3
SHA-512:	335EA0FA4D4D6FC3E24329E6C8C689FF6CC1170EF2F0DA2424FC794F44F7FBC94A266761A6FB7F36AD61CD6359BEB0EEA08F7774C5AAE8E5B68F33A413087EAC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/favicon.ico
Preview:	......lk.... .h.......(...l......... ...................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fema_saml[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	1759
Entropy (8bit):	4.990612441581551
Encrypted:	false
SSDEEP:	48:kMm/mZrTvOfZtVKBr/7svaWPycxKq4uEvw:njOfZEsiWPfKq4vvw
MD5:	A78D8568D656AEC6DC5EE905D9259683
SHA1:	A1AA8B42A398391B0090CE529BC6E17260F40FD3
SHA-256:	B72F28534ECA12C883E1D3FD6BDDB7DB40EA0F6294678163283113CD97A329B1
SHA-512:	D54BDD7902BFAC1AD12DF68CDD5FA05525DCCAC795D5C1DEED107A799E4F2EBB54B14CB72858CE5E09225B7DF800D5F775DC92D8996D62E8D4ED76DBE7971C97
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_saml.js?v=1.x
Preview:	jQuery(document).ready(function() {.. // Jquery is being used to insert some divs and text since the appauth module is in sites/all/modules. // Wraps AppAuth button in div to add styling. jQuery( "#user-login-form ul" ).wrap( "<div class='appauth-area'></div>" );. jQuery( "#user-login-form ul" ).append( "<div class='clear'></div>" );. jQuery( "#user-login-form ul" ).prepend( "<p class='appauth_subtext'></p>" );. jQuery( "#user-login-form ul" ).prepend( "<p>Insert your PIV card into your smart card reader.</p><img class='piv' src='/profiles/femad8_gov/themes/fema_uswds/images/icon_piv.jpg' alt='PIV card image' />" );. jQuery( "div.appauth-area" ).prependTo( "body.page-user div.region-content" );. jQuery('div.appauth-area').before('<h2 class="h2break piv-login"></h2>');. // injects variable for text located in html.tpl.php. // jQuery("p.appauth_subtext").text(AppAuthSubText);. // jQuery("h2.piv-login").text(PivH2);.. // function to parse the url and if

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fema_stacktables[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2406
Entropy (8bit):	4.530672548345211
Encrypted:	false
SSDEEP:	48:0ExQjroYU/ToaOqJT9UBPAh7kalDWxV0xtN99vygaTwkYf/YhCUxOZtXafy7hlxH:0ExQIFhpJT3h7kalDWb0PN99KgaTwkYX
MD5:	8C2A543EEAA0A49BC3B277BA1E922256
SHA1:	2AD7B3E696143634E2C2175CCE7EE69278F3A84B
SHA-256:	1760C784FD76B0128F0AA3C52F5C6885940F768095E4C53018593843517C2F48
SHA-512:	411F23E9773A88F72E8EE1D52F4B370584116E2F79D4ECD4F2A7F3D35CE78FCBCF3ADDF814424D4283FE881C7C8AEC2E63FF3E315FDB937358649A0A95C82530
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/fema_stacktables.js?v=1.x
Preview:	(function ($) {. 'use strict';.. Drupal.behaviors.stacktableResizeBehavior = {. attach: function (context) {.. var mobileBreakpoint = 800;. // Resize timeout event ID.. var resizeTimeoutId;. // Resize timeout duration in milliseconds.. var resizeTimeoutDuration = 0;.. var resizeDebounce = function () {. clearTimeout(resizeTimeoutId);. resizeTimeoutId = setTimeout(doneResizing,resizeTimeoutDuration);. };.. const targetElement = 'table';. const datatableClass = 'datatable';. const datatableSelector = `.${datatableClass}`;. const datatableTableSelector = `${targetElement}${datatableSelector}`;. const datatableWrapperSelector = `.dataTables_wrapper`;. const stacktableClass = 'stacktable';. const selectors = [datatableTableSelector,`${datatableTableSelector}.large-only`];. const smallOnly = 'small-only';. const largeOnly = 'large-only';.. var doneResizing = function () {. var width

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\fr_gS3tHmI3ppuHDLOinbISzm3sUzwHeI0BWG1M1IE1h6M[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6734
Entropy (8bit):	4.86794480785369
Encrypted:	false
SSDEEP:	192:N7FQO3QptQOE0MyPOylJXVMXUaEThCXrwJaiDkdY:4O3gH/SeCXrwtDV
MD5:	C72554E607B10E705296D641DBA8AEF6
SHA1:	5A79CAEA2879DF9DDD68A77983C0791D995CD8E6
SHA-256:	812DED1E6237A69B870CB3A29DB212CE6DEC533C07788D01586D4CD4813587A3
SHA-512:	A23B5F5DD89866162A9E9129B28629A480C7B441262E4BF03A328B7B2F47B2E42A58F4C5CEAAAAE26FC0A051BFE01629B820606011A4B90470665A149C0C94EB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/fr_gS3tHmI3ppuHDLOinbISzm3sUzwHeI0BWG1M1IE1h6M.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Hide":"Masquer","Changed":"Modifi\u00e9","Collapse":"Replier","@label":"@label","closed":"ferm\u00e9","Home":"Accueil","Image":"Image","Link":"Lien","Unlink":"Supprimer le lien","(active tab)":"(onglet actif)","Next":"Suivant","May":"mai","Sunday":"Dimanche","Monday":"Lundi","Tuesday":"Mardi","Wednesday":"Mercredi","Thursday":"Jeudi","Friday":"Vendredi","Saturday":"Samedi","Alias: @alias":"Alias : @alias","No alias":"Aucun alias","Cancel":"Annuler","Title":"Titre","Status":"\u00c9tat","Submit":"Soumettre","Group":"Groupe","Author":"Auteur","List":"Lister","Remove":"Retirer","Description":"Description","Disabled":"D\u00e9sactiv\u00e9","Enabled":"Activ\u00e9","More":"Plus","Taxonomy":"Taxonomie","Download":"T\u00e9l\u00e9chargement","File":"Fichier","Tag":"\u00c9tiquette","Edit":"Modifier","Date":"Date","Search":"Rechercher","Reset":"R\u00e9initialiser","None":"Aucun(e)","Category":"Cat\u00e9gorie","Settings":"Param\u00e8tres","Import":"Import

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	103197
Entropy (8bit):	4.335562748883692
Encrypted:	false
SSDEEP:	3072:Gq/b6NAz1yPJl9zQFGcQ8TlP3GVSB2nxv8x:Gqd
MD5:	BA582801B17EB54324D87D88EDDBA2E6
SHA1:	BC58FC7A3A7A7DB7BECD4831992D5F1E1D455EDE
SHA-256:	C05D322C0F04C46DCB25D18E77DA57DC6BF3F203DA1DA07837C12734C3E435E5
SHA-512:	E9AD7A08C1CC0C4D5BF487F61185EFAA60EA57AF0044EA5C9FF77EBB3C43B6EE1178DE0D9399D3465349A627ACC283AC8DA52038B30C943D240AB350766E49F3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/es/disasters/coronavirus/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="es" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ht_jsmTPvUkPo3P9JWlMIAn6G_o1cITWsWmpoeGs6kH6b8[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	142
Entropy (8bit):	4.798554372742572
Encrypted:	false
SSDEEP:	3:FQgEiKRLLWiOWRcxWn2uuJwE+fKHfH3AUaicHvkuKEJ2YcufeHAVJHBA9f/ue:FqiKR/WpWRcxi2ziRiHvAUJcPkLE4rQ6
MD5:	10D73D2F2A031AC5168CE16ED43052D3
SHA1:	0565362A5BF2A0C3C3B752A5A08CDCCEB748A042
SHA-256:	8EC9933EF5243E8DCFF495A5308027E86FE8D5C2135AC5A6A68786B3A907E9BF
SHA-512:	CBD5C9B9AE8E9C6F39894EDDFF0710B6C1884357487A966FFE4839506AF16C6F895AD3D4D5A34637BE928725E00CDE741FD77186A981AF64F28F89469D6F8E58
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/languages/ht_jsmTPvUkPo3P9JWlMIAn6G_o1cITWsWmpoeGs6kH6b8.js?qrmpxi
Preview:	window.drupalTranslations = {"strings":{"":{"Enabled":"Aktif","Search":"Rech\u00e8ch","Apply":"Aplike"}},"pluralFormula":{"1":0,"default":1}};

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\icon_release[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 100 x 133, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	911
Entropy (8bit):	7.43355335205232
Encrypted:	false
SSDEEP:	24:zg5qQq8jCQcCQcxx7QYrBWm2QCQkcCUn7TpWeGjw9CQcpDCQcCQYkj7:hWjIIVKQvn3o7EMI8s
MD5:	9359BFC3EF8CDAE619AB073189414AA6
SHA1:	0DBC39D10D83378F1162F081036AA1F5788372AA
SHA-256:	42F2E4CDFD40E2409BBF0E4E05D5E42AF38B3AEE0CCEC5D3E6343188BAE0887D
SHA-512:	912DA6CD6E5091637BE7A176A8C54C18D2979F7EA86E5C66D1C40A1280631A1DB5F5911F36F79ED4EF71702161223C6496784F248624F837679900178014EC87
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/icon_release.png
Preview:	.PNG........IHDR...d...........]s....pHYs..!...!....e....AIDATx....K.Q...W.m....D......!;gt...;z...A....x...)..lA...<....P#...xR...v?g..Ew..9.3o......#..)X..c....... 0..1..A`..c....... 0..1..A`..c.......%.p.>...U..{...p.h+`$..$...p...4.t.n...'.c...c....... 0..1..A`..c..$K'{..`x.o.NV....m.w..........r...Q,.F... 1.`..0..@.!...s{. .....G....}.Q4.6HoW{...T....^..(A..\|......y......7..Y...5.Hg..pj.j[..f.W.4..B...[..OU.......nR.9..m...V.... =].._G.Wm..$._.4..B...x.u..u..7...O7qd.....;...........y......U.Q... .d.b......W\Y..L=.%y:J.Ab...,k.C....B\|.a......`..c....... 0..1...?..#.. 0..1..A`..c....... 0..I....ay5_....l+..Cu.O. 1.De6.[.[..=..Q.{...`..c....$....E....m?Kq......S..A`..c....... 0In.W.....Y./.v.......~.$A..7Be.C....JE. ..`..c....$....P.>....kq....;..,...... 0..1..A`\~O..w...3. 0..1......Q..`..c....... 0..1..A`..c....... 0..1..A`...?S........O..IT2......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featured-mini_covid-19-report[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 161 x 161, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2336
Entropy (8bit):	7.803586716889103
Encrypted:	false
SSDEEP:	24:keUjROZmJC11111ewaUusGk+rhe7qNNpJkEYB/ehPXzSidZrh1tbx6L0EqvjOyVo:k4Gk6NZYBKPjzhD5vjOyEws3JNBXrDkm
MD5:	AFE0B9133E5423D8AD90CB8AC6DEB078
SHA1:	8BECCB2BE48F5F4BE28E7153D240595A5005DEF5
SHA-256:	A637A40B1681B13F8EC96807BDDD5BDC7E86326B689C1DAA8D2AC06ECFC1FAF0
SHA-512:	5ED79A6A9BF807A4132D86FF93FACC3A5D5EFF2057D8F4C28D7D0E43DD40B69826FEE5B86B666D509C2B2857DEFAFDD8C0C6FB86CFA37CB46ECD2100050B988B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/illustration_featured-mini_covid-19-report.png
Preview:	.PNG........IHDR..............Q.....pHYs...%...%.IR$.....IDATx..Ol.U.......?.A,"%....%R#. .M/.@.`.z"z..C.1......L8Y..$6A4&............P,)..L.\|..2...ng..7...I6..,3...~o.....L.X.B4..O...D.JH..D.JH..D.JH..D.JH..D.JH..D.JH........".+"..rp..9sNmn[uG..a...h\|Xu.3.\|VD.Ddq.{2.yN..T.%Z.S.9v#`.....'.DM.L.....o..F.,/?.....c....Vf....]....Z...T.h.>...}.q.'L..&..:...C..:...C..:...C..:...C..:...C..:.......X.l..\|.-r...:'.G.j...bT.L....h"67..Z.e....m/.y....}9(#c....i....\.[D>..+R&..0tC6.4E..l...1".;..n.............x..5....ni.bM`*.F5.5.#U......%..!Zk..).!..#..m.....Hk+.$...#.p.gg.X-O>...k..L..@o./.....'.........l.)...........^..+$.v.d..u...q..[R.t#..rx.....EDJ..0...6=...y.>...z.~ (.;;......b...N..cz..F.)...p.kB......g.}B^.~].clh^.<.9....]..1BD.g<..@.A.....7....7:.....&3"eK..I1..o..6..5\|..w.;Mo.+..nr....9z.=n.lJrSB.i....xed..p.....f.'...E.MP......... ._..ys..{.j..&.'....). ..}z..i.s.}.J......iz..&(a.]..{.H...E......(a.../$.-nUL...G...-...0.......R..u.N.Jx..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featured-mini_financial[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 161 x 161, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2639
Entropy (8bit):	7.837619879518007
Encrypted:	false
SSDEEP:	48:kwaSnWN1/9BrSzlBjOUKv8I0ZC2xPxBLZhMa+LIgp12XfyX:YM2GzfbiOZRxpxZKtLII
MD5:	1061408CD443AE0921DC3729C7955E2F
SHA1:	83F086D2764CCFB0C951CFE4291FB73E0841993E
SHA-256:	0BC17060837EA56B240E3AFB330213FC17B214105C473B663B123E3DA285B66C
SHA-512:	1DCDAA973B3D75CC74E9B3B5FE3EA2F5459D2B5D1CF5860A23E05CC08D85482BF6013D3CBB9CDD1AAACFCA8073D46F13328268D227D5AC5A967BFC49DBFD3407
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/graphics/illustration_featured-mini_financial.png
Preview:	.PNG........IHDR..............Q.....pHYs...%...%.IR$.....IDATx.._h\U....&.4.b..].Zm....DZ....aQ+.H...."(.yu.i....,.C.>..V}X...T..-k....j..O.W.i$I[G.w.....s.......@.43......;..)..B.&Kx..6...C..:...C..:...C..:...C..:...C..:...C..:uIz..\.]D.~....W.4%..)d....NT....P3.\|VDv..#a.gz.b...T.d.ED.V...%...wi...>.n..6...}..&...vM...M......'.@{`.M.] .;6....o..h..a..[w..nd....a.D..6\1!.PB..%$.PB..%$.PB..%$.PB..%$.PB..%$.PB.NU..2.\|X...h.].3...../"m..$.k......j..'...'\|...r.)!70..."...$DOB.zI%p...C..:.m.#m.+B.lt......@.#..A:V^..m..^.._fdlb..r.....V..:Y......imj...!^kW^)ww.....\|uF...I./\T.6M(a.@>..}.5.P.4......z..\.$.'.xB.(#%\...........U....9.5..A.C@.w.k...Z@...;......#'...9E.......YU.......`K.'..<..6......>..(5...4....L.?YkQ4E.M.....{....:.(Ol.E._V_.{..;7....C...tl6..k.F.! ...GG...q...=...{n.Z.....`~......!q.h..+.].[X....;...W..E..#6..O_...N.5.".\|;6u..O..:E..!D,qR..........?d.....}.o.1.O..5+.........1..y.......P..P.y.B_..,.~&.W.E.y.C5...S.h_.._.....d....C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_featuredmini_covid_workers[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6434
Entropy (8bit):	7.954124581619025
Encrypted:	false
SSDEEP:	192:mzk+y2dkt2syblinQG0y/3fEF9oggu2zGEURu4v6/R:wk+OPPnbR/3qgu2JUY5
MD5:	F7EC4D28454FEFEF4AE82FEF080FA7E0
SHA1:	4323D85803A1D3C5BC9DBCA43A958A0C53E4F13E
SHA-256:	921A6B0F4B51E2E25FBBB2B62505A29C1B4561D460967FD3958648B679652554
SHA-512:	6569B9316E97D919DAD4F393C8C3D5218819D4DBD9A56F9BD67D664C59EC69757470DF7E2A5C10B06D081EB2388FD4EC9B7873CEB93667B3CB51931DA34F6078
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-06/illustration_featuredmini_covid_workers.png
Preview:	.PNG........IHDR...............g-....pHYs...%...%.IR$.....IDATx..].p.U..'..QH0........."z..>....x...VQ...ej...R....U.,]wY......,..[...VA.e....L.A^..B0!...uN..N..c....j..L.......b......2.O>......U.......p.........\Ef...#T^.KD...^..~..."....>.j~$.5..A.P.F.."c..8..7..."..............l..k ..x.V..p=O#.......h.KKXFD...iI@&......,.x.....k..." ..@..=..5Z`..V...."m.....Z.c..P...".."..l.Z....#..m..G.K.Py.b..\#@%..z.&....\(...)O.U.)@> '..qJ.0T^Y...!.....q.)..Y..}.,.ilc.8....,..q4dk.{`..".Tp.SY.....T...!...{<.Z...1I..H....u.S.)...K....^.]M...5........"...v....Mu..D...a.Gu.M...}.....PTP.z.e......y..M.Qu]..T....J....k..XI........]1j=.3``...&..6......$`]cS...) ]...5..l:l>.i.?.I.......].......}.~..kv.}.....i....._.....^...Y...y...h_.........7.kO....).^.^^w........I...k.i}.A.i=.....c....C..~U........z.t...J.o......@BO..\|..??b....'g.u.\|...E..5).......<OB.....H".....d...R.x2..y.]w.p...7.a.*.i.zQ.....i...d...p.$........_.8)U..o...Y.z...Cr.I.qH........j..1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\illustration_hero_disasters_corona_2[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1188 x 881, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	45302
Entropy (8bit):	7.834642368168608
Encrypted:	false
SSDEEP:	768:Uj21tevchj6IcMsCt5hNr70Pb13Ox4FnE9ArG7rYgK48rbJIJ4POrab0Q/O8iTY4:71rN6pCUPbhOJqG7MgKnbJIJ4P2aYQmt
MD5:	1894AAD77DD21EEB2B27A227EE40100F
SHA1:	0D0A852DA34D89DBA3E5F5EA7BE0109CA0F330D2
SHA-256:	1A56D83240C5D36938A9255307D34ECC85E70A0379081DB17709394B51439386
SHA-512:	254C7540662EB073930A503969FF51E2F00E1F5B5D506F4A1ADA71E6398C47FAA9D0C8EA03591959F8D9CC8564C9F7EB88EA4337FD27BD2925BE3F158F21DD08
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/2020-07/illustration_hero_disasters_corona_2.png
Preview:	.PNG........IHDR.......q......wa.....pHYs...%...%.IR$... .IDATx...kl\.....e....lK.X....v'.^$@\S[%$....EC...La.}..V46.....f.........0..`.6..gv.H....r&q.....X.l..).d.E....?.Q...T..s..~..nd.9.).._....ommM.......a.........@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".......@...........)........@........".

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\query_string.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Pascal source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10915
Entropy (8bit):	5.165697591580398
Encrypted:	false
SSDEEP:	192:27svUtuikEpNoIAhKRvC9599MRvCI30C9mepCR23t5j5u59QyXB9P48LPCakJxkF:27/pAgpC9HepCI30C9mepC03iQqwbaka
MD5:	23CD1A00FECC861A6A8EF9E3A1EAA95C
SHA1:	46C7201F3AAC540BBC41AFD12B0DD3A0F98C16E3
SHA-256:	A538E11479B2D316C7316B0D2D86F99E4BABA3CC75883556482BFBF5A90AC19C
SHA-512:	A4DF8734142592B837629B2BE35C273A6CC72444D86253125BCBC9C8B78581FEB85361E74835C06B6F98184C71E3ED9E778D09220BD01EFC03AE3CE2A529D5D2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/query_string.min.js?v=1.x
Preview:	(function(){function r(e,n,t){function o(i,f){if(!n[i]){if(!e[i]){var c="function"==typeof require&&require;if(!f&&c)return c(i,!0);if(u)return u(i,!0);var a=new Error("Cannot find module '"+i+"'");throw a.code="MODULE_NOT_FOUND",a}var p=n[i]={exports:{}};e[i][0].call(p.exports,function(r){var n=e[i][1][r];return o(n\|\|r)},p,p.exports,r,e,n,t)}return n[i].exports}for(var u="function"==typeof require&&require,i=0;i<t.length;i++)o(t[i]);return o}return r})()({1:[function(require,module,exports){.'use strict';.const strictUriEncode = require('strict-uri-encode');.const decodeComponent = require('decode-uri-component');.const splitOnFirst = require('split-on-first');..function encoderForArrayFormat(options) {..switch (options.arrayFormat) {...case 'index':....return key => (result, value) => {.....const index = result.length;.....if (value === undefined \|\| (options.skipNull && value === null)) {......return result;.....}......if (value === null) {......return [...result, [encode(key, option

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\sourcesanspro-bold-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26040, version 2.45
Category:	downloaded
Size (bytes):	26040
Entropy (8bit):	7.9821543727670825
Encrypted:	false
SSDEEP:	768:nz+uUXMYhtpBaPnZ/di084wyO+ev3tRNl6TbZ:CdM6XQxM0DO+g336TbZ
MD5:	738B5FD59F27AFA7B332F0D228DDD531
SHA1:	EFC3A93BFE745D7F4C22C43D4CD15D2A3C805D22
SHA-256:	48406BAC7EBB5B06CA30657A669D330CF25EA052A8FFD801369FA792367A14A0
SHA-512:	90657F6B5E1365E5E9A2422027C7397FE034D6A8253BA205A5875689A0ACD230F37D32AD411FA665BCC464EA6AA5883A17F59916A901D3A7160C0163D86654B6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/fonts/source-sans-pro/sourcesanspro-bold-webfont.woff
Preview:	wOFF......e........D...-....................BASE..Pl...F...Fe.].GDEF..P....t........GPOS..Q(......9l.\|s.GSUB..c.........l.V.OS/2..A$...W...`\@r.cmap..A\|...n...v..f.glyf...D..8...e(L.5Ahead..=....6...6.w..hhea..A.... ...$....hmtx..=...........>.loca..:.........zK..maxp..9........ ....name..F..........V.post..I........2Unrmx..\|.`[G...'.m.,ff..m.l........a(.A.u..W.+.a......)...m.K.....8.~..k.$.........QyT7E.K....J.2JBQA.Ah..l&^4...d....y.tY...m....u...ML..qz...#.K..{..}.../Cg?.$g...$....)J...V.)?.#..L@yF..bU1...._....;j..._...I_L.:....)....T..!...X.`@...y..o....p.j2.7....{ .pV.Dc.<.J.m...wiR.W_)......@.:MV}z.B......'..Q..3Z..P$..d<..d.....&.Gc.?....7......-..f{B...o.j..k{..q.&0^.t.Y1:I.D.v......c.m@...~j.=.'=.>...BM.j.~..M......a.s.RD.Fb..%&x.@.._.>.J.];..~....Q.........~....q\|....Z.\|.e..6....\|.f....=CM.....g....._...{L.C.q.v.......oI.f.f......J.@...wL..w......>.....2%...$...........=....dF.-.2...(.....e~..1...WU....u.tGb*N1.WC]~.fP..L...c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\stacktable[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	downloaded
Size (bytes):	8219
Entropy (8bit):	4.688120544793996
Encrypted:	false
SSDEEP:	192:kGom6O2ZnApLNCNSuu2TIvm5YZVNpbNLuNt++C9DULb5y3PY0CRhMpv:khRA7yY5raHN/Ra1
MD5:	5CBC0BA1DFDE182C4697BF2B67901536
SHA1:	FAEF6BA9C210A3C6FE582AD5DFCA42831587FC50
SHA-256:	58EE289CC3B0E66D80A8860AB61C78B003B2794A2B01059F5E5A1D6DA47E7327
SHA-512:	374C053291774999F83B7F1E773BEE5F9E914CAAEDA53CC62D38DD3BF23F5BA8EB907DBA6DFC44423ADF8605B970F4EC5747EB2654B44C643672F823C37C6BBC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/js/stacktable.js/stacktable.js?v=1.x
Preview:	/*. stacktable.js. * Author & copyright (c) 2012: John Polacek. * CardTable by: Justin McNally (2015). * MIT license. . Page: http://johnpolacek.github.com/stacktable.js. * Repo: https://github.com/johnpolacek/stacktable.js/. . jQuery plugin for stacking tables on small screens. * Requires jQuery version 1.7 or above. . /.;(function($) {. $.fn.cardtable = function(options) {. var $tables = this,. defaults = {headIndex:0},. settings = $.extend({}, defaults, options),. headIndex;.. // checking the "headIndex" option presence... or defaults it to 0. if(options && options.headIndex). headIndex = options.headIndex;. else. headIndex = 0;.. return $tables.each(function() {. var $table = $(this);. if ($table.hasClass('stacktable')) {. return;. }. var table_css = $(this).prop('class');. var $stacktable = $('<div></div>');. if (typeof settings.myClass !== 'undefined') $stacktable.addClass(settings.myCl

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\twitter_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	731
Entropy (8bit):	4.32075516554521
Encrypted:	false
SSDEEP:	12:t41jrfVllLWiHGllL3553+DY+Qcmv71JZQJL2pJ9bt0SGrlHXv/NvC:t41jT7Olx3554ZQcmD7ZQl2pJ9beSGpk
MD5:	D884FA68D9BB0F23163953AA5C26EDD9
SHA1:	D9F55E6C8DB66080DD6C351B4AEA472700032175
SHA-256:	08A3B7D9839A2300FEE8002C8DE58B54090D16C6694CD513C3CC1BEDF9FC78D0
SHA-512:	565D87D501B87403936E6B4E95482BC03CC474C5F757BF5750BC0B5B81C30318D0EDE4CF1FF180183123168E5C96EC17146AF6C06DBE40DCC82E0373DAF8A20C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/twitter_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>twitter_white</title><g id="twitter"><path d="M25,0A25,25,0,1,0,50,25,25,25,0,0,0,25,0ZM37.563,20.259c.012.25.012.513.012.775,0,7.963-6.062,17.15-17.15,17.15a16.793,16.793,0,0,1-9.213-2.725,10.95,10.95,0,0,0,1.438.087,12.116,12.116,0,0,0,7.487-2.575,6.018,6.018,0,0,1-5.625-4.188,5.747,5.747,0,0,0,1.137.113,6.009,6.009,0,0,0,1.588-.212A6.034,6.034,0,0,1,12.4,22.771V22.7a5.92,5.92,0,0,0,2.725.75,6.024,6.024,0,0,1-1.875-8.037,17.1,17.1,0,0,0,12.425,6.3,5.527,5.527,0,0,1-.162-1.375,6.031,6.031,0,0,1,10.425-4.125,12.207,12.207,0,0,0,3.825-1.462,6.024,6.024,0,0,1-2.65,3.337,12.233,12.233,0,0,0,3.463-.95A12.352,12.352,0,0,1,37.563,20.259Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\u-440qyriQwlOrhSvowK_l5-fCZK[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23600, version 1.1
Category:	downloaded
Size (bytes):	23600
Entropy (8bit):	7.973583674109776
Encrypted:	false
SSDEEP:	384:OMPViqjFD/7v1VG9bCaNwTTRz10p2dF5rnmaMfmF1tKIYFwWajBob/T670WyDLrx:hNdjhRV0bCaNwvRz10pAF5CaMfm8Iqjj
MD5:	69F09800F4F6479D06E44EBA837DF872
SHA1:	5C889B1BEE3D4E75A5FC0749617A15C0E6922072
SHA-256:	8E0F8D862D80DB8B358C03FCCD1FCEB993DEA6A22569620BCD0959806D3D1D12
SHA-512:	1EFFE91D2A3BC1C6442E9B8012EA6806AAB60FCCFB1947F011E281170FE8070FFA5B9E6096363B2B3908C8BCF0D49AF3DDD1BF004E87438B6F0C450FE968F105
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff
Preview:	wOFF......\0.......t........................GDEF.......S...p....GPOS....... ... DvLuGSUB............s.e.OS/2.......O...`U.Kcmap............j,.\|cvt .......8.....~.lfpgm.......F...mA..\|gasp...(............glyf...0..F...y.e.a.head..S....6...6.).7hhea..SL... ...$....hmtx..Sl...c....VG(.loca..U.........b.C.maxp..W.... ... .g.pname..W........r:.Q.post..Y....~.....yujprep..[.........Z.,.x...........'@T7H.....$ AJ...`f...<.......V.vy.QN..........>...Q.m..y.2...k................DFLT................x...n-Q...am.Fp}.k.m.m....A.2.de.d...~.lc..,..8.v.;F...O.Q}......X^..NY(b.O....o>....[7.+e..#.O..\|...../...[...M..T..pH$....D6.T..#....6.O...Sc..R..Z..F>..Q.....,E..O._..hy....V\|.\|x...f..b.X+6?x~...:Z..1b..'z".+Z.-:.O......`..a...l...I3V@....L.....Xj.U;.bG#1.t\|.....Q.7....O.2.....J.........3<R....q..x...!.........K..o#&g.....UL.....}..d..#.L.u^..p..\|....v.....S.s..C...k.3.^.6......s+`..A.x.c`a..8.......).....B3.1.1...@)8`.b&.'8.Y......(.....X4...........)..f..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\u-4n0qyriQwlOrhSvowK_l52xwNZWMf8[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 23260, version 1.1
Category:	downloaded
Size (bytes):	23260
Entropy (8bit):	7.976160585728166
Encrypted:	false
SSDEEP:	384:Bv0MPVryqjFD/7v15tcgxwkH5+WVPgq7FGj2mQf4MBpgt3Re+X8NM7v/9J9PJ3sN:tzNRjhRAG5f+2I2my4YmtMNNMrL9pssC
MD5:	BA56EA84B8084B7FF9677F50D3CD81BD
SHA1:	799C0C07912F6996B80459937AC097813B6B461C
SHA-256:	649C6472A611C5BCFEBB341109E5754F205EE57550F5614577C6B6CB963D17AE
SHA-512:	724487602C085EBA3D79D74A40BFF75A3123241CAE759A27D21430813C0ED6D90899E826A7BE49FBABCD8586DD08DB76D86BB9BE4C8FD9B284AB747727A0A299
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff
Preview:	wOFF......Z........p........................GDEF.......S...p....GPOS....... ... DvLuGSUB............s.e.OS/2.......P...`W..8cmap............j,.\|cvt .......<........fpgm.......F...mA..\|gasp...,............glyf...4..E...uD...head..Q....6...6.M.7hhea..Q.... ...$....hmtx..R...._...._B".loca..T\|.........`..maxp..V.... ... .g.oname..V........Z7.O.post..W....~.....yujprep..Z<........Z.,.x...........'@T7H.....$ AJ...`f...<.......V.vy.QN..........>...Q.m..y.2...k................DFLT................x...n-Q...am.Fp}.k.m.m....A.2.de.d...~.lc..,..8.v.;F...O.Q}......X^..NY(b.O....o>....[7.+e..#.O..\|...../...[...M..T..pH$....D6.T..#....6.O...Sc..R..Z..F>..Q.....,E..O._..hy....V\|.\|x...f..b.X+6?x~...:Z..1b..'z".+Z.-:.O......`..a...l...I3V@....L.....Xj.U;.bG#1.t\|.....Q.7....O.2.....J.........3<R....q..x...!.........K..o#&g.....UL.....}..d..#.L.u^..p..\|....v.....S.s..C...k.3.^.6......s+`..A.x.c`a.........).....B3.1.1.2.......1.........AI......,.......ArL:L....3.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\uswds.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	24790
Entropy (8bit):	5.28735236798167
Encrypted:	false
SSDEEP:	384:YjXVWEnRI6eqcL7P5Vmm7QctEpiQtgBK+lHnyELkRUJ:YJWQRIKcLr5VrfGiR6Y
MD5:	1D38B965D51F8EBA4CD4542FC1115059
SHA1:	D8F7E45232733805EFB13CEB5DC55BC8BEB5BB9A
SHA-256:	9ACC5EA0D590FD2EB34A6D8F7421A5A15378F73F9BC05FCBB29958E392FE86B7
SHA-512:	9BD61A184AE7B6DD8ECD7CAB7A9B37423440D318F5F800CA3C827FDDCCBB4872315CFD9A71590E28FC674F64A125189B1BC6E0F50CCF4A2AB9774B397C7872D9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/assets/js/uswds.min.js?v=1.x
Preview:	!function i(u,c,a){function s(e,t){if(!c[e]){if(!u[e]){var n="function"==typeof require&&require;if(!t&&n)return n(e,!0);if(f)return f(e,!0);var r=new Error("Cannot find module '"+e+"'");throw r.code="MODULE_NOT_FOUND",r}var o=c[e]={exports:{}};u[e][0].call(o.exports,function(t){return s(u[e][1][t]\|\|t)},o,o.exports,i,u,c,a)}return c[e].exports}for(var f="function"==typeof require&&require,t=0;t<a.length;t++)s(a[t]);return s}({1:[function(t,e,n){"use strict";"document"in window.self&&("classList"in document.createElement("_")&&(!document.createElementNS\|\|"classList"in document.createElementNS("http://www.w3.org/2000/svg","g"))\|\|function(t){if("Element"in t){var e="classList",n="prototype",r=t.Element[n],o=Object,i=String[n].trim\|\|function(){return this.replace(/^\s+\|\s+$/g,"")},u=Array[n].indexOf\|\|function(t){for(var e=0,n=this.length;e<n;e++)if(e in this&&this[e]===t)return e;return-1},c=function(t,e){this.name=t,this.code=DOMException[t],this.message=e},a=function(t,e){if(""===e)throw

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\youtube_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	500
Entropy (8bit):	4.758719016843956
Encrypted:	false
SSDEEP:	6:tI9mc4sl3QQCmRDxQL2WwVHDqbUbHW7aWwerVQtXJEPusWiKuXAVWiqGo2E9TdRS:t41jtFxQFwY7dwY6pam3lOA84o9KGbC
MD5:	B56886C59F611D5CAB56286BEDCA22F3
SHA1:	415E0DE7BDBB5C6AC4B82F4DA9D118AA7D802100
SHA-256:	7B0214207905F9255AAB6E20D50C164730BD4BB08DB3C7D1D3CA145E1F9BE6F8
SHA-512:	18AF77AA8F1665C46D8E48B12EF627A3BBD65DD5DFD9B07B2716EAFD6DA26EEFD3C53BAC11C3F9B7AD733DE72B3D5579A79889AEA3C9BDB81EB2C9760BAC208B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/youtube_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>youtube_white</title><g id="youtube"><path d="M48.955,12.887a6.283,6.283,0,0,0-4.421-4.449C40.635,7.386,25,7.386,25,7.386s-15.635,0-19.535,1.052a6.283,6.283,0,0,0-4.421,4.449C0,16.812,0,25,0,25s0,8.188,1.045,12.113a6.283,6.283,0,0,0,4.421,4.449C9.365,42.614,25,42.614,25,42.614s15.635,0,19.535-1.052a6.283,6.283,0,0,0,4.421-4.449C50,33.188,50,25,50,25S50,16.812,48.955,12.887ZM19.886,32.434V17.566L32.955,25Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\877b02039c[4].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\covid_banner_option_04-14-2021[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, progressive, precision 8, 2000x498, frames 3
Category:	downloaded
Size (bytes):	142763
Entropy (8bit):	7.9873581865725445
Encrypted:	false
SSDEEP:	3072:jeDPBUSOOUXEYsfv7sS7MhW881Cytr7jIXBpDeGjhCm6tbwl:je7iS2Xu7sS7MhACyt/jIXth4bwl
MD5:	482EA8334641DCE176EAD911CC42042B
SHA1:	B9C75ECD923CAA7135BDFD484299EE603F864254
SHA-256:	A07DA38E1FA8ECFFBC9F2A4F61817D9D1226C614BC85BF8EB463DBC1F60E0437
SHA-512:	D946B60D487347B550555B464F0BB4C75BFF4741A9AD39E54DB76ECF187E600D845C68EDEAFEDDE0CB73FB6AF827D2E23D46BF01DD6327907145DF5BE59BB74C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/home-page-hero-images/2021-04/covid_banner_option_04-14-2021.jpg
Preview:	......JFIF.....H.H.....C................................... $.' ",#..(7),01444.'9=82<.342...C...........2!.!22222222222222222222222222222222222222222222222222..........."................................................................................}....n').G.p"..D..\Og..?s..3G8=..+...:>]c.j.F..5.....-.)O.$.\n...:.s..?~<....m....i.._e:./.[..\M+.JY....%.Y.ft.X.&.'K.rto.c.J:..y.....$..f]....[..7O.t..Z..6@.+L2 ..wJ....%..O...U....x.9..+.L...h..B.4.5G.e...,j9.!..E.A..UT.E.QQ..#..+A.Oy..oK.b..j..u..5....t.K#$.'.,.\|N2...t....T!Qc...<=..3....<3.<;.s...x...9l.V.5!.J..@.1.....EV.E.....rG....2..\|..{7...~..o.......... ,rDe.+..je.o<..M.....M...t.._..1H..~J..f%.Q..m.[.N,....b.^.=..y...h.d\|...wL<.......3.._[.H..\..zvY.G......9..i.ko../........}=..Y..m.J..F-..=x.&....S............K.Y....G..:.M]N.O..J.[..RY.%K..5os....,.2n.=.5..c..}c..f=..vN.l...ZEji.p...s..o(..s../.........K<.#.z.3.5........J....FH..@...%z.. .zJ..FH$J.i(.+....V.j."$...`.`.`.#$.....1$.....m..L.N.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	911
Entropy (8bit):	5.180032150665888
Encrypted:	false
SSDEEP:	24:5AOYNZGL78AOYsZn9AOYXZG38AOYUTZGR88AOYN7ZG7K:eOWwLjOLUOgwXOxTw+OCwG
MD5:	6559984CF35A95A1F3567F4903E47716
SHA1:	6651235A71D4F95AACBA18BBADBC5E7B08017A3D
SHA-256:	5874DEC01627A418A8167969C6B2715778231B523B028CC6F769C764A98ACEAA
SHA-512:	FAF0ED047ABEB1FAB00688C3586CA457C93B21ADAC29C57228490912BE5ED25BA2DD100652A31F701F3F1CA4B6E435F628CA5765142C8DE9463BCAD4D27A16E1
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLDz8Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiEyp8kv8JHgFVrJJfedA.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 500;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLGT9Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLEj6Z1xlEw.woff) format('woff');.}.@font-face {. font-family: 'Poppins';. font-style: normal;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/poppins/v15/pxiByp8kv8JHgFVrLCz7Z1xlEw.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	1350
Entropy (8bit):	5.207717462695661
Encrypted:	false
SSDEEP:	24:570OY7aTr70OYN0aTF7QMcOYRaocOY7a3cOYUMa0wcOYN0aJ:h0OEaTv0OpaTiHO6azOEaMOxMaeOpaJ
MD5:	DC937CE964861F42AFFF746D52B20397
SHA1:	E2100D1055B7D3ECDFD6A4FA445F5238D1B404C4
SHA-256:	3137EB35363EB5CE777F598A8AE67330143D6863CD5876C1E3DD40C6D407F563
SHA-512:	A86E1DD8070F5F58FC5FF420EDC4C5AE9959A4A4AFC2BEC8FD6DB0B2BC99A4EDAB54F606F2A02FA70BBF6E62206B7DFF8E5FAC28F9042F4175A4FBEDDD720407
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v22/u-440qyriQwlOrhSvowK_l5-fCZK.woff) format('woff');.}.@font-face {. font-family: 'Merriweather';. font-style: normal;. font-weight: 700;. font-display: swap;. src: url(https://fonts.gstatic.com/s/merriweather/v22/u-4n0qyriQwlOrhSvowK_l52xwNZWMf8.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 200;. font-display: swap;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xKydSBYKcSV-LCoeQqfX1RYOo3i94_wlxdo.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 400;. font-display: swap;. src: url(https://fonts.gstatic.com/s/sourcesanspro/v14/6xK3dSBYKcSV-LCoeQqfX1RYOo3qOK7j.woff) format('woff');.}.@font-face {. font-family: 'Source Sans Pro';. font-style: normal;. font-weight: 600;. font-display: swa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	548509
Entropy (8bit):	5.129798976537864
Encrypted:	false
SSDEEP:	3072:nm3W02v34Es0HpLA9+hX+QNryA4l6T7k7AXf7b:nm3W02v34Es0HpLA9+hX+QNryAP/f
MD5:	E727F3D89EF6D7E857E883D8CC5C8EF0
SHA1:	CCE8E1207B4BCEF1EA31E77AAD7C8448430E1108
SHA-256:	D13C940E46291844FB810B4CC73757DFF7A2B2CED2CFC8CA4D5AFF8B9CD274F7
SHA-512:	448E5418F953FDB4FD9A7787CD82FC5F954D5BDB230D8E236A5AC909CC3DE76A75A36A6C1B78B8EB37EEF7E7E83310F94F4F7A8C50E4E393054D862BDEAEBAD5
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_0TyUDkYpGET7gQtMxzdX3_eiss7Sz8jKTVr_i5zSdPc.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);.messages{padding:15px 20px 15px 35px;word-wrap:break-word;border:1px solid;border-width:1px 1px 1px 0;border-radius:2px;background:no-repeat 10px 17px;overflow-wrap:break-word;}[dir="rtl"] .messages{padding-right:35px;padding-left:20px;text-align:right;border-width:1px 0 1px 1px;background-position:right 10px top 17px;}.messages + .messages{margin-top:1.538em;}.messages__list{margin:0;padding:0;list-style:none;}.messages__item + .messages__item{margin-top:0.769em;}.messages--status{color:#325e1c;border-color:#c9e1bd #c9e1bd #c9e1bd transparent;background-color:#f3faef;background-image:url(/core/misc/icons/73b355/check.svg);box-shadow:-8px 0 0 #77b259;}[dir="rtl"] .messages--status{margin-left:0;border-color:#c9e1bd transparent #c9e1bd #c9e1bd;box-shadow:8px 0 0 #77b259;}.messages--warning{color:#734c00;border-color:#f4daa6 #f4daa6 #f4daa6 transparent;background-color:#fdf8ed;background-image:url(/core/mis

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\css_wFl6wWXW8mkSBb9CnCjEnU5hRiydLO04gAYNaYjfXQI[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	87121
Entropy (8bit):	5.029133083621057
Encrypted:	false
SSDEEP:	1536:wrlXMXd+AwljF+vg7LD81XaFKvrfefa2J:Z+AwljF+vg7LDafefD
MD5:	ED4D08CCF426727EB06D19BC2E3B42BA
SHA1:	1275B491BF0BBFED437800E48CC4BB6D8C21DEFA
SHA-256:	C0597AC165D6F2691205BF429C28C49D4E61462C9D2CED3880060D6988DF5D02
SHA-512:	3301285FD100077D303C31990F0D5B07EB5429F955AB18BD490D35EB162A59B3DF559A5E4FA3C54B3E8AD8BFB3D0538B9647F358BBEB22FBE173445FAFEB2ADD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/sites/default/files/css/css_wFl6wWXW8mkSBb9CnCjEnU5hRiydLO04gAYNaYjfXQI.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);@import url(https://fonts.googleapis.com/css?family=Poppins:300,400,500,600,700);html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%;}body{margin:0;}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block;}audio,canvas,progress,video{display:inline-block;vertical-align:baseline;}audio:not([controls]){display:none;height:0;}[hidden],template{display:none;}a{background-color:transparent;}a:active,a:hover{outline:0;}abbr[title]{border-bottom:1px dotted;}b,strong{font-weight:bold;}dfn{font-style:italic;}h1{font-size:2em;margin:0.67em 0;}mark{background:#ff0;color:#000;}small{font-size:80%;}sub,sup{font-size:75%;line-height:0;position:relative;vertical-align:baseline;}sup{top:-0.5em;}sub{bottom:-0.25em;}img{border:0;}svg:not(:root){overflow:hidden;}fig

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\disaster-responses[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	90777
Entropy (8bit):	4.3671936403243405
Encrypted:	false
SSDEEP:	1536:JltYqJ6G+mF8rtD0m2/LcFTNQh840ljCXPD5Az1PJl9zQFGcQ8TlP3GVSB2nxEPu:Tq/BShFAz1PJl9zQFGcQ8TlP3GVSB2np
MD5:	12B007A36E8C99106B62A6ED34255681
SHA1:	29AB4391815E8882558B366226EED10590CD66FD
SHA-256:	65F221D7B4D0BF26A4DC1E1B118831BE7982C606E3E8F1C9EEDAF45B9BA687AD
SHA-512:	0525A4059A68312B90F4E975D8579CC7F5992FAC2EB679503541B6F1F6ED3BF7169A3541A12D9CB79D3FC66E5901CC52F751C01AFDCEA43FEC916DF3A04D5896
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/disaster-responses
Preview:	<!DOCTYPE html>.<html lang="en" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\effect-min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	16816
Entropy (8bit):	5.357184455434572
Encrypted:	false
SSDEEP:	192:5vTeXBVAInxCBhjX2sjhlStCsbiXcWzNvwu2LqQ6uZWs74:5vKXBVAWxC3jmQCCsbQ5IdGs74
MD5:	86F1E6B37CFAF2786F58619B88778717
SHA1:	96975EB34AA586AD9FA48C6F994A4AD2D87A0C60
SHA-256:	252B076ABB37EC8CEE93AA75EE776C45E01515D8361A9BAE2341EDFE02D875F7
SHA-512:	756F0D67A468BA5DAF96420DCFE493383A26833A392336180C1D2194190E995C409AD778A87429E0C84C41F77968852A4C0B0A239B473EF77A9BDEF03BDB1891
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/core/assets/vendor/jquery.ui/ui/effect-min.js?v=1.12.1
Preview:	/! jQuery UI - v1.12.1 - 2017-03-31. http://jqueryui.com.* Copyright jQuery Foundation and other contributors; Licensed /.!function(a){"function"==typeof define&&define.amd?define(["jquery","./version"],a):a(jQuery)}(function(a){var b="ui-effects-",c="ui-effects-style",d="ui-effects-animated",e=a;return a.effects={effect:{}},function(a,b){function c(a,b,c){var d=l[b.type]\|\|{};return null==a?c\|\|!b.def?null:b.def:(a=d.floor?~~a:parseFloat(a),isNaN(a)?b.def:d.mod?(a+d.mod)%d.mod:0>a?0:d.max<a?d.max:a)}function d(b){var c=j(),d=c._rgba=[];return b=b.toLowerCase(),o(i,function(a,e){var f,g=e.re.exec(b),h=g&&e.parse(g),i=e.space\|\|"rgba";if(h)return f=c[i](h),c[k[i].cache]=f[k[i].cache],d=c._rgba=f._rgba,!1}),d.length?("0,0,0,0"===d.join()&&a.extend(d,f.transparent),c):f[b]}function e(a,b,c){return c=(c+1)%1,6c<1?a+(b-a)c6:2c<1?b:3c<2?a+(b-a)(2/3-c)6:a}var f,g="backgroundColor borderBottomColor borderLeftColor borderRightColor borderTopColor color columnRuleColor outlineColor textD

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\extlink[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	12131
Entropy (8bit):	4.989656129321139
Encrypted:	false
SSDEEP:	192:0ylfDS8TGQagunKkuiCqIryXJaBFagUdar/vAyKYUVuh9W+z2TxkRng7uKOmKaeF:5GxLKTaSnPuy82P1wVtO
MD5:	8D9C6B70088EF032B791015028A993A4
SHA1:	148F6DA696C868AB9DD2D3AEFE9C7B5BCEF16614
SHA-256:	2541237FEFFE96F5FB2CFEDE3F77B8B13CF8E72E0D70C1F7017D303C743CCBAB
SHA-512:	15CC9545BCA93786907DFCA0DB353805615D80D50BB22012EEEB9AAFA5B7511D17884E39ABC3ED78E1D395D2CA371E51B51F8D0B2DEE13E55D3BF13851296735
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/modules/baseline/contrib/extlink/extlink.js?v=8.9.13
Preview:	/*. @file. * External links js file.. /..(function ($, Drupal, drupalSettings) {.. 'use strict';.. Drupal.extlink = Drupal.extlink \|\| {};.. Drupal.extlink.attach = function (context, drupalSettings) {. if (!drupalSettings.data.hasOwnProperty('extlink')) {. return;. }.. // Define the jQuery method (either 'append' or 'prepend') of placing the. // icon, defaults to 'append'.. var extIconPlacement = 'append';. if (drupalSettings.data.extlink.extIconPlacement && drupalSettings.data.extlink.extIconPlacement != '0') {. extIconPlacement = drupalSettings.data.extlink.extIconPlacement;. }.. // Strip the host name down, removing ports, subdomains, or www.. var pattern = /^(([^\/:]+?\.))([^\.:]{1,})((\.[a-z0-9]{1,253})*)(:[0-9]{1,5})?$/;. var host = window.location.host.replace(pattern, '$2$3$6');. var subdomain = window.location.host.replace(host, '');.. // Determine what subdomains are considered internal.. var subdomains;. if

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\facebook_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	353
Entropy (8bit):	5.077371229316119
Encrypted:	false
SSDEEP:	6:tI9mc4sl3QQ5CRWbr44LStdasvU3kclETLYhUo9eCCUsE72TMcGHpAZQtGyJAC:t41jgl4LSt5U3a0HEbUwMcGHOZAGjC
MD5:	F03CE1FECA3D42A0322E7E6A6A0597CD
SHA1:	AEA0F9FC7D7293658C2A1246DB0D8ED1BCA9DE82
SHA-256:	2F7113793C5D5FD6B38E7BAB63CA5D88FF29EDB32DB7AD519E9746414A1A697A
SHA-512:	608468EA1E48920DCBD131B7A29195A4F18F116AB949FB1D1F81D3689CCE47FFC16706E8ACB2E83883107B4201E9B2EF68BDA66A6435342F8F19F75CCABC6364
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/social-icons/facebook_white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><title>facebook_white</title><g id="facebook"><path d="M25,0a25,25,0,0,0-3.906,49.7V32.227H14.746V25h6.348V19.492c0-6.266,3.732-9.727,9.443-9.727a38.444,38.444,0,0,1,5.6.488v6.152H32.98c-3.106,0-4.074,1.927-4.074,3.9V25H35.84l-1.108,7.227H28.906V49.7A25,25,0,0,0,25,0Z" fill="#fff"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\funeral-assistance[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	100319
Entropy (8bit):	4.600868461164398
Encrypted:	false
SSDEEP:	3072:Tq/IINJa/ozAz1HPJl9zQFGcQ8TlP3GVSB2nxv8A:Tqj+
MD5:	6FE0729A35259029E929C470F870D97D
SHA1:	CE3A63F05610CC73ABB6C448C0F3225DDAB2FD96
SHA-256:	507E7366AE858096AE497F2F40701BADF96AA956EE05CD8813EB6C3E74DC8018
SHA-512:	43C5F5FEA4CC4454A47C2758F3EB6431C2549AE365DBE2A9D34AA92269D6C0983A9736FD6751DDC952F9EDC58A2A1A008CAB68F6229B20D910367740E23C4B6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/zh-hans/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="zh-hans" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\funeral-assistance[2].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	102295
Entropy (8bit):	4.508877639155757
Encrypted:	false
SSDEEP:	3072:9q/zPyQUTSxiaTAz1oPJl9zQFGcQ8TlP3GVSB2nxv8A:9qrPh
MD5:	60CE39905A668CB4C247607759A06367
SHA1:	C2BDE796E0493AA9EA5872583467EC825812AB84
SHA-256:	36AD0777AFCA6CD84F05302BF8193116105B6C41CB339D402750CF4322B8B799
SHA-512:	C51302725E17E81506A5C317F63DF42FA877A27D019A0FCCB66EE657DB5C81CD98B8C5FD8C0DB0FB1762380E208AD0147EAA4586E58D6ACDCF9CB099EA67F8C8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/vi/disasters/coronavirus/economic/funeral-assistance
Preview:	<!DOCTYPE html>.<html lang="vi" dir="ltr">. <head>. <meta charset="utf-8" /><script type="text/javascript">(window.NREUM\|\|(NREUM={})).loader_config={licenseKey:"877b02039c",applicationID:"140456369"};window.NREUM\|\|(NREUM={}),__nr_require=function(e,t,n){function r(n){if(!t[n]){var i=t[n]={exports:{}};e[n][0].call(i.exports,function(t){var i=e[n][1][t];return r(i\|\|t)},i,i.exports)}return t[n].exports}if("function"==typeof __nr_require)return __nr_require;for(var i=0;i<n.length;i++)r(n[i]);return r}({1:[function(e,t,n){function r(){}function i(e,t,n){return function(){return o(e,[u.now()].concat(c(arguments)),t?null:this,n),t?void 0:this}}var o=e("handle"),a=e(7),c=e(8),f=e("ee").get("tracer"),u=e("loader"),s=NREUM;"undefined"==typeof window.newrelic&&(newrelic=s);var d=["setPageViewName","setCustomAttribute","setErrorHandler","finished","addToTrace","inlineHit","addRelease"],p="api-",l=p+"ixn-";a(d,function(e,t){s[t]=i(p+t,!0,"api")}),s.addPageAction=i(p+"addPageAction",!0),s.setCur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\icon_pdf[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 41 x 41, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	668
Entropy (8bit):	7.482374070784684
Encrypted:	false
SSDEEP:	12:6v/7LnOJQuuLvSNDwM3fGb2nfIZ3/cKK+uvsB2OtjGDlRn/DheiIgVJ4:eOJtKvSx3gOImKK+MsFGD/Dheitn4
MD5:	A9AA48BA3EE6C644A53FA0007EB8533E
SHA1:	33581A5EA5438B06EF224F06528E875E4D58446F
SHA-256:	811FA84C912B5A3F1D125312E35B3CC7583FCBCE2382008352AF3EDE0ED2EBB0
SHA-512:	A75C1C9B3229EE8C452BA503BFF2B87D3524BED41E281E9B560E49084BB5DAC530611B29F9FC72C0D04C679D3075164E2E7F3F203675C4FC635D48176360FC5C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.fema.gov/profiles/femad8_gov/themes/fema_uswds/images/icon_pdf.png
Preview:	.PNG........IHDR...)...)......`......pHYs...%...%.IR$....NIDATX..X.q.0.Us./...`.0...t.f.lPFH7`....LP.L..Sq.Fv..&..w`.....;D.H...Z..b..`H.[..{..F.$..I=.........zF.+...C. ..J....C_..S.....N....!..66..h...E....^..d...Dt............G.o.Kn..w.{N...T........* ..f.}z.U#=&...1U..UP.........IT.bIr.....,..u..?./..&........A.!.........2.......9.<."..w.uE{!.y..\|\|GJ.b..D~`.Z".:Hq.F.R..d.d,w...d.>x%..1{k.P.Q.Z..T.L6+%$7L_I.....-.X.7.)..m......{)2...EH......H..".C..HM....Ern...."...-.R.X.]...F..!}.$.......o...E4..Wpv...!}.&..G.&.>...H...X...Q...xq....$.D.....%.&..U..piq..9.......7.rs.`..'...\zJ.W].#V4qEQ..HU.M...IY&..{m..k.....LB..w.....IEND.B`.

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2021 12:49:41.650415897 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.651741028 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.690875053 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.691005945 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.691610098 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.692114115 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.692208052 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.692823887 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.731895924 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732342005 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732381105 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732419014 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.732429028 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.732481956 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.732495070 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733278990 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733419895 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733469009 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733489037 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733510971 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.733534098 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.733568907 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.734718084 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.734806061 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.735344887 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.735420942 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.745980024 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.746469975 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.746598005 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.747000933 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.751652002 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787264109 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787292004 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787327051 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787364960 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787571907 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787669897 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787682056 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787697077 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787723064 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.787740946 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787763119 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.787787914 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788614988 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788656950 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788686991 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788693905 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788702965 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788743973 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.788748026 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.788798094 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.789680004 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.789738894 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.791984081 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.792025089 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.792069912 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.817814112 CEST	49741	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.823649883 CEST	49742	443	192.168.2.4	13.32.25.62
Apr 16, 2021 12:49:41.858396053 CEST	443	49741	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:41.865735054 CEST	443	49742	13.32.25.62	192.168.2.4
Apr 16, 2021 12:49:43.819807053 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.820777893 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.873740911 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.873900890 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.874368906 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.874543905 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.875543118 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.876821041 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.927963972 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928335905 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928354979 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928369999 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.928411961 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.928457022 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.928930998 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929337978 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929358959 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929373980 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.929425955 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.929460049 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.940525055 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.941431999 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942027092 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942250013 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.942437887 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993364096 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993408918 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993479013 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993516922 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993825912 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993896961 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.993916035 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.993993998 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994436026 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994467974 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.994505882 CEST	443	49753	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.994609118 CEST	49754	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.994648933 CEST	49753	443	192.168.2.4	74.125.140.154
Apr 16, 2021 12:49:43.995309114 CEST	443	49754	74.125.140.154	192.168.2.4
Apr 16, 2021 12:49:43.995407104 CEST	443	49754	74.125.140.154	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 16, 2021 12:49:31.836177111 CEST	53	49257	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:32.116338968 CEST	62389	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:32.165350914 CEST	53	62389	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:33.109535933 CEST	49910	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:33.162635088 CEST	53	49910	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:34.147094965 CEST	55854	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:34.198741913 CEST	53	55854	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:35.264157057 CEST	64549	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:35.313461065 CEST	53	64549	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:37.013514996 CEST	63153	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:37.062258959 CEST	53	63153	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:39.740586042 CEST	52991	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:39.805598974 CEST	53	52991	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:40.821105957 CEST	53700	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:40.881500959 CEST	53	53700	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.452179909 CEST	51726	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.521622896 CEST	53	51726	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.583909035 CEST	56794	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.643265009 CEST	53	56794	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.673877954 CEST	56534	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.723695040 CEST	53	56534	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:41.940026999 CEST	56627	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:41.960547924 CEST	56621	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:42.000262976 CEST	53	56627	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:42.017704964 CEST	53	56621	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.701103926 CEST	63116	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:43.725138903 CEST	64078	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:43.749593973 CEST	53	63116	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.795666933 CEST	53	64078	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:43.995332003 CEST	64801	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.015399933 CEST	61721	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.023281097 CEST	51255	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:44.045562029 CEST	53	64801	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:44.072519064 CEST	53	61721	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:44.091254950 CEST	53	51255	8.8.8.8	192.168.2.4
Apr 16, 2021 12:49:58.924324036 CEST	61522	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:49:58.984334946 CEST	53	61522	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:02.706779003 CEST	52337	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:02.756808996 CEST	53	52337	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:03.930140018 CEST	55046	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:03.987736940 CEST	53	55046	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:09.811964035 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:09.852564096 CEST	49285	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:09.861752987 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:09.914652109 CEST	53	49285	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:10.713376045 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:10.773519993 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:10.821856022 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:10.870717049 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:11.725521088 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:11.779591084 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:11.826534033 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:11.875241995 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:12.783030033 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:12.834628105 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:13.856408119 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:13.905253887 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:14.946597099 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:15.000122070 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:16.685909033 CEST	60875	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:16.739510059 CEST	53	60875	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:17.861408949 CEST	49612	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:17.911900997 CEST	53	49612	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:18.008429050 CEST	56448	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:18.057079077 CEST	53	56448	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:18.943389893 CEST	50601	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:18.994993925 CEST	53	50601	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:19.225620985 CEST	59172	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:19.274573088 CEST	53	59172	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:20.483397007 CEST	62420	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:20.532124996 CEST	53	62420	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:21.586327076 CEST	60579	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:21.634908915 CEST	53	60579	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:22.603677988 CEST	50183	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:22.667221069 CEST	53	50183	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:25.915914059 CEST	61531	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:25.966175079 CEST	53	61531	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:27.592505932 CEST	49228	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:27.642458916 CEST	53	49228	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:29.001718998 CEST	59794	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:29.050465107 CEST	53	59794	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:31.470613956 CEST	55916	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:31.519362926 CEST	53	55916	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:40.894579887 CEST	52752	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:40.944999933 CEST	53	52752	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:41.822966099 CEST	60542	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:41.875538111 CEST	53	60542	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:44.372824907 CEST	60689	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:44.424273014 CEST	53	60689	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:49.274296045 CEST	64206	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:49.337711096 CEST	53	64206	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:52.448410988 CEST	50904	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:52.507056952 CEST	53	50904	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:52.958602905 CEST	57525	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:53.009433985 CEST	53	57525	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:53.821203947 CEST	53814	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:53.882581949 CEST	53	53814	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:55.863524914 CEST	53418	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:55.912224054 CEST	53	53418	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:56.499140978 CEST	62833	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:56.549696922 CEST	53	62833	8.8.8.8	192.168.2.4
Apr 16, 2021 12:50:57.610954046 CEST	59260	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:50:57.673594952 CEST	53	59260	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:00.168108940 CEST	49944	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:00.217422009 CEST	53	49944	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:00.838685036 CEST	63300	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:00.896094084 CEST	53	63300	8.8.8.8	192.168.2.4
Apr 16, 2021 12:51:02.149461985 CEST	61449	53	192.168.2.4	8.8.8.8
Apr 16, 2021 12:51:02.210201979 CEST	53	61449	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 16, 2021 12:49:40.821105957 CEST	192.168.2.4	8.8.8.8	0xd4bb	Standard query (0)	www.fema.gov	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.583909035 CEST	192.168.2.4	8.8.8.8	0x5b3f	Standard query (0)	dap.digitalgov.gov	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.701103926 CEST	192.168.2.4	8.8.8.8	0xbf34	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.725138903 CEST	192.168.2.4	8.8.8.8	0x2376	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.995332003 CEST	192.168.2.4	8.8.8.8	0xb07c	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.023281097 CEST	192.168.2.4	8.8.8.8	0x9866	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:58.924324036 CEST	192.168.2.4	8.8.8.8	0xea3b	Standard query (0)	www.fema.gov	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 16, 2021 12:49:40.881500959 CEST	8.8.8.8	192.168.2.4	0xd4bb	No error (0)	www.fema.gov	www.fema.gov.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	dap.digitalgov.gov	d27f3qgc9anoq2.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.62	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.113	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.16	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:41.643265009 CEST	8.8.8.8	192.168.2.4	0x5b3f	No error (0)	d27f3qgc9anoq2.cloudfront.net		13.32.25.127	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.749593973 CEST	8.8.8.8	192.168.2.4	0xbf34	No error (0)	js-agent.newrelic.com	f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.154	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.155	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.157	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:43.795666933 CEST	8.8.8.8	192.168.2.4	0x2376	No error (0)	stats.l.doubleclick.net		74.125.140.156	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.19	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.21	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.20	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.045562029 CEST	8.8.8.8	192.168.2.4	0xb07c	No error (0)	bam.nr-data.net		162.247.242.18	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:44.091254950 CEST	8.8.8.8	192.168.2.4	0x9866	No error (0)	www.google.de		172.217.19.99	A (IP address)	IN (0x0001)
Apr 16, 2021 12:49:58.984334946 CEST	8.8.8.8	192.168.2.4	0xea3b	No error (0)	www.fema.gov	www.fema.gov.edgekey.net		CNAME (Canonical name)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 16, 2021 12:49:41.734718084 CEST	13.32.25.62	443	192.168.2.4	49741	CN=dap.digitalgov.gov CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Oct 02 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Nov 03 01:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Apr 16, 2021 12:49:41.735344887 CEST	13.32.25.62	443	192.168.2.4	49742	CN=dap.digitalgov.gov CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Oct 02 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Nov 03 01:00:00 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Apr 16, 2021 12:49:43.928354979 CEST	74.125.140.154	443	192.168.2.4	49754	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 23 09:18:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 15 10:18:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.928354979 CEST	74.125.140.154	443	192.168.2.4	49754	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.929358959 CEST	74.125.140.154	443	192.168.2.4	49753	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Mar 23 09:18:56 CET 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jun 15 10:18:55 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:43.929358959 CEST	74.125.140.154	443	192.168.2.4	49753	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.362380028 CEST	162.247.242.19	443	192.168.2.4	49755	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.362380028 CEST	162.247.242.19	443	192.168.2.4	49755	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.363219023 CEST	162.247.242.19	443	192.168.2.4	49756	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:49:44.363219023 CEST	162.247.242.19	443	192.168.2.4	49756	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.499155998 CEST	162.247.242.19	443	192.168.2.4	49780	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.499155998 CEST	162.247.242.19	443	192.168.2.4	49780	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.516370058 CEST	162.247.242.19	443	192.168.2.4	49779	CN=*.nr-data.net, O="New Relic, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Tue Feb 08 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 16, 2021 12:50:43.516370058 CEST	162.247.242.19	443	192.168.2.4	49779	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5964 Parent PID: 800

General

Start time:	12:49:39
Start date:	16/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff698750000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 2896 Parent PID: 5964

General

Start time:	12:49:40
Start date:	16/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5964 CREDAT:17410 /prefetch:2
Imagebase:	0x1180000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://www.fema.gov/disasters/coronavirus/economic/funeral-assistance

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5964 Parent PID: 800

General

Analysis Process: iexplore.exe PID: 2896 Parent PID: 5964

General

Disassembly