Play interactive tour

Edit tour

Windows Analysis Report https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4

Overview

General Information

Sample URL:	https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Analysis ID:	436463
Infos:
Most interesting Screenshot:

Detection

Score:	0
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Found iframes

Classification

Process Tree

System is w10x64

iexplore.exe (PID: 5888 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 5936 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5888 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: Iframe src: https://www.intermedia.net/crossdomain/frame.html
Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: Iframe src: https://app-sj01.marketo.com/index.php/form/XDFrame
Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: Iframe src: https://www.intermedia.net/crossdomain/frame.html
Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: Iframe src: https://app-sj01.marketo.com/index.php/form/XDFrame
Source: https://www.intermedia.com/products/securisync	HTTP Parser: Iframe src: https://www.intermedia.net/crossdomain/frame.html
Source: https://www.intermedia.com/products/securisync	HTTP Parser: Iframe src: https://app-sj01.marketo.com/index.php/form/XDFrame
Source: https://www.intermedia.com/products/securisync	HTTP Parser: Iframe src: https://www.intermedia.net/crossdomain/frame.html
Source: https://www.intermedia.com/products/securisync	HTTP Parser: Iframe src: https://app-sj01.marketo.com/index.php/form/XDFrame

Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: No <meta name="author".. found
Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: No <meta name="author".. found
Source: https://www.intermedia.com/products/securisync	HTTP Parser: No <meta name="author".. found
Source: https://www.intermedia.com/products/securisync	HTTP Parser: No <meta name="author".. found

Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: No <meta name="copyright".. found
Source: https://www.intermedia.com/why-intermedia/compliance	HTTP Parser: No <meta name="copyright".. found
Source: https://www.intermedia.com/products/securisync	HTTP Parser: No <meta name="copyright".. found
Source: https://www.intermedia.com/products/securisync	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.69:443 -> 192.168.2.3:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.69:443 -> 192.168.2.3:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.119:443 -> 192.168.2.3:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.119:443 -> 192.168.2.3:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.80:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.80:443 -> 192.168.2.3:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.190:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.190:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.144.84:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.144.84:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.89.41:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.89.41:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.29:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.29:443 -> 192.168.2.3:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.174.11.69:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.174.11.69:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.111:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.111:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.156.70:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.156.70:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.75.66.243:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.75.66.243:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.131:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.131:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.158.134.119:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.158.134.119:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.47.36.17:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.47.36.17:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.147.68:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.147.68:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.68:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.68:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.137.162:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.137.162:443 -> 192.168.2.3:49768 version: TLS 1.2

Source: securisync[1].htm.2.dr	String found in binary or memory: <a class="fancybox-media vid-link with-icon" href="https://www.youtube.com/watch?v=IFcmZPTAtic">See how SecuriSync protects against ransomware-related downtime</a> equals www.youtube.com (Youtube)
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: <a class="facebook social-icon" target="_blank" href="https://www.facebook.com/intermedia.inc"> equals www.facebook.com (Facebook)
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: <a class="linkedin social-icon" target="_blank" href="https://www.linkedin.com/company/intermedia"> equals www.linkedin.com (Linkedin)
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: <a class="linkedin social-icon" target="_blank" href="https://www.youtube.com/channel/UCU-qlUSGWdMC95HVO5hHPrg "> equals www.youtube.com (Youtube)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"dataProcessingOptions\",[\"LDU\"],0,0);fbq(\"init\",\"387569738474119\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=387569738474119\u0026amp;ev=PageView\u0026amp;noscript=1\u0026amp;dpo=LDU\u0026amp;dpoco=0\u0026amp;dpost=0\"\u003E\u003C\/noscript\u003E", equals www.facebook.com (Facebook)
Source: customization[1].json.2.dr	String found in binary or memory: "VideosLink": "https://www.youtube.com/playlist?list=PLCRe8TVknTfsvF3zPUZWzwYpDJVlcLz6e", equals www.youtube.com (Youtube)
Source: 387569738474119[1].js.2.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func
Source: gtm[1].js.2.dr	String found in binary or memory: E=V("YT"),D=function(){e(C)};J(u.vtp_gtmOnSuccess);if(E)E.ready&&E.ready(D);else{var I=V("onYouTubeIframeAPIReady");qt("onYouTubeIframeAPIReady",function(){I&&I();D()});J(function(){for(var R=V("document"),Q=R.getElementsByTagName("script"),S=Q.length,T=0;T<S;T++){var Z=Q[T].getAttribute("src");if(b(Z,"iframe_api")\|\|b(Z,"player_api"))return}for(var L=R.getElementsByTagName("iframe"),W=L.length,ca=0;ca<W;ca++)if(!t&&c(L[ca],C.ic)){U("https://www.youtube.com/iframe_api");t=!0;break}})}}else J(u.vtp_gtmOnSuccess)} equals www.youtube.com (Youtube)
Source: gtm[1].js.2.dr	String found in binary or memory: Math.round(p);v["gtm.videoCurrentTime"]=Math.round(q);v["gtm.videoElapsedTime"]=Math.round(f);v["gtm.videoPercent"]=r;v["gtm.videoVisible"]=t;return v},ug:function(){e=cb()},Db:function(){d()}}};var zq=["www.youtube.com","www.youtube-nocookie.com"],Aq,Bq=!1,Cq=0; equals www.youtube.com (Youtube)
Source: www-widgetapi[1].js.2.dr	String found in binary or memory: n.setup=function(a,b){var c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"===a.tagName.toLowerCase(),b.host\|\|(b.host=c?Db(a.src):"https://www.youtube.com"),this.i=new Si(b),c\|\|(b=aj(this,a),this.m=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.h=a,this.h.id\|\|(this.h.id="widget"+Ga(this.h)),Mi[this.h.id]=this,window.postMessage){this.l=new P;bj(this);b=Z(this.i,"events");for(var d in b)b.hasOwnProperty(d)&&this.addEventListener(d,b[d]);for(var e in Oi)Oi.hasOwnProperty(e)&& equals www.youtube.com (Youtube)
Source: yt-tracking[1].js.2.dr	String found in binary or memory: tag.src = "https://www.youtube.com/player_api"; equals www.youtube.com (Youtube)
Source: gtm[1].js.2.dr	String found in binary or memory: var p=["www.youtube.com","www.youtube-nocookie.com"],q={UNSTARTED:-1,ENDED:0,PLAYING:1,PAUSED:2,BUFFERING:3,CUED:5},r,t=!1;(function(u){Y.__ytl=u;Y.__ytl.m="ytl";Y.__ytl.o=!0;Y.__ytl.priorityOverride=0})(function(u){u.vtp_triggerStartOption?m(u):vl(function(){m(u)})})}(); equals www.youtube.com (Youtube)
Source: player_api[1].js0.2.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/997fe684\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: securisync.intermedia.net

Source: tag[1].js.2.dr	String found in binary or memory: http://127.0.0.1
Source: IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].htm.2.dr	String found in binary or memory: http://angularjs.org
Source: st[1].js.2.dr	String found in binary or memory: http://bestiejs.github.io/json3
Source: vendor.bundle[1].js.2.dr	String found in binary or memory: http://g.co/ng/security#xss)
Source: vendor.bundle[1].js.2.dr	String found in binary or memory: http://g.co/ng/security#xss).
Source: st[1].js.2.dr	String found in binary or memory: http://james.padolsey.com
Source: jquery-custom-ui.min[1].js.2.dr	String found in binary or memory: http://jquery.com/
Source: st[1].js.2.dr, jquery-custom-ui.min[1].js.2.dr	String found in binary or memory: http://jquery.org/license
Source: st[1].js.2.dr	String found in binary or memory: http://kit.mit-license.org
Source: st[1].js.2.dr	String found in binary or memory: http://sizzlejs.com/
Source: st[1].js.2.dr	String found in binary or memory: http://unlicense.org/UNLICENSE
Source: jquery.lazyload[1].js.2.dr	String found in binary or memory: http://www.appelsiini.net/projects/lazyload
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: http://www.intermedia.co.uk/why-intermedia
Source: compliance[1].htm.2.dr	String found in binary or memory: http://www.intermedia.co.uk/why-intermedia/compliance
Source: securisync[1].htm.2.dr	String found in binary or memory: http://www.intermedia.com/products/securisync
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: http://www.intermedia.com/why-intermedia
Source: compliance[1].htm.2.dr	String found in binary or memory: http://www.intermedia.com/why-intermedia/compliance
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: http://www.jdpower.com
Source: jquery.lazyload[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php
Source: customization[1].json.2.dr	String found in binary or memory: https://account.securisync.intermedia.net/login/v1.1/
Source: gtm[1].js.2.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://admin.us2sync.myonlinedata.net/provisioning
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://app-sj01.marketo.com/index.php/form/XDFrame
Source: customization[1].json.2.dr	String found in binary or memory: https://apps.apple.com/us/app/securisync/id471324547
Source: customization[1].json.2.dr	String found in binary or memory: https://auth.myonlinedata.net/locator/
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://auth.us2sync.myonlinedata.net/auth
Source: forms2[1].css.2.dr	String found in binary or memory: https://bugzilla.mozilla.org/show_bug.cgi?id=33654
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://cp.intermedia.net/ControlPanel/Login
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://cp.serverdata.net/Portal/Partner/Login
Source: www-widgetapi[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: munchkin[1].js0.2.dr	String found in binary or memory: https://developers.marketo.com/?p=7696
Source: munchkin[1].js.2.dr	String found in binary or memory: https://developers.marketo.com/MunchkinLicense.pdf
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://fonts.gstatic.com/
Source: gtm[1].js.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: vendor.bundle[1].js.2.dr	String found in binary or memory: https://goo.gl/X2J8zc.
Source: vendor.bundle[1].js.2.dr	String found in binary or memory: https://goo.gl/wIDDiL
Source: customization[1].json.2.dr	String found in binary or memory: https://howto.securisync.com
Source: why-intermedia[1].htm0.2.dr, securisync[1].htm.2.dr	String found in binary or memory: https://kb.intermedia.net
Source: securisync[1].htm.2.dr	String found in binary or memory: https://kb.intermedia.net/Article/2554
Source: securisync[1].htm.2.dr	String found in binary or memory: https://kb.intermedia.net/Article/2652
Source: customization[1].json.2.dr	String found in binary or memory: https://kb.intermedia.net/article/3315
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://kms.us2sync.myonlinedata.net/kms
Source: tag[1].js.2.dr	String found in binary or memory: https://mc.yandex.
Source: tag[1].js.2.dr	String found in binary or memory: https://mc.yandex.md/cc
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://partnersales.intermedia.net
Source: customization[1].json.2.dr	String found in binary or memory: https://play.google.com/store/apps/details?id=net.intermedia.securisync.ui&hl=en
Source: insight.min[1].js.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect?
Source: insight.min[1].js.2.dr	String found in binary or memory: https://px.ads.linkedin.com/insight_tag_errors.gif?
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisyn.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9f
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisyn.com/why-intermedia/complianceRoot
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisyn.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9f
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.int
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.inte9fc4
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.inteRoot
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.inteame.html
Source: customization[1].json.2.dr	String found in binary or memory: https://securisync.intermedia.net/downloads/securisync/documents/SecuriSync%20Get%20Started%20Guide%
Source: customization[1].json.2.dr	String found in binary or memory: https://securisync.intermedia.net/downloads/securisync/documents/SecuriSync-Get-Started-Guide-for-Fi
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://securisync.intermedia.net/us2
Source: IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].htm.2.dr	String found in binary or memory: https://securisync.intermedia.net/us2/
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr, {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4Root
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4ermedia.net/us2/s/IpnIUjFRDCv9
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/file?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisync.intermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003eRoot
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisynermedia.net/us2/s/file?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9f
Source: {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	String found in binary or memory: https://securisynermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9
Source: gtm[1].js.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: st[1].js.2.dr	String found in binary or memory: https://st1.dialogtech.com/st/
Source: st[1].js.2.dr	String found in binary or memory: https://st1.dialogtech.com/st/locations
Source: st[1].js.2.dr	String found in binary or memory: https://st2.dialogtech.com/st/log
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: st[1].js.2.dr	String found in binary or memory: https://stcdproducer.dialogtech.com/v1/data
Source: analytics[1].js.2.dr	String found in binary or memory: https://tagassistant.google.com/
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://twitter.com/intermedia_net
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/chats
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/data
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/data_sse
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/diagnostic
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/metadata
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/update
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://us2sync.myonlinedata.net/v3
Source: tp.widget.sync.bootstrap.min[1].js.2.dr	String found in binary or memory: https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Source: us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	String found in binary or memory: https://wopi.us2sync.myonlinedata.net/wopi
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.anymeeting.com/AccountManager/Login.aspx
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/a?id=
Source: js[2].js.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.googletagmanager.com/ns.html?id=GTM-N47LFD
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.co.uk/
Source: frame[1].htm.2.dr, why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com
Source: customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-EULA.pdf
Source: customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-ExternalUserTerms.pdf
Source: customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-Open-Source-Notice-File.pdf
Source: why-intermedia[1].htm0.2.dr, customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/assets/pdf/legal/PrivacyPolicy.pdf
Source: imagestore.dat.2.dr	String found in binary or memory: https://www.intermedia.com/assets/tracked/img/favicon.ico
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com/blog/animal-hospital-and-pet-resort-sets-new-standards/
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.com/blog/judicial-district-uses-technology-to-keep-courts-in-session/
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com/blog/should-your-business-offer-flexible-work-arrangements-permanently/
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.com/blog/stranded-oil-leverages-intermedias-communications-and-collaboration-
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.com/blog/whats-the-best-cloud-storage-for-business/
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com/blog/why-cloud-phone-systems-are-the-future/
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com/login/voice
Source: customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/products/SecuriSync
Source: customization[1].json.2.dr, securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.com/products/securisync
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4a.net/us2/s/fi
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/products/securisyncrCloud
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr, why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia
Source: www.intermedia[1].xml.2.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia"
Source: customization[1].json.2.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia/
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr, compliance[1].htm.2.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia/compliance
Source: www.intermedia[1].xml.2.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia/compliance"
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia/complianceare=IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/why-intermedia/compliancezIT
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/why-intermediarWorry-Free
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4com/products/se
Source: frame[1].htm.2.dr	String found in binary or memory: https://www.intermedia.net
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.intermedia.net/blog
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.net/blog/category/services/securisync/
Source: ~DF7C8DA5896C7BBD32.TMP.1.dr	String found in binary or memory: https://www.intermedia.net/crossdomain/frame.html
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.net/report/ransomware
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.intermedia.net/report/ransomware#continuity
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.linkedin.com/company/intermedia
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.tsia.com
Source: www-widgetapi[1].js.2.dr, player_api[1].js0.2.dr	String found in binary or memory: https://www.youtube.com
Source: why-intermedia[1].htm0.2.dr	String found in binary or memory: https://www.youtube.com/channel/UCU-qlUSGWdMC95HVO5hHPrg
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api
Source: yt-tracking[1].js.2.dr	String found in binary or memory: https://www.youtube.com/player_api
Source: customization[1].json.2.dr	String found in binary or memory: https://www.youtube.com/playlist?list=PLCRe8TVknTfsvF3zPUZWzwYpDJVlcLz6e
Source: securisync[1].htm.2.dr	String found in binary or memory: https://www.youtube.com/watch?v=IFcmZPTAtic
Source: tag[1].js.2.dr	String found in binary or memory: https://yandexmetrica.com
Source: tag[1].js.2.dr	String found in binary or memory: https://yastatic.net/s3/gdpr/popup/v2/
Source: tag[1].js.2.dr	String found in binary or memory: https://ymetrica1.com/watch/3/1
Source: securisync[1].htm.2.dr	String found in binary or memory: https://youtu.be/enLvRvNVEdY

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49695 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49686 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49698
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49697
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49696
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49695
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49694
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49693
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49692
Source: unknown	Network traffic detected: HTTP traffic on port 49692 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49691
Source: unknown	Network traffic detected: HTTP traffic on port 49703 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49690
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49689 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49681 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49726
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49689
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49688
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49687
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49686
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49685
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49684
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49683
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49682
Source: unknown	Network traffic detected: HTTP traffic on port 49697 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49681
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49680
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49760 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49688 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49680 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49694 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49726 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49768 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49683 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49704
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49703
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49702
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49701
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49691 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49704 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49701 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49682 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49759 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 49696 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49685 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49768
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49760
Source: unknown	Network traffic detected: HTTP traffic on port 49693 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49702 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49690 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49684 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49759
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 49698 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49687 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746

Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49681 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49680 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.69:443 -> 192.168.2.3:49687 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.69:443 -> 192.168.2.3:49686 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.119:443 -> 192.168.2.3:49689 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.119:443 -> 192.168.2.3:49688 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49691 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49692 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49690 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49693 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49695 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.200.121.85:443 -> 192.168.2.3:49694 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49697 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49696 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49698 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.200.116:443 -> 192.168.2.3:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.193.202.116:443 -> 192.168.2.3:49700 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49702 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49701 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.80:443 -> 192.168.2.3:49704 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.93.80:443 -> 192.168.2.3:49703 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.190:443 -> 192.168.2.3:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.27.190:443 -> 192.168.2.3:49718 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.3:49722 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 157.240.17.15:443 -> 192.168.2.3:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.144.84:443 -> 192.168.2.3:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.144.84:443 -> 192.168.2.3:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 74.125.140.154:443 -> 192.168.2.3:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.89.41:443 -> 192.168.2.3:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.89.41:443 -> 192.168.2.3:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.244.197.215:443 -> 192.168.2.3:49726 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.29:443 -> 192.168.2.3:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.29:443 -> 192.168.2.3:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.174.11.69:443 -> 192.168.2.3:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.174.11.69:443 -> 192.168.2.3:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.111:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.111:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.156.70:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.156.70:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.75.66.243:443 -> 192.168.2.3:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 80.75.66.243:443 -> 192.168.2.3:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.131:443 -> 192.168.2.3:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.131:443 -> 192.168.2.3:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.158.134.119:443 -> 192.168.2.3:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 93.158.134.119:443 -> 192.168.2.3:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.47.36.17:443 -> 192.168.2.3:49756 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 154.47.36.17:443 -> 192.168.2.3:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.147.68:443 -> 192.168.2.3:49759 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.28.147.68:443 -> 192.168.2.3:49760 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.68:443 -> 192.168.2.3:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.224.99.68:443 -> 192.168.2.3:49761 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.137.162:443 -> 192.168.2.3:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 107.162.137.162:443 -> 192.168.2.3:49768 version: TLS 1.2

Source: classification engine

Classification label: clean0.win@3/152@33/23

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF94C390ACE305242B.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5888 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5888 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
sj01.mktoedge.com	0%	Virustotal	Browse
auth.myonlinedata.net	0%	Virustotal	Browse
auth.us2sync.myonlinedata.net	0%	Virustotal	Browse
524-vts-832.mktoresp.com	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://securisyn.com/why-intermedia/complianceRoot	0%	Avira URL Cloud	safe
https://securisync.int	0%	Avira URL Cloud	safe
https://securisynermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9	0%	Avira URL Cloud	safe
https://mc.yandex.	0%	URL Reputation	safe
https://mc.yandex.	0%	URL Reputation	safe
https://mc.yandex.	0%	URL Reputation	safe
http://james.padolsey.com	0%	Avira URL Cloud	safe
http://unlicense.org/UNLICENSE	0%	Avira URL Cloud	safe
http://www.intermedia.com/products/securisync	0%	Avira URL Cloud	safe
http://www.intermedia.com/why-intermedia	0%	Avira URL Cloud	safe
https://us2sync.myonlinedata.net/data	0%	Avira URL Cloud	safe
https://www.intermedia.com/why-intermedia/compliancezIT	0%	Avira URL Cloud	safe
https://us2sync.myonlinedata.net/metadata	0%	Avira URL Cloud	safe
https://securisynermedia.net/us2/s/file?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9f	0%	Avira URL Cloud	safe
https://www.intermedia.com/products/securisyncrCloud	0%	Avira URL Cloud	safe
https://mc.yandex.md/cc	0%	URL Reputation	safe
https://mc.yandex.md/cc	0%	URL Reputation	safe
https://mc.yandex.md/cc	0%	URL Reputation	safe
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-EULA.pdf	0%	Avira URL Cloud	safe
https://www.intermedia.com/blog/why-cloud-phone-systems-are-the-future/	0%	Avira URL Cloud	safe
https://www.intermedia.com/blog/judicial-district-uses-technology-to-keep-courts-in-session/	0%	Avira URL Cloud	safe
https://www.intermedia.com/why-intermedia/complianceare=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	0%	Avira URL Cloud	safe
https://auth.myonlinedata.net/locator/	0%	Avira URL Cloud	safe
https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	0%	Avira URL Cloud	safe
https://www.intermedia.com/login/voice	0%	Avira URL Cloud	safe
https://www.intermedia.com/blog/should-your-business-offer-flexible-work-arrangements-permanently/	0%	Avira URL Cloud	safe
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-Open-Source-Notice-File.pdf	0%	Avira URL Cloud	safe
https://securisyn.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9f	0%	Avira URL Cloud	safe
http://127.0.0.1	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www.intermedia.com/why-intermedia	0%	Avira URL Cloud	safe
http://www.intermedia.com/why-intermedia/compliance	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://auth.us2sync.myonlinedata.net/auth	0%	Avira URL Cloud	safe
https://www.intermedia.com/blog/animal-hospital-and-pet-resort-sets-new-standards/	0%	Avira URL Cloud	safe
https://securisync.inteame.html	0%	Avira URL Cloud	safe
https://www.intermedia.co.uk/	0%	Avira URL Cloud	safe
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-ExternalUserTerms.pdf	0%	Avira URL Cloud	safe
https://us2sync.myonlinedata.net/diagnostic	0%	Avira URL Cloud	safe
https://www.intermedia.com/assets/pdf/legal/PrivacyPolicy.pdf	0%	Avira URL Cloud	safe
https://www.intermedia.com/blog/stranded-oil-leverages-intermedias-communications-and-collaboration-	0%	Avira URL Cloud	safe
https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	0%	Avira URL Cloud	safe
https://howto.securisync.com	0%	Avira URL Cloud	safe
http://www.intermedia.co.uk/why-intermedia/compliance	0%	Avira URL Cloud	safe
https://securisync.inte9fc4	0%	Avira URL Cloud	safe
https://kms.us2sync.myonlinedata.net/kms	0%	Avira URL Cloud	safe
https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4com/products/se	0%	Avira URL Cloud	safe
https://securisync.inteRoot	0%	Avira URL Cloud	safe
https://admin.us2sync.myonlinedata.net/provisioning	0%	Avira URL Cloud	safe
https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4a.net/us2/s/fi	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
abrtp1.marketo.com	192.28.144.84	true	false		high
mc.yandex.ru	93.158.134.119	true	false		high
stproducer.dialogtech.com	107.162.137.162	true	false		high
pop-eda6.mix.linkedin.com	108.174.11.69	true	false		high
d3bipqqt7o7bp0.cloudfront.net	13.224.99.111	true	false		high
sj01.mktoedge.com	104.16.93.80	true	false	0%, Virustotal, Browse	unknown
auth.myonlinedata.net	162.244.197.119	true	false	0%, Virustotal, Browse	unknown
dl7g9llrghqi1.cloudfront.net	13.224.99.29	true	false		high
scontent.xx.fbcdn.net	157.240.17.15	true	false		high
stnumreq.dialogtech.com	107.162.156.70	true	false		high
tracking.g2crowd.com	104.18.27.190	true	false		high
www.intermedia.net	162.244.197.215	true	false		high
d38au5kn48shwv.cloudfront.net	13.224.99.69	true	false		high
auth.us2sync.myonlinedata.net	199.193.200.116	true	false	0%, Virustotal, Browse	unknown
524-vts-832.mktoresp.com	192.28.147.68	true	false	0%, Virustotal, Browse	unknown
stats.l.doubleclick.net	74.125.140.154	true	false		high
www.intermedia.com	162.244.197.215	true	false		unknown
us2sync.myonlinedata.net	199.193.200.116	true	false		unknown
apikeys-lb.civiccomputing.com	80.75.66.243	true	false		unknown
securisync.intermedia.net	199.193.202.116	true	false		high
heapanalytics.com	52.200.121.85	true	false		high
www.google.ch	142.250.186.131	true	false		high
widget.trustpilot.com	13.224.99.68	true	false		high
d31y97ze264gaa.cloudfront.net	13.224.89.41	true	false		high
mc.webvisor.org	154.47.36.17	true	false		unknown
cc.cdn.civiccomputing.com	unknown	unknown	false		unknown
cdn.jsdelivr.net	unknown	unknown	false		high
apikeys.civiccomputing.com	unknown	unknown	false		unknown
stats.g.doubleclick.net	unknown	unknown	false		high
js.driftt.com	unknown	unknown	false		high
app-sj01.marketo.com	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high
st2.dialogtech.com	unknown	unknown	false		high
cdn.heapanalytics.com	unknown	unknown	false		high
rtp-static.marketo.com	unknown	unknown	false		high
www.linkedin.com	unknown	unknown	false		high
abrtp1-cdn.marketo.com	unknown	unknown	false		high
connect.facebook.net	unknown	unknown	false		high
px.ads.linkedin.com	unknown	unknown	false		high
st1.dialogtech.com	unknown	unknown	false		high
munchkin.marketo.net	unknown	unknown	false		unknown
snap.licdn.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Reputation
https://www.intermedia.com/why-intermedia/compliance	false	unknown
https://www.intermedia.com/products/securisync	false	unknown
https://securisync.intermedia.net/us2/s/file?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.intermedia.net/blog/category/services/securisync/	securisync[1].htm.2.dr	false		high
https://securisyn.com/why-intermedia/complianceRoot	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://cp.serverdata.net/Portal/Partner/Login	why-intermedia[1].htm0.2.dr	false		high
https://securisync.int	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://securisynermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://mc.yandex.	tag[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://james.padolsey.com	st[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://kb.intermedia.net/Article/2652	securisync[1].htm.2.dr	false		high
http://unlicense.org/UNLICENSE	st[1].js.2.dr	false	Avira URL Cloud: safe	unknown
http://www.intermedia.com/products/securisync	securisync[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.intermedia.com/why-intermedia	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/downloads/securisync/documents/SecuriSync%20Get%20Started%20Guide%	customization[1].json.2.dr	false		high
https://px.ads.linkedin.com/collect?	insight.min[1].js.2.dr	false		high
https://cp.intermedia.net/ControlPanel/Login	why-intermedia[1].htm0.2.dr	false		high
https://us2sync.myonlinedata.net/data	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.net/report/ransomware#continuity	securisync[1].htm.2.dr	false		high
https://www.youtube.com	www-widgetapi[1].js.2.dr, player_api[1].js0.2.dr	false		high
https://www.intermedia.com/why-intermedia/compliancezIT	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/iframe_api	gtm[1].js.2.dr	false		high
http://www.opensource.org/licenses/mit-license.php	jquery.lazyload[1].js.2.dr	false		high
https://us2sync.myonlinedata.net/metadata	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://stcdproducer.dialogtech.com/v1/data	st[1].js.2.dr	false		high
https://securisynermedia.net/us2/s/file?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9f	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/krux/postscribe/blob/master/LICENSE.	gtm[1].js.2.dr	false		high
https://www.intermedia.com/products/securisyncrCloud	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
https://youtu.be/enLvRvNVEdY	securisync[1].htm.2.dr	false		high
https://www.youtube.com/channel/UCU-qlUSGWdMC95HVO5hHPrg	why-intermedia[1].htm0.2.dr	false		high
https://mc.yandex.md/cc	tag[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-EULA.pdf	customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/blog/why-cloud-phone-systems-are-the-future/	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/blog/judicial-district-uses-technology-to-keep-courts-in-session/	securisync[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/why-intermedia/complianceare=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4ermedia.net/us2/s/IpnIUjFRDCv9	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://auth.myonlinedata.net/locator/	customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://bugzilla.mozilla.org/show_bug.cgi?id=33654	forms2[1].css.2.dr	false		high
https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/login/voice	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/blog/should-your-business-offer-flexible-work-arrangements-permanently/	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/watch?v=IFcmZPTAtic	securisync[1].htm.2.dr	false		high
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-Open-Source-Notice-File.pdf	customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
http://www.appelsiini.net/projects/lazyload	jquery.lazyload[1].js.2.dr	false		high
https://securisyn.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9f	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
http://127.0.0.1	tag[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://st1.dialogtech.com/st/	st[1].js.2.dr	false		high
https://kb.intermedia.net/article/3315	customization[1].json.2.dr	false		high
https://www.intermedia.net/report/ransomware	securisync[1].htm.2.dr	false		high
https://cct.google/taggy/agent.js	js[2].js.2.dr, gtm[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://account.securisync.intermedia.net/login/v1.1/	customization[1].json.2.dr	false		high
https://www.intermedia.com/why-intermedia	~DF7C8DA5896C7BBD32.TMP.1.dr, why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://g.co/ng/security#xss).	vendor.bundle[1].js.2.dr	false		high
http://www.intermedia.com/why-intermedia/compliance	compliance[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://developers.marketo.com/MunchkinLicense.pdf	munchkin[1].js.2.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://auth.us2sync.myonlinedata.net/auth	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/blog/animal-hospital-and-pet-resort-sets-new-standards/	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://app-sj01.marketo.com/index.php/form/XDFrame	~DF7C8DA5896C7BBD32.TMP.1.dr	false		high
https://securisync.inteame.html	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003eRoot	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://www.tsia.com	why-intermedia[1].htm0.2.dr	false		high
https://www.intermedia.co.uk/	why-intermedia[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/downloads/securisync/documents/SecuriSync-Get-Started-Guide-for-Fi	customization[1].json.2.dr	false		high
https://www.intermedia.com/assets/pdf/legal/Intermedia-SecuriSync-ExternalUserTerms.pdf	customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://us2sync.myonlinedata.net/diagnostic	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.com/assets/pdf/legal/PrivacyPolicy.pdf	why-intermedia[1].htm0.2.dr, customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.intermedia.net/crossdomain/frame.html	~DF7C8DA5896C7BBD32.TMP.1.dr	false		high
https://www.intermedia.com/why-intermedia/compliance	~DF7C8DA5896C7BBD32.TMP.1.dr, compliance[1].htm.2.dr	false		unknown
https://goo.gl/wIDDiL	vendor.bundle[1].js.2.dr	false		high
https://www.intermedia.com/blog/stranded-oil-leverages-intermedias-communications-and-collaboration-	securisync[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://kb.intermedia.net	why-intermedia[1].htm0.2.dr, securisync[1].htm.2.dr	false		high
https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
http://jquery.org/license	st[1].js.2.dr, jquery-custom-ui.min[1].js.2.dr	false		high
https://howto.securisync.com	customization[1].json.2.dr	false	Avira URL Cloud: safe	unknown
http://www.intermedia.co.uk/why-intermedia/compliance	compliance[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://sizzlejs.com/	st[1].js.2.dr	false		high
https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4	~DF7C8DA5896C7BBD32.TMP.1.dr, {C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://securisync.inte9fc4	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/player_api	yt-tracking[1].js.2.dr	false		high
https://yastatic.net/s3/gdpr/popup/v2/	tag[1].js.2.dr	false		high
https://kms.us2sync.myonlinedata.net/kms	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/us2/	IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].htm.2.dr	false		high
https://twitter.com/intermedia_net	why-intermedia[1].htm0.2.dr	false		high
https://www.anymeeting.com/AccountManager/Login.aspx	why-intermedia[1].htm0.2.dr	false		high
https://securisync.intermedia.net/us2/s/login?public_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4	~DF7C8DA5896C7BBD32.TMP.1.dr	false		high
http://angularjs.org	IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].htm.2.dr	false		high
https://www.intermedia.com/why-intermediasynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4com/products/se	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://securisync.inteRoot	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4Root	{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat.1.dr	false		high
https://admin.us2sync.myonlinedata.net/provisioning	us2[1].json.2.dr, externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4[1].json.2.dr	false	Avira URL Cloud: safe	unknown
https://www.youtube.com/playlist?list=PLCRe8TVknTfsvF3zPUZWzwYpDJVlcLz6e	customization[1].json.2.dr	false		high
https://www.intermedia.com/products/securisync	customization[1].json.2.dr, securisync[1].htm.2.dr	false		unknown
https://px.ads.linkedin.com/insight_tag_errors.gif?	insight.min[1].js.2.dr	false		high
https://st2.dialogtech.com/st/log	st[1].js.2.dr	false		high
https://www.intermedia.net/blog	why-intermedia[1].htm0.2.dr	false		high
http://kit.mit-license.org	st[1].js.2.dr	false		high
https://www.intermedia.com/products/SecuriSync	customization[1].json.2.dr	false		unknown
https://www.intermedia.com/products/securisynclic_share=IpnIUjFRDCv9PeEVchmZ5r003e9fc4a.net/us2/s/fi	~DF7C8DA5896C7BBD32.TMP.1.dr	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
80.75.66.243	apikeys-lb.civiccomputing.com	United Kingdom	20860	IOMART-ASGB	false
13.224.89.41	d31y97ze264gaa.cloudfront.net	United States	16509	AMAZON-02US	false
52.200.121.85	heapanalytics.com	United States	14618	AMAZON-AESUS	false
107.162.156.70	stnumreq.dialogtech.com	United States	55002	DEFENSE-NETUS	false
192.28.144.84	abrtp1.marketo.com	United States	15224	OMNITUREUS	false
13.224.99.69	d38au5kn48shwv.cloudfront.net	United States	16509	AMAZON-02US	false
157.240.17.15	scontent.xx.fbcdn.net	United States	32934	FACEBOOKUS	false
192.28.147.68	524-vts-832.mktoresp.com	United States	53580	MARKETOUS	false
13.224.99.68	widget.trustpilot.com	United States	16509	AMAZON-02US	false
162.244.197.119	auth.myonlinedata.net	United States	19780	AS-INTERMEDIA2US	false
13.224.99.29	dl7g9llrghqi1.cloudfront.net	United States	16509	AMAZON-02US	false
93.158.134.119	mc.yandex.ru	Russian Federation	13238	YANDEXRU	false
162.244.197.215	www.intermedia.net	United States	19780	AS-INTERMEDIA2US	false
199.193.200.116	auth.us2sync.myonlinedata.net	United States	16406	AS-INTERMEDIAUS	false
13.224.99.111	d3bipqqt7o7bp0.cloudfront.net	United States	16509	AMAZON-02US	false
142.250.186.131	www.google.ch	United States	15169	GOOGLEUS	false
108.174.11.69	pop-eda6.mix.linkedin.com	United States	14413	LINKEDINUS	false
104.16.93.80	sj01.mktoedge.com	United States	13335	CLOUDFLARENETUS	false
107.162.137.162	stproducer.dialogtech.com	United States	55002	DEFENSE-NETUS	false
154.47.36.17	mc.webvisor.org	United States	174	COGENT-174US	false
74.125.140.154	stats.l.doubleclick.net	United States	15169	GOOGLEUS	false
199.193.202.116	securisync.intermedia.net	United States	16406	AS-INTERMEDIAUS	false
104.18.27.190	tracking.g2crowd.com	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	436463
Start date:	18.06.2021
Start time:	03:54:26
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 5m 3s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	19
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean0.win@3/152@33/23
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.intermedia.com/products/SecuriSync Browsing link: https://www.intermedia.com/why-intermedia/
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, ielowutil.exe, wermgr.exe, SgrmBroker.exe, conhost.exe, svchost.exe, UsoClient.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 184.24.20.248, 142.250.186.106, 142.250.185.200, 142.250.185.142, 23.50.98.76, 23.211.5.242, 104.16.88.20, 104.16.87.20, 104.16.89.20, 104.16.86.20, 104.16.85.20, 172.217.23.110, 142.250.185.78, 172.217.16.142, 142.250.185.110, 142.250.185.174, 142.250.185.206, 142.250.185.238, 142.250.181.238, 216.58.212.174, 142.250.74.206, 142.250.186.46, 142.250.186.78, 142.250.186.110, 142.250.186.142, 142.250.186.174, 13.107.42.14, 142.250.184.196, 96.7.53.23, 152.199.19.161, 23.211.4.86, 173.222.108.210, 173.222.108.226, 52.147.198.201, 13.64.90.137, 52.255.188.83, 13.88.21.125 Excluded domains from analysis (whitelisted): au.download.windowsupdate.com.edgesuite.net, cdn.jsdelivr.net.cdn.cloudflare.net, e10776.b.akamaiedge.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, wildcard.marketo.net.edgekey.net, e11290.dspg.akamaiedge.net, e9706.dscg.akamaiedge.net, iecvlist.microsoft.com, l-0005.l-msedge.net, go.microsoft.com, www.googletagmanager.com, audownload.windowsupdate.nsatc.net, e8999.b.akamaiedge.net, www.google.com, watson.telemetry.microsoft.com, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.google-analytics.com, www-linkedin-com.l-0005.l-msedge.net, skypedataprdcolwus17.cloudapp.net, fs.microsoft.com, www-google-analytics.l.google.com, ajax.googleapis.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, a767.dscg3.akamai.net, skypedataprdcoleus16.cloudapp.net, youtube-ui.l.google.com, skypedataprdcoleus17.cloudapp.net, wildcard.licdn.com.edgekey.net, wildcard.marketo.com.edgekey.net, go.microsoft.com.edgekey.net, blobcollector.events.data.trafficmanager.net, skypedataprdcolwus15.cloudapp.net, cs9.wpc.v0cdn.net Not all processes where analyzed, report is missing behavior information Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\QAD0GKHX\www.intermedia[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	84740
Entropy (8bit):	5.172397902717591
Encrypted:	false
SSDEEP:	384:scSh8SO8SO8SW9r8SW9r8SW9E8SW9Q8SW9Q8SW988SW9V8SW9V8SW9c8SW9c8SW/:922BFF5wwZnX3q7UpmIomLLt3fR
MD5:	A0322D672212693D3555E84156905952
SHA1:	E8186F924765371F3CD84DA437C06D8F56FE0148
SHA-256:	1817852BAB07C18BA32A73B225A42B0E6D1D7C0F4C0BAE7BE54FA05CC848CE1F
SHA-512:	6E5C09CE5BD3D7A74F0CC44DCDA47EB6AC78065F3D18AEDB5BB0D08AA87664878199FB2BE0276C84CCBFC8E1F571C1CF915E756ED3786117A059BBFCE3278E21
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root></root><root><item name="_ym19278121_lsid" value="1412867928199" ltime="2505813216" htime="30893104" /><item name="_ym19278121_reqNum" value="1" ltime="2505813216" htime="30893104" /></root><root><item name="_ym19278121_lsid" value="1412867928199" ltime="2505813216" htime="30893104" /><item name="_ym19278121_reqNum" value="1" ltime="2505813216" htime="30893104" /><item name="_ym_uid" value=""1624013786379863379"" ltime="2505813216" htime="30893104" /></root><root><item name="_ym19278121_lsid" value="1412867928199" ltime="2505813216" htime="30893104" /><item name="_ym19278121_reqNum" value="1" ltime="2505813216" htime="30893104" /><item name="_ym_uid" value=""1624013786379863379"" ltime="2505813216" htime="30893104" /><item name="_ym_synced" value="{}" ltime="2505813216" htime="30893104" /><item name="_ym3_lsid" value="869298614111" ltime="2506333216" htime="30893104" /></root><root><item name="_ym19278121_lsid" value="1412867928199" l

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\VRE5PYW9\app-sj01.marketo[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	131
Entropy (8bit):	4.380405392955556
Encrypted:	false
SSDEEP:	3:D90aK1r0aK1ryRtFwsxAC5EJVqGCj58BLDAqSeWUZA0aK1r0aKb:JFK1rFK1rUFSC5EJVqGCj58BLYeTZAkY
MD5:	0D5CF74DDF811D25498277F34E978169
SHA1:	9AB80B8E43B3FBC9A01BBD6F8A5B0154CC9B3977
SHA-256:	15ED7A5A0D48DE496914AB2E2A21CCE1899A207ED78A3F1244A268C154B6DD5F
SHA-512:	7B2A0F9BF59C2400F199078087A8C3684E9A1C693F47D2588B45991F09036750621235C0B8E3B42BC8DA168AEA289114A20BA7EC8D6E04CD886A7469689E7D26
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root><root><item name="modernizr" value="modernizr" ltime="2577333216" htime="30893104" /></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C4C43A1B-D023-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8554368178824838
Encrypted:	false
SSDEEP:	192:reZ5ZTf2TsWTGtTtfTvFMT0TkPTCfTosX:rqvy3yBS4sU1
MD5:	18812A4B8F31C3D00C0E6C1C243573CD
SHA1:	987687EE656D4D947ADD0EC70900691621FD7B09
SHA-256:	872F0B7EA6810D64F1C339376A5B4BE49F095EF916CA7637BCF00CBB59BE9E5E
SHA-512:	56D0BA9D5140B216AEA06BFD44EACCA3D3ACB0772F5D4744F8AF17AB65EB68E8E0F57B37AE3F417D366D11AC1261BBA6AFC69CFD4731B06DA1AB61A06AC01C1C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C4C43A1D-D023-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	114384
Entropy (8bit):	2.6264631776282443
Encrypted:	false
SSDEEP:	384:rkk6nmok/gdY5IDzv/EtgsgBAXkX9X7eVLXnBAXkXM0lGSVQW4NtxoSVlXm0vxHJ:+A0tcRA06YAxqoxuCGDgxMidgxMR
MD5:	967843ADF3A52DBC2BCD1C8E2E33EE60
SHA1:	921C0C78E08380542E31969ADC4958E39F9C4080
SHA-256:	FCE830C7F5809DB9D3F553DE03FA421819BAE633339B6A4F1CB592BFCBC33F34
SHA-512:	F80C0EFE581A3BC4CA6A61D34D4D3AAC5969DA8A7F383419D59E567AA33B067552EC8DDD22184D6E150A4199CBB4E2A5F0E70ED36378A64D803CD90A034995D4
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CCA3CA89-D023-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.564083817200676
Encrypted:	false
SSDEEP:	48:IwFGcpr8Gwpa9G4pQRGrapbS+cGQpKEUG7HpRE7TGIpG:rbZ0Q/6hBS+0AEfTExA
MD5:	F4E3EC6571F15B5136A92BEF90485078
SHA1:	657B7E01D6D30A7308B9145CFF800ED2317472E2
SHA-256:	006FD8330388C7763FF021C7EC79E5435C705B1DFAFF03F3856FF2F60E507609
SHA-512:	4E24EE2BBF6E58C8D965936D58822802F98698427EA9261809B35B7FD9C33BD24548CE77D209B8110954C8019184A2A8A32A9D6AF0F6AABAC475AE9B6CE3AA89
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	470
Entropy (8bit):	3.0427659580385438
Encrypted:	false
SSDEEP:	12:AHQUnlU1ANbplkyw/mbekekekekekekek555bFFFFFFD55vep:AHQklMo/nwmbekekekekekekekRFFFFc
MD5:	4BCE4ABD0EF1D9C8D424A7E186927381
SHA1:	333392BB1BEEAC829DE5F651C877A0D97C2F7907
SHA-256:	8FAE18B23DCABE7609EEDFD5300F58168C31FD7CE96E7D79991555AB4C741251
SHA-512:	993AFFBDBE10ECE525DB337822EA9F732A8CF4B6A0C6A5404C4484BE827B04A0C5F4901D72364E615EA084E9C39129C4DA8EF32FA45B4E19241C82DD26147C42
Malicious:	false
Reputation:	low
Preview:	9.h.t.t.p.s.:././.w.w.w...i.n.t.e.r.m.e.d.i.a...c.o.m./.a.s.s.e.t.s./.t.r.a.c.k.e.d./.i.m.g./.f.a.v.i.c.o.n...i.c.o.>.................(.......(....... .......................................3......$................................................................................0. .@...0. .@...0. .@...0. .@...0. .@...0. .@...0. .@...0. .@...................................................................................................................{.`.....{.`....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2164[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
Reputation:	low
IE Cache URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/2164.js?p=https://www.intermedia.com/why-intermedia&e=94495bbf-4e46-4448-9358-3f4d8e508a54
Preview:	// Tracking File

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\387569738474119[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	533904
Entropy (8bit):	5.4725986149767705
Encrypted:	false
SSDEEP:	6144:Rk1HgCSntDV/HaKKV/Ha8NEPjQHguH3HpQrwz8GW9k1HgCSntDV/HaKKV/Ha8NEl:CNE7cNE75
MD5:	CB9D2CC6DB300AF8ECC64CA58188F394
SHA1:	1D189C37B0E23CA76C2B7B66B26B05AED6FC7C39
SHA-256:	207FF6097684196739A88981B2B68DF01D3D5A7C55AE2FFD29EED0B5024B5223
SHA-512:	7F026142EEF23ECA52C923B75F5D3D612B2C3E3C1D983FEC5BE411872645E038E05BDE83F6F5E993E5899339CD20985B4138724CE975C6E097205B25BBA21B11
Malicious:	false
Reputation:	low
IE Cache URL:	https://connect.facebook.net/signals/config/387569738474119?v=2.9.41&r=stable
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\387569738474119[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	266952
Entropy (8bit):	5.4725986149767705
Encrypted:	false
SSDEEP:	6144:Rk1HgCSntDV/HaKKV/Ha8NEPjQHguH3HpQrwz8GWb:CNE75
MD5:	701A9A99E83FD26B924DE9F7B52BEB08
SHA1:	2A14FAD1125D75936E71EDADD0AD835D0C01163A
SHA-256:	5D4787248BFB504C4794D889B8A37292B31298B85043BDA1423A723496AECD68
SHA-512:	D52762B0714CFF273F4A889A584EC400FA75A3A9179C0FFFB2D5962B0177178D159879CE43F07B657E493A06DC4BDDC463B9A69486235A859948EF690A6C2C33
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\anz[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2722
Entropy (8bit):	5.0673670936558155
Encrypted:	false
SSDEEP:	48:coAXQSfEXAV0l4SYrdNOO8wubliEt60BU:AXQSfaPl4SO8wiiExBU
MD5:	532EF3AF87C8DBCCCE983DDFB9B1C292
SHA1:	287824D996658A732EFF87A676CEF7F252CBF23F
SHA-256:	20A57D334BEF19A28C7923E5265368E05378F1DF22CDC009ABDE3BFBC99165D9
SHA-512:	00C4A94932AFA41115BEC57DDB175BF2CD9058AEE538273E7FC6300AC6648270D92BCCDFCC3621ED5FDAB7F6E751DD6111D5C9973E5A6E644D0EE22BB235A0BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/flags/anz.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px"... viewBox="0 0 43 22" enable-background="new 0 0 43 22" xml:space="preserve">..<rect fill="#26356F" width="43" height="22"/>..<polygon fill="#FFFFFF" points="20,3 20,2 22,2 22,0 18,0 18,1 16,1 16,2 14,2 14,3 13,3 13,0 9,0 9,3 8,3 8,2 6,2 6,1 4,1 4,0 0,0 ...0,2 2,2 2,3 4,3 4,4 0,4 0,8 4,8 4,9 2,9 2,10 0,10 0,12 4,12 4,11 6,11 6,10 8,10 8,9 9,9 9,12 13,12 13,9 14,9 14,10 16,10 16,11 ...18,11 18,12 22,12 22,10 20,10 20,9 18,9 18,8 22,8 22,4 18,4 18,3 "/>..<polygon fill="#E11E39" points="22,5 12,5 12,0 10,0 10,5 0,5 0,7 10,7 10,12 12,12 12,7 22,7 "/>..<rect x="14" y="3" fill="#E11E39" width="2" height="1"/>..<rect x="14" y="8" fill="

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\cookieControl-8.0.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	27807
Entropy (8bit):	5.500903253740743
Encrypted:	false
SSDEEP:	768:9U7VBuKqhFazD9eB83sh4oAloA0g+CN5QtF7E:9U2KsazD9eB4RtvnXQtFA
MD5:	F24896C64426938C08CF496385EFA363
SHA1:	3807F981E07BE72FF8CBAEA86E9CA1FB398055CD
SHA-256:	F7747F6B3C907BCDF5BB5D567461E79A9B68C03587D0B11400DEB85C8526916A
SHA-512:	AB616EA3B1458C35208B9BEB4D6E353068690B471033A216274FCFDE4278A88B0855EF2AC424DDE95AAAA9327E866CC79BB0576C9A6F90326BE94679BF07899F
Malicious:	false
Reputation:	low
IE Cache URL:	https://cc.cdn.civiccomputing.com/8.0/cookieControl-8.0.min.js
Preview:	var CookieControl=function(){var p="accepted",n="revoked",v=null,r="0123456789ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz".split("");Math.uuid=function(t,e){var o,c,n=r,i=[];if(e=e\|\|n.length,t)for(o=0;o<t;o++)i[o]=n[0\|Math.random()e];else for(i[8]=i[13]=i[18]=i[23]="-",i[14]="4",o=0;o<36;o++)i[o]\|\|(c=0\|16Math.random(),i[o]=n[19==o?3&c\|8:c]);return i.join("")};var C=null,t={necessaryCookies:[],optionalCookies:{},initialState:{},statement:{},consentDate:Date.now(),consentExpiry:90},w=JSON.parse(localStorage.getItem("ccConsentState"))\|\|t,o=localStorage.getItem("ccConsentUser")\|\|Math.uuid();localStorage.setItem("ccConsentUser",o);var S={COMMUNITY:"CookieControl Free",PRO:"CookieControl Single-Site",PRO_MULTISITE:"CookieControl Multi-Site"},a=["BE","BG","CZ","DK","DE","EE","IE","GR","ES","FR","HR","IT","CY","LV","LT","LU","HU","MT","NL","AT","PL","PT","RO","SI","SK","FI","SE","GB"],l=["Belgium","Bulgaria","Czech Republic","Denmark","Germany","Estonia","Ireland","Greece","Spain","

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 16 colors, 4 bits/pixel
Category:	downloaded
Size (bytes):	318
Entropy (8bit):	2.4627473262974844
Encrypted:	false
SSDEEP:	6:8zE/cFUFIsjksjksjksjksjksjksjkn555bFFFFFFD55n:8w/mbekekekekekekek555bFFFFFFD55
MD5:	2AF95D1CDA9CCD4648425BEBA0C63493
SHA1:	65F52235E955684ABFAD3D54343E238FEAE29800
SHA-256:	20FAF4C65CD8F4D71D43D91095C3793038D6E136F0C8DEF56893BD2DF6573FE3
SHA-512:	4C454BD51EF6FC5C1A6F545114BC2650BFDD45DEF72A2943B66553D7C78D8130282BEBF341292453FD5EA5B93B8BED0C9AC176F97E093A64EAA0BE86F7F5C0A7
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/favicon.ico
Preview:	..............(.......(....... .......................................3......$................................................................................0. .@...0. .@...0. .@...0. .@...0. .@...0. .@...0. .@...0. .@..................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\fbevents[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	95938
Entropy (8bit):	5.395551905316836
Encrypted:	false
SSDEEP:	1536:5M+OWtI6ay9Ies1zKqQqfUThe7Kdv0a9sIOs1jaV7vu5Om20C+QNSMngySZYSlIa:5zNpkjSVnYDGeI
MD5:	38EEDE6B7D7BC51D9D0935E3850DAD20
SHA1:	D0B0061C020A48B5DFB8CC19C15694D8B7E6896F
SHA-256:	547F226C6E04B6654144617685448D360E2A92D908C6FB646761A1E6D4850004
SHA-512:	164B13C0764FFA43CCB45455BB20CF4E32ADEC23DA1666E2E2D613172070B9E734E9F007A3593D1457B023920D359084A7BDAB8D80F37A09824D763A07B06D48
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\forms2.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	209287
Entropy (8bit):	5.49608628178514
Encrypted:	false
SSDEEP:	3072:r/i/bncR4dIcjidMAHOhqR4+dWGVPF44nhRAHLa98Hrxj2MtZ:r67DdjMVHOQDdWGlYLa98Hrxj2Q
MD5:	C63399EEAEB21D1CFCA1CB417241FFB3
SHA1:	ADFDEB23C7C69395F3D21C57E5DDFBD3883742B5
SHA-256:	014DE295141A456CEDA8E3C4762085E53DCA50F91DDF65906D227F70CF0B1A55
SHA-512:	14C2A902C771F3F98956200E418D8DE6EF1559D96E09F66D6C0233C5D147C61A0249D1D0BE6C8EE22D1B5B7029909EAA98BE0C40B9CE1CA4D2197196AD887D43
Malicious:	false
Reputation:	low
IE Cache URL:	https://app-sj01.marketo.com/js/forms2/js/forms2.min.js
Preview:	/! forms2 2021-01-13 See forms2.js for license info /.!function a(b,c,d){function e(g,h){if(!c[g]){if(!b[g]){var i="function"==typeof require&&require;if(!h&&i)return i(g,!0);if(f)return f(g,!0);var j=new Error("Cannot find module '"+g+"'");throw j.code="MODULE_NOT_FOUND",j}var k=c[g]={exports:{}};b[g][0].call(k.exports,function(a){var c=b[g][1][a];return e(c?c:a)},k,k.exports,a,b,c,d)}return c[g].exports}for(var f="function"==typeof require&&require,g=0;g<d.length;g++)e(d[g]);return e}({1:[function(a,b,c){var d="ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789+/";!function(a){"use strict";function b(a){var b=a.charCodeAt(0);return b===g\|\|b===l?62:b===h\|\|b===m?63:i>b?-1:i+10>b?b-i+26+26:k+26>b?b-k:j+26>b?b-j+26:void 0}function c(a){function c(a){j[l++]=a}var d,e,g,h,i,j;if(a.length%4>0)throw new Error("Invalid string. Length must be a multiple of 4");var k=a.length;i="="===a.charAt(k-2)?2:"="===a.charAt(k-1)?1:0,j=new f(3*a.length/4-i),g=i>0?a.length-4:a.length;var l=0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\forms2[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	13367
Entropy (8bit):	5.057936866539623
Encrypted:	false
SSDEEP:	192:1maFFZjROLUFKza7EIU6hUFRuKt3FLrOamnFvr2S1:13FZjROwFKzB6hUFRNFLiaeFvaS1
MD5:	56655DA87943D0E5EF98E742AE6EE3D2
SHA1:	AA87802906516962A3EC0F444031F7154B70F0AF
SHA-256:	256E42104F48A5FA80B031DA12DC56ACDE224FBA3F9810F8F8192B39136D365A
SHA-512:	0478226BADA3BA5CD80A70265B37B723F56804C35F94632CD0255F35776C93294C9EE799B3787EBCB43B1328212CB828B06ADDCD5E9FD33FFE639E9B3E5999A6
Malicious:	false
Reputation:	low
IE Cache URL:	https://app-sj01.marketo.com/js/forms2/css/forms2.css
Preview:	/* This is used to test if the stylesheet has been loaded yet/.#mktoStyleLoaded {. background-color: #123456;. display: none;.}..mktoForm {. text-align: left;.}..mktoForm .mktoClear {. clear: both;. float: none;.}..mktoForm div,..mktoForm span,..mktoForm label,..mktoForm p {. text-align: left;. margin: 0;. padding: 0;.}..mktoForm input,..mktoForm select,..mktoForm textarea {. margin: 0;.}..mktoForm {. font-family: inherit;.}..mktoForm .mktoOffset {. float: left;. height: 1.2em;.}..mktoForm .mktoGutter {. float: left;. height: 1.2em;.}..mktoForm .mktoFieldWrap {. float: left;.}..mktoForm .mktoFieldWrap .mktoInstruction {. display: none;.}..mktoForm .mktoLabel {. float: left;. line-height: 1.2em;. padding-top: 0.3em;.}..mktoForm .mktoField {. line-height: 1.2em;. font-size: 1em;. float: left;.}..mktoForm .mktoPlaceholder {. float: left;.}..mktoForm .mktoLogicalField {. float: left;.}..mktoForm fieldset {. padding: 0;. margin: 0;.}..mktoForm fieldset legend {.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\heap-160018915[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	105099
Entropy (8bit):	5.41856905986454
Encrypted:	false
SSDEEP:	1536:UlpFin+E/ZKhk1eAW/T+uU3y/Zzo/9++vt5EPUeeWBfKV2olSn:Ug3SkyQozo/9+OEcuAq
MD5:	12A094086DA134B6FA692657972A18C0
SHA1:	F266100BA2BE89210C1DBA292BF919A000E5DEB6
SHA-256:	88F24BBEB910DFE3D1C2FC76C6EB5860C795BA1E03B8F83BA192A20CE95B6DE0
SHA-512:	A1EAEC369B9397904D491D55F26896308CBB024B3982EB71614E3791E71F3133C48E38756EB92D347B924D51FBC6E9A76F8CD734F836A0774A19D7518730947B
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn.heapanalytics.com/js/heap-160018915.js
Preview:	//@preserve v4.14.1+8a16a25356acc.!function(e){var t={};function r(n){if(t[n])return t[n].exports;var i=t[n]={i:n,l:!1,exports:{}};return e[n].call(i.exports,i,i.exports,r),i.l=!0,i.exports}r.m=e,r.c=t,r.d=function(e,t,n){r.o(e,t)\|\|Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){'undefined'!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:'Module'}),Object.defineProperty(e,'__esModule',{value:!0})},r.t=function(e,t){if(1&t&&(e=r(e)),8&t)return e;if(4&t&&'object'==typeof e&&e&&e.__esModule)return e;var n=Object.create(null);if(r.r(n),Object.defineProperty(n,'default',{enumerable:!0,value:e}),2&t&&'string'!=typeof e)for(var i in e)r.d(n,i,function(t){return e[t]}.bind(null,i));return n},r.n=function(e){var t=e&&e.__esModule?function t(){return e.default}:function t(){return e};return r.d(t,'a',t),t},r.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},r.p="/js/",r(r.s=9)}([function(e,t,r){"use strict";Object.defineProp

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\index[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	682251
Entropy (8bit):	5.077235309709643
Encrypted:	false
SSDEEP:	6144:32IKj8Wm1oDNBKpN6Fd7otoDEqY82XDidkcEG:32IKj8Wm2JBHFd7otoDEqY82XDidkcEG
MD5:	5285DE3994EB2AC1EC1EA96245CBEB9F
SHA1:	F915D7463E39FA7212AAFD8686AC99A9E02F175D
SHA-256:	1FD8700114435E8E9FFB5382063850DC5DB52FE36D8B8E6D669719D85BEEEB67
SHA-512:	4DDFF01117FDAF19507D3C275141B760A6CE6B0B79C718C8045183FE8C407266EB1AE44FEAE2356CFF02FC06F7BB177FD9B012034F6AC5F8C05F4568AFE7A680
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/css/index.css?version=54654656
Preview:	/! fancyBox v2.1.5 fancyapps.com \| fancyapps.com/fancybox/#license /.html{font-family:sans-serif;-ms-text-size-adjust:100%;-webkit-text-size-adjust:100%}body{margin:0}h1,h2,h3,h4,h5,h6,p,a,blockquote p,blockquote cite,.mod-accordian > ul > li a,.table-video .col-2 h3,form .mktoErrorMsg,.mod-tabbed-content nav[role="tabbed-nav"] li,.mod-tabbed-content nav[role="tabbed-nav"] li[data-subtitle]:after,#landing .hero-promo,.p-header .center .hero-headline h1,body #ya-site-results,body #ya-site-results .b-serp-item__title,#why_intermedia .mod-pillars .pillar h3{-webkit-margin-before:0em;-webkit-margin-after:0em;margin-top:1em;margin-bottom:1em}ul,ol{-moz-padding-start:0;-webkit-margin-before:0em;-webkit-margin-after:0em;-webkit-margin-start:0;-webkit-margin-end:0;-webkit-padding-start:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,nav,section,summary,body#about_careers #content #info-box{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:basel

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\insight.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	4774
Entropy (8bit):	5.518986103890679
Encrypted:	false
SSDEEP:	96:yvc+dEEqOmEM0fUBpL5CN6jKaYmd97KHijQcAoyvXe/J2Gnzr8D/e:x1EOEgzAK7N+oyvIJhv2e
MD5:	C4440888B2ED74F2A104115FC1D3C737
SHA1:	81359FD8D29CF6AFFD5B27317C379E53DDAEF00F
SHA-256:	6E6E6A03E72A528C28884B50BF296425667F38DD0AAF1DD17CE89199FFC85271
SHA-512:	5BE97F4FB111C4BBF32543B7581796AEBB3277585B5F7AF909E4E99765523ECCAFF300DA81533F6F0FE2A27D4A775DE3F3731E6B4E837B5070CC988A7A699C09
Malicious:	false
Reputation:	low
IE Cache URL:	https://snap.licdn.com/li.lms-analytics/insight.min.js
Preview:	!function(){"use strict";function n(){return(new Date).getTime()}function c(n,e){var i=n.cookie.match(new RegExp("(?:^\|; )"+encodeURIComponent(e).replace(/([\.$?\|{}\[\]\\\/\+^])/g,"\\$1")+"=([^;])"));return i?decodeURIComponent(i[1]):""}function l(n,e,i,r){var o=r.days_until_expiration,t=void 0===o?1:o,a=r.path,d=void 0===a?"/":a,_=r.domain,c=void 0===_?null:_,l=function(n){var e=(new Date).getTime()+n,i=new Date;return i.setTime(e),i.toUTCString()}(864e5*t),s=encodeURIComponent(e)+"="+encodeURIComponent(i);s=s+";expires="+l,c&&(s=s+";domain="+c),s=s+";path="+d,n.cookie=s}function r(n){return n.webkit&&n.webkit.messageHandlers&&n.webkit.messageHandlers.LIPixli\|\|!1}function e(n,e){var i="https://px.ads.linkedin.com/collect?"+e;r(n)?n.webkit.messageHandlers.LIPixli.postMessage(i):(new n.Image).src=i}function i(n,e){var i="https://px.ads.linkedin.com/insight_tag_errors.gif?"+e;r(n)?n.webkit.messageHandlers.LIPixli.postMessage(i):(new n.Image).src=i}function s(n){return n.map(functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	95816
Entropy (8bit):	5.499438440314399
Encrypted:	false
SSDEEP:	1536:B1+XJVesTp0ZfITFDvJLWiyo7yGxNdDjjh4pVM6XCqv1895/Pty6BHFo93sAtT01:Bg5VeC0CDvJzi2dT2M5qOrKttTVnc9
MD5:	0CF95A92F21874296132A62BD48009DD
SHA1:	27B5A3EA9F20C43E402E413D21DDA8C967E39D95
SHA-256:	FF80923943F362EFA62AAF278C3CCF585336327C49A34A58D0E4EA115415D60A
SHA-512:	FF314931BE33B7C64707B8477BFBF0301C4854EF92F3989A16F7C2F2A3BEA084FC16DB6EF5E560676609378427529E170CEB723468B320F2082EEBB1D60E4D01
Malicious:	false
Reputation:	low
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"38",. . "macros":[{. "function":"__e". },{. "function":"__dee". },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":false. },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__exs",. "vtp_measurementId":"r6fbIoynSqexBSoAMqp9wQ",. "vtp_sections":["list",2]. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "function":"__cie",. "vtp_experimentState":["macro",4],. "vtp_trafficCoverage":["macro",5],. "vtp_trafficCoverageHash":["macro",6]. },{. "function":"__c",. "vtp_value":false. },{. "functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\js[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	95816
Entropy (8bit):	5.499425916240272
Encrypted:	false
SSDEEP:	1536:B1+XJVesTp0ZfITFzRvJLWiyo7yGxNdDjjh4pVM6XCqv1895/Pty6BHFo93sAtTY:Bg5VeC0CdvJzi2dT2M5qOrKttTVnc9
MD5:	56F4CEDBC49B8DF2D9B63995F69EC6E4
SHA1:	63A28E6CC0F9A11BC6372B3C6EB140B5F52B41F7
SHA-256:	A8C73927510B8D436F50B35F17D10F1D17A6A922330DA194034FD358151E9360
SHA-512:	755EAFA3D45F5D9093FB7F34CB0CD375A5A04E282024448798B66517CB49F10BDD5CB0A620E639FF86BCC37726432D582DACE3BD19F8DF5775587BC62B7F3311
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/gtm/js?id=GTM-KJF2NWF&t=gtm11&cid=1641651054.1624013785
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"38",. . "macros":[{. "function":"__e". },{. "function":"__dee". },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":false. },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__exs",. "vtp_measurementId":"r6fbIoynSqexBSoAMqp9wQ",. "vtp_sections":["list",2]. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "function":"__cie",. "vtp_experimentState":["macro",4],. "vtp_trafficCoverage":["macro",5],. "vtp_trafficCoverageHash":["macro",6]. },{. "function":"__c",. "vtp_value":false. },{. "functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\log[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stb=1&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&mln=%5B%2218003797729%22%2C%228003797729%22%5D&t=%5B%7B%22h%22%3A181%7D%5D&_stk=65389331b63b84e5636e5385d48228ccef23ab2c&stv=35&cb=1624013882301&r=
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\nav-icon-call[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 80 x 80, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1020
Entropy (8bit):	7.480414899604754
Encrypted:	false
SSDEEP:	24:hDFB/JrwpjqruLCpnNmp0F/zorexqUHMr6OImPtEo4D6Q/i0CP:hZWomCmeF/Eqxnsr6FmPadleP
MD5:	E30030A957D8ED23C71A2DB82BD709EC
SHA1:	B652882DF04E7DBA61D977C526771CB12B7A105A
SHA-256:	D8C7DEC6908AC6EF016739EA4E8F8D410D9CC40490306F7FB69C25629B6EC62E
SHA-512:	282A580718BE330EFD9B3A336E6F25207F4427D5024519D9DFF2E75AE7F657FC2D11CCF8983AA5143EC950A62DD8F3DBEA5559D632C7E1EDFEBE5AE055140C55
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/nav-icon-call.png
Preview:	.PNG........IHDR...P...P.............PLTE....u..t..s..t..u..t..t..t..s..t..t..u..t..u..u..s..u..t..t..t..u..A..u..t..u..u..t..t..v..z..s..t..t..t..u..t..q..t..u..t..t..u........~.1.....a....A...........!......q..Q..M.n...tRNS......p......xG%..W@...~P9,..ha2.M....f..u[....IDATX..v.0.........v..P.K;...6...FBBn...?..M..........^....T.h3m".?....vRE>....qn.J..1x.U.....O7....I......]<.)8..O.........?P../.pIf..wI.K..Z........s:$h..@..m...<z.q Hb0T. .S.g%>...Y.(.y.]J...9\.>.0H..y.c'6Ft..H\|.C..'.q.q.S......Y.....?.vM....C...O`.....Q.]?..pe.2..e.C...mLW5(.\|d...H...4.Y.h......<.3.h..2.g.'......J4EJ,..x,.e....:.....#n..\|.[b.....(-..5...c..[.@.lR,.....'2.g.T.._,se....K...N...R+r.L<...C4.Jz6~..I$O...P;.Gm:dib.....w......Q....1.......u...0L..6..B.H/.-....$;c.aGJU...q.i%..g<........<}..CK.).g-.ni..iGg..zN..._.\|] ._(..C..I..2N.P.c?...(.1.......%LHP.'x...L.6.z....I.F.~^.....xE...L..).=p.[.q... ..&...h...t.y....w....3.._}=.s..6....,..mu.${.i....z;_h,._

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\player_api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1960
Entropy (8bit):	5.305794466576843
Encrypted:	false
SSDEEP:	48:E1HXmtEP0PcSAXW5kaJLzwYhn1HXmtEP0PcSAXW5kaJLzwYhQ:ExCMm5kaJL0YhnxCMm5kaJL0YhQ
MD5:	3D3E3C53D48FA10E5ABF56B76F139A7A
SHA1:	13448CD0EB2BBA2BC3EC7B3685C01ED0C9D4D9DD
SHA-256:	10F6603F20B432AD5F6B93637040194F015FE89F98D7CFB32BE357A56157E60A
SHA-512:	99CB5C4EE47E264A2B2ABBF19711DC8248FBE9F33D081192A548EFC353D59D5216833FA29F9229772C26088812E25386A31FA019D8E5D13D6C18EB9BE533102C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/player_api
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/997fe684\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;for(var i=0;i<l.length;i++)try{l[i]()}catch(e$0){}};YT.setConfig=function(c){for(var k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",n)}var b=.document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.var scriptUrl = 'htt

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\products-overview-form[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4191
Entropy (8bit):	5.149687900435036
Encrypted:	false
SSDEEP:	96:aNStepkNc0crdTLQRER8RjcR/6oidWBEqXTsktOtUX0pl:aNSI6DaTLE4A0/6oidWBEKTfOtUX0pl
MD5:	61D4FC7D426AAE9CE4ED3B9D1B5535D1
SHA1:	3C80467AC11AF21B831B90F473509909BACAE5DB
SHA-256:	DF5F4BB0E14082B01062F356BC422759D1EF4F4FEE08C9E94E6E9FFE2D7F56EF
SHA-512:	00A75E5035AE42B9F36FAA6A1E4E170D5C618B7ED890A4B465201053554471644E22617EE3A80CE57CCD289A34F0E2C00577A8BD72D5FCD4C63D3D377DF0FAB7
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/js/products-overview-form.js
Preview:	(function() {...var currentYPosition = function() {....// Firefox, Chrome, Opera, Safari....if (self.pageYOffset) return self.pageYOffset;....// Internet Explorer 6 - standards mode....if (document.documentElement && document.documentElement.scrollTop).....return document.documentElement.scrollTop;....return 0;...}.....// Swiped from SO...var smoothScroll = function(position) {....var startY = currentYPosition();....var stopY = position;....var distance = stopY > startY ? stopY - startY : startY - stopY;....if (distance < 100) {.....scrollTo(0, stopY); return;....}....var speed = Math.round(distance / 100);....if (speed >= 20) speed = 20;....var step = Math.round(distance / 25);....var leapY = stopY > startY ? startY + step : startY - step;....var timer = 0;....if (stopY > startY) {.....for ( var i=startY; i<stopY; i+=step ) {......setTimeout("window.scrollTo(0, "+leapY+")", timer * speed);......leapY += step; if (leapY > stopY) leapY = stopY; timer++;.....} return;....}....for ( var i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\rtp[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	154883
Entropy (8bit):	5.467827310935559
Encrypted:	false
SSDEEP:	3072:HI2dxlBUcNmOV81eF8CNt8RYokpuVHi3j8j4ZJT:HI2dxlBUcNmGB8CNt8RYNpxAjI
MD5:	ECEAEFFED5B1FA7076EE630319871556
SHA1:	D770F211BFB7284652118C8B8BB9F4984C7B82BE
SHA-256:	A78A4E9FE1B48CB0595E5C2AC139737D5E165A8E50D40AF41E0359E74D47FC86
SHA-512:	7C46C1A48DEF92EB1B3500DF9BEC3259DF831745BDD39983F670BC2E526026EAFD307E419D2CC5A9216627AA1906D2CC91F2F96D07750FF8A8C13738E28C26F6
Malicious:	false
Reputation:	low
IE Cache URL:	https://abrtp1-cdn.marketo.com/rtp-api/v1/rtp.js?aid=intermedia
Preview:	/!. TRW.js version 3.16. /.(function(a){var d="%",b={checkPattern:function(e,f){if(f.indexOf(d)==0&&f.lastIndexOf(d)==f.length-1){f=f.substring(1,f.length-1);return e.indexOf(f)!=-1}else{if(f.indexOf(d)==0){f=f.substring(1,f.length);return e.lastIndexOf(f)==e.length-f.length}else{if(f.lastIndexOf(d)==f.length-1){f=f.substring(0,f.length-1);return e.indexOf(f)==0}else{return e==f}}}},compareWithWildcard:function(n,e,f){var l;if(f===undefined\|\|f==null){l=d}else{l=f}var j=e.split(l);if(!this.validateParam(j[j.length-1])){j.pop()}var m=e.indexOf(l)+1==e.length;var h=e.indexOf(l)==0;if(m&&j[j.length-1].lastIndexOf("/")+1==j[j.length-1].length){j[j.length-1]=j[j.length-1].substring(0,j[j.length-1].length-1)}for(var g=0;g<j.length;g++){if(g==0&&!h){if(n.indexOf(j[g])!=0){return false}}if(g+1==j.length&&!m){if(!(n.indexOf(j[g])+j[g].length==n.length)){return false}}var k=n.indexOf(j[g]);if(k==-1){return false}n=n.substring(k+j[g].length)}return true},validateParam:function(e){return(e!==unde

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\search-icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 61 x 61, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1626
Entropy (8bit):	7.797312458118968
Encrypted:	false
SSDEEP:	48:mlBYgzv9B7/jnR0F+BxOjz3TbmVxuBFGL:mlBjzz77R00nOTbOuBM
MD5:	237DFCB521D7FA90B6F2B9E59D2B2F4B
SHA1:	6F961369A4795EACBD58DA0ACB78E80FD15D0303
SHA-256:	74855A78E1A4EE0416297176C142E5B794C5D1F8234D4492208FBCA9BE5759E2
SHA-512:	62822F46177A699115FF7DE9194F4EF88579A110AD63F07668CE7C566291FEF6BD2329BECA860E46C8C9D9D9542B46078D1A724B92046B47B5551A3A8E5741E3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/search-icon.png
Preview:	.PNG........IHDR...=...=......ba.....sRGB........8eXIfMM........i...........................=...........=......).....IDATh..Z..E...'Q..B.HH..y...)....(....).. ......7.... e#..8.D...'`.E......M.U.'..V.=3=..-.3........?+j...{d(....e..T....#"u..TFF=%}...&U....>...n....t.:..1..j....dI.l..!...U[.9......(.6%......../h?-&.'}.N.V7.T......&=<.W..6..e..\|..X...G........0..T.DW.I..'........C..w........hA...2i}.". $.d. 2.r..r.<..:...............r...1..>.....e....X.eJ...}U.._.........;........L1.h.pA.^%[...n\|.;.'..iI...V..07l...:.)k..Ko:..f6@f.....pK.>A.3.....7..v..f..(.3.tK..Q,G.{R...^h)...H[+..,.#..6.pu...`g...G?.F..-.+..k..EiIh..:.g.....X...E.......~.iR4..l.NHODa6.VYx.....FRi.a..a..V.\.....lP......2...y......5\|..2A.o..+._.7ch.~G........W...B_lG..L...G..C.......b:..`.y.;'!........W.u5OliO.y{.y..,!..q..z..k.X.6....a.t4..X}..%.2^...;.R....:Rn..YIw..8.=..o..u..;..sZ.=.......c....Jkc...K=.D.....9.T.Z.#[);.f;.<..:O...:.#.k.K.@\|......;.C.,.Oo..W

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\shares[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	423
Entropy (8bit):	5.186211559317158
Encrypted:	false
SSDEEP:	12:Yw4tJLS1+A4IyTBRsfTakmgVskwflepBD:YptJ+f48TvmgFGlc
MD5:	A5CD0FA4FC04D9F5908BE0190B97B3AD
SHA1:	000E28640DF1D59FD6CBA6B7454C6DF8687BFE1B
SHA-256:	6FA5421BF6630EB873265195F9D04F9012EAEB730C6D86F722DC0955A0E5AB4D
SHA-512:	4B33B5E9B2121A924F1820A1826D6C98ABB2B671105612696728FA24E5E63E9F2EDFE69413F71B477E5D79B98DC0097EE3518FA1325227D2AAA514F2EF8EF20C
Malicious:	false
Reputation:	low
IE Cache URL:	https://us2sync.myonlinedata.net/metadata/v4.1/organizations/4104132/users/externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4/shares?include_owner=true
Preview:	{"total_item_count": 1, "items": [{"status": "accepted", "is_synced_by_default": true, "type": "weblink", "level": "read", "name": "VoIPTesterSetup_v5.0 (1).exe", "owner": {"identity": "8eba0a5f-2b83-494f-b349-7124438d7911", "type": "regular_user", "display_name": "AFM Demo User"}, "file": {"type": "file", "owner_path": "/8eba0a5f-2b83-494f-b349-7124438d7911/filesync/TEST!/VoIPTesterSetup_v5.0 (1).exe", "id": "Lw=="}}]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\splash[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	737
Entropy (8bit):	5.07376758700536
Encrypted:	false
SSDEEP:	12:taT3absM0yjL7Ft3Tw4aoz3g3R6+xsqaT3absM0j1pfsOn7p4uxozOA:tgqbslkL7Ft3kHQ3g3dsHqbsl5p0On7a
MD5:	3686AC40F8A4FF14BF5CBD63FFC7CCB6
SHA1:	B14BFCD26CF97FFF7E426CD3A545685664F315D4
SHA-256:	D1F32DA2A06264EAEE97EAD33E16D9C7BDFDC3F76B65974012778A666C844B80
SHA-512:	895C6ADE66B3FF838FAEB95558108DF911DDF29ACB9F0D3D105322B5E3904EB4C8BC901DC45464C6636F8DB6CD2E307D1BAF8D6E581403074F1545F5D217595D
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/theme/templates/splash.html?version=3.18.0
Preview:	<svg x="0px" y="0px" width="48px" height="48px" viewBox="0 0 24 24" enable-background="new 0 0 24 24" xml:space="preserve">...<g id="colored">....<polygon fill="#41B2E4" points="12,2 12,12 16,8 16,2" />....<polygon fill="#F05354" points="12,22 12,12 8,16 8,22" />....<polygon fill="#96BD3D" points="22,12 12,12 16,8 22,8" />....<polygon fill="#ED9522" points="2,12 12,12 8,16 2,16" />...</g>..</svg>..<div class="grey-logo">...<svg x="0px" y="0px" width="48px" height="48px" viewBox="0 0 24 24" enable-background="new 0 0 24 24" xml:space="preserve">....<g id="grey">.....<polygon fill="#DBDBDB" points="12,2 12,12 22,12 22,8 16,8 16,2 " />.....<polygon fill="#DBDBDB" points="12,22 12,12 2,12 2,16 8,16 8,22" />....</g>...</svg>..</div>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\styles[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	754
Entropy (8bit):	5.054985082836064
Encrypted:	false
SSDEEP:	12:jAE7F58sEnsNdd1EPXdPnEWSrLK9lZGXNdoTLJddo8FCJ8OJdo3dGiGiSNSmlGZv:jAk58svEPtEWSCsXgJXCJ8O88xk1ZXKC
MD5:	C3207A7F7CB79FBEA4BF4C6C5F5BB788
SHA1:	A262568E0B9793B2BFB7F29C225B7D51B9E3C55F
SHA-256:	03BBCE587AA64B6AC10B02F1F99B4222446AC3013AC86EC774D95FEECC7593F9
SHA-512:	832BA7876A3C49F52F357EE39EE86EAE0719DE26664E527459A37D731D473636C7672B7FCE453D5DC7C453FE19C62157FF794D85EFFCFB978C40FC5BB4F4B12E
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/theme/styles/styles.css?ver=3.18.0
Preview:	#splash-screen{margin-bottom:25px;animation:rotate-logo 5s linear forwards infinite;vertical-align:top;position:relative;height:48px;width:48px}.grey-logo{position:absolute;width:48px;height:48px;left:0;bottom:0;overflow:hidden}.grey-logo svg{position:absolute;left:0;bottom:0}#splash-screen .grey-logo{z-index:2;animation:loading 5s linear forwards infinite}@keyframes loading{0%{height:48px}25%,30%{height:0}50%,55%{height:48px}75%,80%{height:0}100%,95%{height:48px}}@keyframes rotate-logo{25%{transform:rotate(0)}30%,50%{transform:rotate(180deg)}55%,75%{transform:rotate(0)}80%,95%{transform:rotate(180deg)}100%{transform:rotate(0)}}.login-page h1{background:url(../images/icons/48/logo.gif?version=3.18.0) left top no-repeat;text-transform:uppercase}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\styles[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	223824
Entropy (8bit):	5.1579328779581886
Encrypted:	false
SSDEEP:	3072:LIYKa9/Hxz63ATs2eu+MQ4gA7ayVNQz/DUgoaE8rW:LIYKaL63ATs2eu+MQ4gA7ayVNQz/DL3W
MD5:	691A5CFC704071F9EEE6BD16C2E05907
SHA1:	DD8C0595E948442E22C06CADD66CE37B54D28089
SHA-256:	1E4BDD15474296A17AEC7FC908F6FF92AED7ED022A3EF8A81BAFCF81A3A56BF9
SHA-512:	0BD0DAB2066C29BCFA85E263EB46842A0A0DE503395AC0E987087BE0D9ED12E36F7C1CBE942620FCA758F4DDC669F15B93189598C1A3DAB44A37CC1267DF1AA6
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/sync/css/styles.css?ver=3.18.0
Preview:	.scroll-wrapper{overflow:hidden!important;padding:0!important;position:relative}.scroll-wrapper>.scroll-content{border:none!important;box-sizing:content-box!important;height:auto;left:0;margin:0;max-height:none;max-width:none!important;overflow:scroll!important;padding:0;position:relative!important;top:0;width:auto!important}.scroll-wrapper>.scroll-content::-webkit-scrollbar{height:0;width:0}.scroll-element{display:none}.scroll-element,.scroll-element div{box-sizing:content-box}.scroll-element.scroll-x.scroll-scrollx_visible,.scroll-element.scroll-y.scroll-scrolly_visible{display:block}.scroll-element .scroll-arrow,.scroll-element .scroll-bar{cursor:default}.scroll-textarea{border:1px solid #ccc;border-top-color:#999}.scroll-textarea>.scroll-content{overflow:hidden!important}.scroll-textarea>.scroll-content>textarea{border:none!important;box-sizing:border-box;height:100%!important;margin:0;max-height:none!important;max-width:none!important;overflow:scroll!important;outline:0;padding:2p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\sync_cookie_image_decide[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	https://mc.webvisor.org/sync_cookie_image_decide?token=9307.xdZLVc9f-rZzVMbnCyGMRcjrsDXKg75rHqprUJn5Ns1wmdZHERybUYHtt2JpJ0HKCRz_4zr0aXc6XGF-AxSNZO5MWkLQ1dFqxraUyV0ZISg%2C.ebtQEkJcl9j6ST3F3CkDhIwy5CM%2C
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\top-nav-login-customer[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 65 x 65, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1048
Entropy (8bit):	7.276041177459599
Encrypted:	false
SSDEEP:	24:Ia5qbK2kYOSVGWPfzmLK5fk08QWYFsBMEK2QrVvORNQ:IMqesVHPfqm1YooMEK22iNQ
MD5:	E9533B1B38ECB12CE7200C5BEDC4DA94
SHA1:	CB1168A57E93A6DDE44287B8BF24BC77FD8009B1
SHA-256:	E8037017C383707EB6C4F6727EFC2C8F5DD964173138B41A07ABF3D083DEA08B
SHA-512:	EB16ED08F7A5F0989E9732C9AE33A45778D784AEED89ED7CAC5F85F9A99325785F15F35F8655CC3EB745753F6764F2ED49C2A9B6A869465F46E8A43FDCE95B93
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/top-nav-login-customer.png
Preview:	.PNG........IHDR...A...A......)9w....PLTE.................................................................................................................................t..../..>...........%....\..M..G..y.......................z..[..V.....................y..q..?..?..3..-.......................f..e..5..%....tRNS..k....F-.....(.N..q`]QK9..P<....$.=........IDATX..yS.@...Mb$J....D.....7R@...Z.....F.....YH&....W..<.E..l....Q.d.TL......k...5uU.ed..Y..".....%...+.oyE...,..ty.8. .....`.->.. (e...#.u..D8..@^...[..4.7}......t.?..g..I.E.Z.....n-.-L.../..."...ay..C.$r3[.,B....wt).m.8.,.I.yF.n!.jL...n.{..I..T..(`.B..cRx.F...`d'3..i.I..\|.S.....O..8..p.NA...._.tG....2..-.'.....e.q..d!b.....81..g..j....Zh../2.t.m_...X.o.+\...H<.....~.{_.%......B..u0.;.z.o!./R.....t?. ..F....2...:.T.b.L. ....^....t.+H..._U.~x._]8.TfV;..?.7a....7.Ev...oL.JZp5....B.d...t\...$..l..7E......f....P.P......8%.r.!.J.,.RB'..p.49...#..#..#./..q$....H.)...W..7..y. wP

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\top-nav-login-pp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 65 x 65, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	834
Entropy (8bit):	7.110257944396539
Encrypted:	false
SSDEEP:	12:6v/7Ea7owN9lmZQ0D42YnEqenEO7q3dNNQktccKblQfdXFIToZKCqnhiVjCpx/n3:Bak29OQ0kEVEO6dNbrrIoKfngV0L7
MD5:	2D5D13763BB4016441F41EAEC08A10AB
SHA1:	7972A2F79727F42E2E1B1F69269A50DF601AB3B9
SHA-256:	A0AF5D5E291D636ED7DE1C4DDA2F5FE0F8653EE96BE905303C8D72A959315CDC
SHA-512:	A22ED9351BBE4DC766ABCBED9C21E7BC6B28FFD2E013DCA73B2A76451D4AC1BCB12C0EF311B8A3FA823E0FCB6CE6DB0B5A0A56D79D4DCA1410685DCDA151C22A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/top-nav-login-pp.png
Preview:	.PNG........IHDR...A...A......)9w....PLTE........................................................................................................................t..../..?....i..Pu..................x...b..H..8.........0..... .......X\|..............p.]`[...&tRNS....O..k..F:'...i..-..q`]K........c......IDATX...r.@...oQ/ $S\..\|.Nq.;..K...Q.2.Y.".....;.....q..Q.....(..c..*..MN.h..$op.F.....i..Jt;...6.P....`..Y....j.#lt.X.:....c./...C.q..Q..M.u9.........w1.JWq.n\.'.....^qe<w.3?,..\.d..@.p7..<3......7....x.W...\|h....t.4..).J.Lt!7...B.g.1.J.2._.@A..@..=.3..7.^....=...CJ.X{O~x.......... ..bD.B.PX..',..Q...V......'...........>\|.\|.r.Ba!D$,D....... ..Rx...[...\|@O.F....B.g...g5rA!.....@.w..Xpw..X.:;.:...f.....rI..2....]N.O.wZ.^-.........f..&..A.....6.3nw6..y+H.-....U...)M....;....9............f....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\top-nav-login-sp[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 65 x 65, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	891
Entropy (8bit):	7.2066461096857015
Encrypted:	false
SSDEEP:	12:6v/7aaOlM30aM1uN5VfjehpooN8PW8y1r3JhYwCjFbNfwPuQncw0JRuUvwhJYlnZ:3a8WjIutfjeEQ8FyjmwgZNfL/SfKL+i
MD5:	493745D5F68A08D06C7707C06404E7E8
SHA1:	4FC36346DB5F39432FD91F80DA88E04791E648EB
SHA-256:	F4031B4E6A31E32219C91DC84B188F1D5CA966C1D6E8C1F6E12FD08F45366E84
SHA-512:	55D35A5E455752B9AF3A617C3C8ED9577516926A6AD9F6AC33E36EB26DF7B5A34973C04090BDAA5F8C023DF0C2B5D65B066FEA743FCDC26A9988336398669082
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/top-nav-login-sp.png
Preview:	.PNG........IHDR...A...A......)9w....PLTE............................................................................................................t..../..N..........y.......}...........K..?..6..#~........................w..p..d..V........{..c..O..<.C.....#tRNS.k.......F:-..P..(.N..q`]K....$...s...)IDATX..i[.0.....@.......KA.A]...].....Z;)Mi.<.....!.........0z...>..A.,Hcm..)K.j...Z'%h......"....}..J.".Z%_p.@...<.........b... .vV..r..66A....k.,V7..-....E.T...7@..O.)'...9c....a^.4...D...;.'.._ $...l.c,1D..gH\P .`....3..,9U....!f....5.\.......N...d._#2P........d.)hd.....A....x.(..?q.`,. ...B<N..5...8<n...Vh...%.........p#/.......LY...3uI.b.2..>I.s)c...$....R`.\C(..........g1S3...S5..1y.f8...A.@..Z..<.>....f%U..Ki..R'./d.4S.ogR..!./...3....C./..R.......$.U....h7.{..>J....'.{Z.Z.../.g.1.V.c.~......C_{.....g..Hs 3..........o.{.i..8.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\tp.widget.bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	downloaded
Size (bytes):	21632
Entropy (8bit):	5.240358209452314
Encrypted:	false
SSDEEP:	384:Cl6H8gZF7F2QHLwirdsnAgb08nL+xudqz3w3FyjKrUegakVO5PH5yRjT5caHRB7I:Cl6cIF7FlrdsnAggaLMhz3w3FyZyORjY
MD5:	9D1F10064929DD7D6F92910FA34B6A30
SHA1:	D2BE9DAEDDA05026B932656771280AA61F02D1A9
SHA-256:	D279EA376A7E45170F380D993C36D80DA1617E38237C05491E5B0B840E75F0F0
SHA-512:	C88BFB8CC59F715F285CD1B30950F8EBA2C59988BBFB41D31DFFF571D2095D5B765871467A3C38F6D4AAEB9C1526CA7E4CA7D24881705932621AD1BA5064FF7A
Malicious:	false
Reputation:	low
IE Cache URL:	https://widget.trustpilot.com/bootstrap/v5/tp.widget.bootstrap.min.js
Preview:	.!function o(r,a,u){function l(t,e){if(!a[t]){if(!r[t]){var n="function"==typeof require&&require;if(!e&&n)return n(t,!0);if(d)return d(t,!0);var i=new Error("Cannot find module '"+t+"'");throw i.code="MODULE_NOT_FOUND",i}var s=a[t]={exports:{}};r[t][0].call(s.exports,function(e){return l(r[t][1][e]\|\|e)},s,s.exports,o,r,a,u)}return a[t].exports}for(var d="function"==typeof require&&require,e=0;e<u.length;e++)l(u[e]);return l}({1:[function(e,t,n){"use strict";var c=e("./constants.js").OFF,s=e("./xhr.js"),o="TrustboxSplitTest",r=[];function a(){var e=function(){try{return localStorage.getItem(o)}catch(e){return null}}();if(e)return e;var t=o+"=",n=document.cookie,i=n.indexOf(t);return-1<i?n.substring(i+t.length).split(";")[0]:void 0}function i(e,t){!function(e){try{return localStorage.setItem(o,e),!0}catch(e){return!1}}(e)&&(document.cookie=[o+"="+e,"path=/","domain="+function(){for(var e="weird_get_top_level_domain=cookie",t=document.location.hostname.split("."),n=t.length-1;0<=n;n--)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\tp.widget.sync.bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	downloaded
Size (bytes):	1312
Entropy (8bit):	5.294081621424985
Encrypted:	false
SSDEEP:	24:V6lLh2hP262JkiaOgB4lLv1GFURW3tRWZNtnkRW85VJ4KPtICjddjH3iMZc5j3:V67UPl2a4F1jw9wZTnkw85v48ICjPJiD
MD5:	901928912893C693700FE1B09842B5DD
SHA1:	08773982E60D89A23E354DACB481E6C347946D1E
SHA-256:	BD90495A01D0E283633E1B39FA2E683C85DB34C41D8BD4611D3B222EE8E80CA8
SHA-512:	9BB29868DCF94BCB62CE9D476A8DF8E6444AFF8D9B4D340317845FE403AEE90ABFAF980CC0661AECD8D95F78E311C68D74EACF675B8FE8853AA182439D23657D
Malicious:	false
Reputation:	low
IE Cache URL:	https://widget.trustpilot.com/bootstrap/v5/tp.widget.sync.bootstrap.min.js
Preview:	.!function i(a,s,l){function d(t,e){if(!s[t]){if(!a[t]){var r="function"==typeof require&&require;if(!e&&r)return r(t,!0);if(u)return u(t,!0);var n=new Error("Cannot find module '"+t+"'");throw n.code="MODULE_NOT_FOUND",n}var o=s[t]={exports:{}};a[t][0].call(o.exports,function(e){return d(a[t][1][e]\|\|e)},o,o.exports,i,a,s,l)}return s[t].exports}for(var u="function"==typeof require&&require,e=0;e<l.length;e++)d(l[e]);return d}({1:[function(e,t,r){"use strict";!function(){function e(){var e=void 0,t=void 0,r=void 0;if(s.getElementsByClassName)e=s.getElementsByClassName("trustpilot-widget");else if(s.querySelectorAll)e=s.querySelectorAll(".trustpilot-widget");else{var n=[],o=new RegExp("(^\| )trustpilot-widget( \|$)"),i=s.body.getElementsByTagName("*");for(t=0,r=i.length;t<r;t++)o.test(i[t].className)&&n.push(i[t]);e=n}for(t=0;t<e.length;++t)for(var a=e[t];a.firstChild&&"IFRAME"!==a.firstChild.tagName;)a.removeChild(a.firstChild)}var s=document;"loading"!==s.readyState&&e(),s.addEventList

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\us2[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	877
Entropy (8bit):	4.607247348158122
Encrypted:	false
SSDEEP:	12:Yhka91da91ua91uEia91OcJ1v1Ahza9118aeo1CyGaDLs1IDpGaq1wjHa91Ca91/:YhwZmQj1qJbD
MD5:	49801BBC6D9DD6B9C88651D258777BF4
SHA1:	1BD84D02ADCC20D4DDFF5D66431C115681FAECD1
SHA-256:	8FA1CED7830F0A169CA060D350DD9CEF24E98BFCC70C960798220C75720E0DBC
SHA-512:	2CF05C3C016A96A9D7AD7983FB5A545A82CEB8504396203295EE55925F49DF2EDA160195CA4C3F749AF1DF39A12232C7A4369BB2452AA4AFB5A47FA8954FC089
Malicious:	false
Reputation:	low
IE Cache URL:	https://auth.myonlinedata.net/locator/v1.0/pods/us2
Preview:	{"pod": {"id": "us2", "storage_service_url": "https://us2sync.myonlinedata.net/v3", "metadata_service_url": "https://us2sync.myonlinedata.net/metadata", "data_service_url": "https://us2sync.myonlinedata.net/data", "update_service_url": "https://us2sync.myonlinedata.net/update", "kms_url": "https://kms.us2sync.myonlinedata.net/kms", "message_bus_url": "wss://us2sync.myonlinedata.net/v3/message_bus", "diagnostic_service_url": "https://us2sync.myonlinedata.net/diagnostic", "auth_service_url": "https://auth.us2sync.myonlinedata.net/auth", "provisioning_service_url": "https://admin.us2sync.myonlinedata.net/provisioning", "wopi_service_url": "https://wopi.us2sync.myonlinedata.net/wopi", "chat_service_url": "https://us2sync.myonlinedata.net/chats", "data_sse_service_url": "https://us2sync.myonlinedata.net/data_sse", "web_app_url": "https://securisync.intermedia.net/us2"}}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\v[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.623939059213221
Encrypted:	false
SSDEEP:	6:Y0yQmcjBsk/zjqKSFy9QaK3LVYeYLwuaixj0Qm4iVXU:Y1QLxO1Fhp5kcRkj0Q0XU
MD5:	616798DA289105560D85A616408D14F1
SHA1:	5BD13AF1C8666F1678A6D51736661B379D75E53B
SHA-256:	0A30EC6F61A194399029DD0AEB5C9F969485759BAF18FC2BE00E53EC27E68119
SHA-512:	5F34567FD8753840190AE12033A7E1D952EE2EBAE88BCA0627A48B87AEFF42D39D4C09181FE635265D1B897559837E87A614966FB43E588174D882501C94E089
Malicious:	false
Reputation:	low
Preview:	{"valid":true,"format":"fields","product":"CookieControl Single-Site","version":"8","domain":"(^\|\\.)intermedia\\.com$","record_consent_state":"0","geo":{"country":"CH","countryName":"Switzerland","continent":"Europe","european_union":false,"success":1}}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\v[2].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	254
Entropy (8bit):	4.623939059213221
Encrypted:	false
SSDEEP:	6:Y0yQmcjBsk/zjqKSFy9QaK3LVYeYLwuaixj0Qm4iVXU:Y1QLxO1Fhp5kcRkj0Q0XU
MD5:	616798DA289105560D85A616408D14F1
SHA1:	5BD13AF1C8666F1678A6D51736661B379D75E53B
SHA-256:	0A30EC6F61A194399029DD0AEB5C9F969485759BAF18FC2BE00E53EC27E68119
SHA-512:	5F34567FD8753840190AE12033A7E1D952EE2EBAE88BCA0627A48B87AEFF42D39D4C09181FE635265D1B897559837E87A614966FB43E588174D882501C94E089
Malicious:	false
Reputation:	low
Preview:	{"valid":true,"format":"fields","product":"CookieControl Single-Site","version":"8","domain":"(^\|\\.)intermedia\\.com$","record_consent_state":"0","geo":{"country":"CH","countryName":"Switzerland","continent":"Europe","european_union":false,"success":1}}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\visitWebPage[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	2
Entropy (8bit):	1.0
Encrypted:	false
SSDEEP:	3:V:V
MD5:	E0AA021E21DDDBD6D8CECEC71E9CF564
SHA1:	9CE3BD4224C8C1780DB56B4125ECF3F24BF748B7
SHA-256:	565339BC4D33D72817B583024112EB7F5CDF3E5EEF0252D6EC1B9C9A94E12BB3
SHA-512:	900110C951560EFF857B440E89CC29F529416E0E3B3D7F0AD51651BFDBD8025B91768C5ED7DB5352D1A5523354CE06CED2C42047E33A3E958A1BBA5F742DB874
Malicious:	false
Reputation:	low
IE Cache URL:	https://524-vts-832.mktoresp.com/webevents/visitWebPage?_mchNc=1624013792536&_mchCn=&_mchId=524-VTS-832&_mchTk=_mch-intermedia.com-1624013787213-20042&_mchHo=www.intermedia.com&_mchPo=&_mchRu=%2Fwhy-intermedia%2Fcompliance&_mchPc=https%3A&_mchVr=160&_mchEcid=&_mchHa=&_mchRe=https%3A%2F%2Fwww.intermedia.com%2Fwhy-intermedia&_mchQp=
Preview:	OK

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\why-intm-header[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1379x920, frames 3
Category:	downloaded
Size (bytes):	111346
Entropy (8bit):	7.972209674537568
Encrypted:	false
SSDEEP:	3072:GNUC6QvbCFQ9fuuvp8p+Z51nYDfc7sdxO5jt2Orp8RrxQ0z:GNf6iWF/kNYgGI5Z3p83
MD5:	7F3C29C11B6301C50FD0E340974AECBD
SHA1:	C481643B8AC758BDC65E3DA508A3BA147334B83A
SHA-256:	696699AD11DE9EF4A4477E4A78C58A1C6FC900CF567F6B0EFDCD62B798AB1619
SHA-512:	0C2D1FBD0923072D5BECF0B14557A84883DC406A16B3C292D2A1F96482847EADC03063B9D0ED571A392EC7A9900879291765A8A589E446415E075D93CE978073
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/why-intm-header.jpg
Preview:	......JFIF.............C............................. .....!%0)!#-$..9-13666 (;?:4>0563...C...........3"."33333333333333333333333333333333333333333333333333........c...........................................................................................)........(...0.......`!.`2"..`...b.....P..K..A`......p.......AD...P........U.V+..DC#..0...F:Gh._.&M{L....B<.w..n.}.b.C..!.......@.....l...@@.1.C.......1.........`...@....;.....@. .......`....@....HB.....@.....YL:...U....O....F...L.9..w.`!..f. ..B. .....}O//.`!...`0..C.........b...a@C.0.B..`0B.t.......`.1.c....."1....0........@1...X.@(+....i.=&;X8.......;:.iY................(....I..0...a........!...@.$ .....`8(.!+#RB..B....A@..`0...!... ......`....D..\..OP+."B....F.4&...G......D...P!.....F.RD.....@D.S...F1Q.........`1....`!.S.@0..."T..1.".p.t..@...1..`....`..0..!.................{Y.H,!.b..*.5...r.!..gM...LU..RDe........Dc.....E..r_:.....C..b.....0..........:c.....(................C.....D..0..0.......B.Y.[..C (.Y..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\yse3ch7dkr4r[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	219027
Entropy (8bit):	5.324999131409446
Encrypted:	false
SSDEEP:	3072:W+1OhIq4F/45FUP8cD3RcvJd9Kr8J2158mGo7TVYO:dAJCgw58c1F
MD5:	A623A00422F2430B47912C809845AEF4
SHA1:	1BABCE22629DA1B15239F536454F1726CDFF545B
SHA-256:	1A0C1D42F2AAC5AFB70F36B15178BDCE6EA776C594C3077A89FE7046D2FD5D5B
SHA-512:	D31D7F629247181BF7A475426187DA7D64D64F8310A2769B79F4794F7848DDBD022C94168EE35C2D23F695A26B66DA789C573708F8CC783BD15E11751B0B7228
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/include/1624014000000/yse3ch7dkr4r.js
Preview:	!function(e){function webpackJsonpCallback(t){for(var r,o,i=t[0],c=t[1],s=0,u=[];s<i.length;s++)o=i[s],n[o]&&u.push(n[o][0]),n[o]=0;for(r in c)Object.prototype.hasOwnProperty.call(c,r)&&(e[r]=c[r]);for(a&&a(t);u.length;)u.shift()()}var t={},n={0:0};function __webpack_require__(n){if(t[n])return t[n].exports;var r=t[n]={i:n,l:!1,exports:{}};return e[n].call(r.exports,r,r.exports,__webpack_require__),r.l=!0,r.exports}__webpack_require__.e=function requireEnsure(e){var t=[],r=n[e];if(0!==r)if(r)t.push(r[2]);else{var o=new Promise(function(t,o){r=n[e]=[t,o]});t.push(r[2]=o);var i,a=document.createElement("script");a.charset="utf-8",a.timeout=120,__webpack_require__.nc&&a.setAttribute("nonce",__webpack_require__.nc),a.src=function jsonpScriptSrc(e){return __webpack_require__.p+"assets/"+({}[e]\|\|e)+"."+{1:"c4a40125",2:"391f7772",3:"1104c0c2",4:"7e67eece"}[e]+".chunk.js"}(e);var c=new Error;i=function(t){a.onerror=a.onload=null,clearTimeout(s);var r=n[e];if(0!==r){if(r){var o=t&&("load"===t.t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\19278121[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	129
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHhqw9yltxlHhqw9yltxlHh/:mqlql/
MD5:	DE658DFAC8CD9A064973E5F2B15CC2BB
SHA1:	BBADA5C0D3C5419AE0E2151762581DE7DC584217
SHA-256:	06D9D619915BC999F01FBD1B283A9DB8F1BC5CE9B216FF335CC1B349EB239517
SHA-512:	89E05A260B8A382E0B7713805DE8EFD057C1CCE52A845F5DFD89DCFD4CE3A30DA6141E6B4B733234BCB54371B2300BA8993AE21DD1C83CF0F6340866FC88CBA6
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D..;GIF89a.............!.......,...........D..;GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\2164[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	16
Entropy (8bit):	3.625
Encrypted:	false
SSDEEP:	3:RFREYDA:jRLA
MD5:	A454F56F4DEF70095E30E7676718042E
SHA1:	DB6A025FAFED1D1AD75A6D8BBA133D473ECC58B0
SHA-256:	3DAE93A05EDD9DCFC1864B87178A31E0BFA93E1A9B1C486C6E9CBF73CAE87862
SHA-512:	70CDF04204F3D1DFFEAF7F925EEBF04EA720735625A3BE0375E4AAAF9030C062CE6CCE84607483B282D3F9DA3482E920F17C74E226961156B1612F64814E0365
Malicious:	false
Reputation:	low
IE Cache URL:	https://tracking.g2crowd.com/attribution_tracking/conversions/2164.js?p=https://www.intermedia.com/products/securisync&e=94495bbf-4e46-4448-9358-3f4d8e508a54
Preview:	// Tracking File

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\BC_carousel[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1180 x 501, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	174752
Entropy (8bit):	7.958122179372736
Encrypted:	false
SSDEEP:	3072:NUM0OHlXdoUQjyFn8k0BsDsVG6CqOfd+WwJUm5rbIT0j6Yikh4L8hP0ENlODzND:ZlXOUh83kHjw2Arb7YL8hP0ENIDt
MD5:	4EBBD33FEE194504C590B8C92F6C84E0
SHA1:	30DF575C0D1F3778368C64837B3EDE5694459874
SHA-256:	173D889CCACB09C6543BFF0E22B78A72B948243B3250D1807A2ADD853531190E
SHA-512:	AE013328895A9947DDBAADFF85A5843EEB7666F48D41DD1346F6A92675BB4D408340B0F32CB7B073F3664245AC867FE8DCA243D010C3C388D337CAD38C60896E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/BC_carousel.png
Preview:	.PNG........IHDR..............3.....IPLTE@-'8'G/&2'.........K1)O3'...-)(...8.(^NCB3ZJ?))(...B6/...L>5;95?@G+....DEMU3(bQEQC9C;4...gUH..x......D@<>3,//2NPZTU`...rs~w{.79?...L6-JLV..r&('~..@>;acm.......W>{..Z\g62/.aBVH=...237o<0.L856;H<3...TF<HIPu?0...]@7.R;.~Qvx....jlv<=B.gD...c6,..}z@4.........fhr.C2\2+.O:.lF.\BHC=.rHi8..wK.F4.H68;E.~knoxcE<V=5R90UD9rw.:>K[[T.yf...lo\|lt.iibsOCmYMrrkdd\.zliKD[9-....E<lG;.s`vwp`_Wdix{UHz{w>CQ9Aenmg.n[GGE<Gp/5O...XUPf@20D.hW..\|fo.4<Y.....t.KA\dw.\N..Y[`p....uf.bR...CHX.ZEOGF.TC...).<{NB...`j~uG;OWi...POO.hL.aJHPbS^s....ndQOG\[_u\Q.VJta^.`Q......k]\.d^.xv~mk.}m.F9.nS.....\|..l_nL.ubm._........IDATx...k+U...F..i.1...[1h..3.r.P..D.........4.....C6.n..).\....F.....s~.13I..~.....k>.~.....-.Bsi.'Dm4htI.4."7t...tu.?a..j.6q./..Mv.2.....R.a...o?.X;........V.>?<.\.....F.ht....;..w........vz..g..?[..u2.o......t.../..s...N.....5.r......dtzz...v.....Vq+>.?.....K.F.)+U.pQ=........].....h...Di4.....J....#.MQ.B.t.cv.Uv.<..k.o..R.l.U...GK~1.../,,.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\XDFrame[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	1799
Entropy (8bit):	4.351600604467741
Encrypted:	false
SSDEEP:	24:0peTzzmNVhRACGkx19WssLeU9sbSIwD/mz4wDFrrb623vNEI6h8yVWM:0m3s6CGkwssozwD/mkwDFrr22VZi8y1
MD5:	10B454C9F5D3C5DA2C0B712A2DE0F913
SHA1:	D6149559E23E4F615472E0AC20B6970FDB871888
SHA-256:	B009509439667DF44830CB84F993EBFBF0E4087460178F81004CE3620D210ED5
SHA-512:	4377D45DF7D5671169C006B86002B354FFDCF46A5C2D9ADC600FAE2C63E60007517C88E34EEBA0618CFE788CC4F4D90D6E99005FDA2A5F879A393D44E9793D5D
Malicious:	false
Reputation:	low
Preview:	<!doctype html>.<html>. <head>. <title>Marketo Forms 2 Cross Domain request proxy frame</title>. <script src="//app-sj01.marketo.com/js/forms2/js/forms2.min.js"></script>. <script>. (function (){. var $ = MktoForms2.$;. if(!window.parent \|\| window.parent == window){. return;. }. $(window).on("message", function (e){. var origin = e.originalEvent.origin;. var message = e.originalEvent.data;. try{. message = $.parseJSON(message); . }catch(ex){. return; //our messages are always JSON. }. if(message && message.mktoRequest && message.mktoRequest.ajaxParams){. var p = message.mktoRequest.ajaxParams;. var params = { type:"POST", dataType:"json", url:p.url, data:p.data, crossDomain:false, jsonp:false };. params.success = function (data){. window.parent.postMessage(JSON.stringify({. mktoResponse:{.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\buy-srs[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 548 x 178, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	8591
Entropy (8bit):	7.917489512977139
Encrypted:	false
SSDEEP:	192:IOvi0J/xng0f76WnM0ftT60QZUej2Mhb7iH6p3rHDtRLLXJWYm7:IOLgR01+pZf9hrjt9ZWYE
MD5:	E97794574E27C9BB861C6A6CFE4B492B
SHA1:	95FFE1355DFF279DFE9924AD96DEE91703A0BB49
SHA-256:	156E5C0C7236EB6E227055454510AEEC83306B94A9CD21DAD281B65DB4861656
SHA-512:	3C61EC6350958A12432E63904A4AEC1A3648FC67A047F13A0EA4F3FB2CE1BE607FC7FA80DCBB15F84416790BD2B42C354C7E18E8B9A2133254E4EE39453D1E3D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/buy-srs.png
Preview:	.PNG........IHDR...$.........E.$5..._PLTEGpL........................................................................................................................................................................yR.......................X.................t................Z.......w...............................=.....#..'}zz.a9.oJ......Q........s........................X......\tRNS.[...@.......0.........8..tG....$)..M.mUQg....a\|................................xb}.[..Y.....IDATx..k.J..c_D.......%...m"..b..2 .."B@..%e.......6.?..I..,+....H3s.9_..4m..*..]\|8.Z.e..........J{....%kx~qT../...h>\|.~......N....q5m.....a..V..k.sJB.'.j.K.Q....5....Sf}...'.t..,..-33U.N9.1.U.I.tkf.j.)..-s'.V[....;.e5..f$.H.f..g.;.Y...w.K3.U..,nh..j....T.s....U.=.......?.Z=3o..e..Crl././.$...{.\|6.D..RM#...:4.H.RMc.!93..l ...zCF...M........zcFL.$..yYQd.HSYZH....h..v}.,...i. ...::4.....lj......?..).b.. ..P.."@2ln2f.9A.......i...2.+.#.a.g.G\|:Q=@\X. .&.....[HNw...c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\collect[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	35
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHh/:HJ/
MD5:	28D6814F309EA289F847C69CF91194C6
SHA1:	0F4E929DD5BB2564F7AB9C76338E04E292A42ACE
SHA-256:	8337212354871836E6763A41E615916C89BAC5B3F1F0ADF60BA43C7C806E1015
SHA-512:	1D68B92E8D822FE82DC7563EDD7B37F3418A02A89F1A9F0454CCA664C2FC2565235E0D85540FF9BE0B20175BE3F5B7B4EAE1175067465D5CCA13486AAB4C582C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\customization[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	3288
Entropy (8bit):	5.210331183965778
Encrypted:	false
SSDEEP:	48:GqD7rB4mfBI4Lnb2qKTbhZT9ghentBkefXHamkvvcUQNb7/35eo+V:GqDlBbLnb5albtBkoKsfNb7Pj0
MD5:	C1D7027B94AD35670A22C6FC9A191AE9
SHA1:	4B0BF8C71463362BD53C0EAC136D315224F8CDB0
SHA-256:	51D2637001D0319C74605A4C67820507B496ED23222DC7EB014DA43C88C71448
SHA-512:	4E43E1E3B25A1B10D34A0ACEEAC07003D1C4BFC1E4939EE43CEBB40177C74AC59F0E9349AA8402685FAF8379957B34CC6088F9E5820CBC1D938ECD99D38CA36B
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/static/customization.json?version=3.18.0
Preview:	{. "SupressFolderDownload": "false",. "SupressThumbnails": "false",. "SupressFolderDownloadInWeblink": "false",. "EnableHeapAnalytics": "true",. "EnableVideoThumbnails": "false",. "HeapAnalyticsKey": "160018915",. "RestoreEarliestDateUTC": "2016-02-04T00:00:00.0Z",. "WebAppHotFeaturesRevision": "1",. "WebAppRedirectSubstitutionFrom": "",. "WebAppRedirectSubstitutionTo": "",. "OfficeOnline": {. "ExcelConfirmThresholdSizeMB": "5". },. "PodId": "us2",. "LocatorServiceUrl": "https://auth.myonlinedata.net/locator/",. "SuppressEmbedded": "false",. "HideFeedbackButton": "false",. "SupportedLocales": {. "0": "en-us",. "1": "en-gb",. "2": "en-au",. "3": "de-de",. "4": "es-419",. "5": "fr-ca",. "6": "it-it",. "7": "ja-jp",. "8": "nl-nl". },. "CustomizationID": "SecuriSync",. "ApplicationName": "SecuriSync",. "MainFolderName": "SecuriSync",. "CompanyName": "Intermedia",. "ControlPanelName": "HostPilot",. "UnifiedLoginClientId": "securisync_web

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\dinot-fonts[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1380
Entropy (8bit):	4.8637384502535905
Encrypted:	false
SSDEEP:	12:DMMAEbOZshSWAN3OZshTjAMOZshcsA2KGOZshw3jAgFOZsh5A2aKOZYSlOASGOZe:YDsU1Us1Uss1sS3ssmZYSlC1YS0XP
MD5:	C8D9C00C09F6456923FB928B07812C7A
SHA1:	7B5E96F4883AA2E2100298CC593D71ED733AB78C
SHA-256:	46FA301C20F53EBEEE5DFC4145D0C49F9E9983E678FC145B543149E27F1A88D7
SHA-512:	1D62A1CC75C80D62281A20B60FDC724BC2E5DAA80EDC79E7A1FC5D38AC62EED5B750CB2C66DD378D57838CCF76A210FD3214AE177ADD597CE94B02E9C0A14B0B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/css/dinot-fonts.css?version=54654656
Preview:	@font-face {.. font-family: 'DINOTRegular';.. src: url('/assets/fonts/dinot-webfont.woff2') format('woff2');.. font-weight: normal;.. font-style: normal;..}..@font-face {.. font-family: 'DINOTLight';.. src: url('/assets/fonts/dinot-light-webfont.woff2') format('woff2');.. font-weight: normal;.. font-style: normal;..}..@font-face {.. font-family: 'DINOTMedium';...src: url('/assets/fonts/dinot-medium-webfont.woff2') format('woff2');.. font-weight: normal;.. font-style: normal;..}..@font-face {.. font-family: 'DINOTBold';...src: url('/assets/fonts/dinot-bold-webfont.woff2') format('woff2');.. font-weight: normal;.. font-style: normal;..}..@font-face {.. font-family: 'DINOTCondensedMedium';...src: url('/assets/fonts/dinot-condmedium-webfont.woff2') format('woff2');.. font-weight: normal;.. font-style: normal;..}..@font-face {.. font-family: 'DINOTBlack';...src: url('/assets/fonts/dinot-black.woff2') format('woff2');.. font-weight: no

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\empty[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1 x 1, 1-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	95
Entropy (8bit):	4.4663197309483555
Encrypted:	false
SSDEEP:	3:yionv//thPlE+kSI+Dtmy2pf3Vwghl/Y3WlED//jp:6v/lhPfkCDtmy2pf3mghu3WlEDTp
MD5:	BAAE77A879C2A3C0713F77C3E87EECA3
SHA1:	BCB783AC5156D5F57E7886DE12C77C051723F694
SHA-256:	1743B80176C7A9B725D2E472694B728AE510BBDAE78EE5D33D58278221F552D9
SHA-512:	0FAEF1B7CBE9A8A3E8F7D505D6B2DEA14602C8805205752720BC76E343072AA78E07B80E260133E42F0B8AD11A9BCFCEEF66856637831D52486E3D7518197BB1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/empty.png
Preview:	.PNG........IHDR.............%.V.....PLTEGpL........tRNS.@..f....IDAT..c`.......!.3....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\en-us[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	74212
Entropy (8bit):	4.674515187077405
Encrypted:	false
SSDEEP:	768:FdtFLozcp1+2a+78oLs5PygQgUJLjJmg2:FljNd7nsIv4
MD5:	2A65F99A6749B994B8649DD2EE8E86B6
SHA1:	6C291039F34A9161C8B291D0072448846825832B
SHA-256:	CAB75C625068FB3EABF5FCBE3DDEACF5540AD0A468F94E46A9F51302137694FA
SHA-512:	C4490BB17152F85045DB116C4A350020A1126B691261D19A1C54EF8D283D988B1390F389DCF513BB8A94262EDE1630A74CF07BFA71FC825A3793E3F89562AB3C
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/static/localization/en-us.json?version=3.18.0
Preview:	{. "FILESYNC": {. "ACTIVITY_FEED": {. "EMPTY_MESSAGE": "Once you upload your files and start sharing, Activity Feed will show all collaboration events on your account.",. "ALL_EVENTS": "All events",. "ADD_EVENTS_ONLY": "Add events only",. "UPDATE_EVENTS_ONLY": "Update events only",. "SHARE_EVENTS_ONLY": "Share events only",. "DELETE_EVENTS_ONLY": "Delete events only",. "RESTORE_EVENTS_ONLY": "Restore events only",. "LOCK_EVENTS_ONLY": "Lock events only",. "MOVE_EVENTS_ONLY": "Move events only",. "DURING_LAST_N_DAYS": {. "one": "During last day",. "other": "During last {{days}} days". },. "FILTER": "Filter",. "UNKNOWN_EVENT": "Unknown event",. "ITEM_ADDED": {. "BY_YOU": "<act>You added</act> <item>{{itemName}}</item> <note>to</note> <dest>{{folderName}}</dest> <action-optional></ac

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\environment-control-white-logo[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 690 x 400, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4657
Entropy (8bit):	7.808417957010497
Encrypted:	false
SSDEEP:	96:iWaINQbgTb8X0TAzB28xqoX6v67VHExy2z2cc475zVHX2:5QcwX0TQFIOVkXv5H32
MD5:	50A345943413BC556CE41430C299F682
SHA1:	64764120461067097474A3F3507CD93D991B5B51
SHA-256:	33DEECEEE9AA4798B6621DEA96E7A7102586159DFE8DB8E92EC586DC3900F4D4
SHA-512:	522450F078DE60E690DFB117129912727C26B0F4AA22AB95C3780986BDEF885C0A7BF9A83B38DE7F9750DEE8D8E28259BDCED7006FA74C90071405F5E2DB067E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/environment-control-white-logo.png
Preview:	.PNG........IHDR.............e+s....3PLTE..........................................................tRNS.@....` ..0.p.P[......IDATx.........................................................................`..@.........TUUUUUUUUUUUUUUUUUUUUUUUUUUUUU....... ..FPUUUUUUUUUUUUUUa.....(.Vq......t.B.2..<....OA.X.Y..R..o.$.....R.....LJ].........)u5....3=eR...E...a...']#... .C...C.`#)u...[M...)u.Wp..!a0.C..KZu.<.).`....} .N.v..1.;o^H..,hE....En.}\........._0.Y...z...N...fV.ad..Y...fV....Yt2.X........t.......23_.!f.....:.J....Bw..D...~[........$.9.B.p7..ZK-i.77...P....Eq..J.T.......L..%....4.6.;Y.nOi.O.0.q...kF......61......3U\.S...kUb.:.....&...B[/s.....5.0..Q_Y....(N...<..u ...a`r......x{\|r.2...v^a...e.y..T....{...%H..0..Vzq..$#..).35......l.._..:.x.l.O..7.j._6..1...V.."..g;...g... m...<0.kE...f.........b.,y..5:cd...ui..E..YDz..F...l.f..T;.J..@...ed..P.4mg...+..Y.v.,..m.gy;$.._"..\..Z.....H..".R.q4...#..f.C.KMm.?....0..`......i;..?>.=.6T........2.N..2Y.+..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\favicon[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	201048
Entropy (8bit):	5.2824239996798825
Encrypted:	false
SSDEEP:	6144:BYLGwWW3I6rORO/r+hc6GWWEWekumQTn2IeTDsruSuJDCo6RG:u/Bey
MD5:	8733845B95D7854BCEFDC976AC81E5D6
SHA1:	5AE2231C6E37E24617ECEB0441BA1C965F5EAEDF
SHA-256:	FB316FCC85245B709926B495A8AB46B0499DB9D5FF94948852767E8108A3D9D1
SHA-512:	CA4770DCD7B4B45491891DB2D0C63C3A36A6CC0F88EE8E6B209C828414DB4D36CB784879D856A88457A79689D74B18211815A49B9BBDB1781BE89CA35E117957
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>..<html class="" xmlns:ng="http://angularjs.org" >....<head>.. <meta http-equiv="cache-control" content="max-age=0" />.. <meta http-equiv="cache-control" content="no-cache" />.. <meta http-equiv="expires" content="0" />.. <meta http-equiv="expires" content="Tue, 01 Jan 1980 1:00:00 GMT" />.. <meta http-equiv="pragma" content="no-cache" />.. <meta charset="utf-8" />.. <base href="https://securisync.intermedia.net/us2/" />.... <link rel="icon" href="content/theme/images/favicon.ico" type="image/x-icon" />.. <link rel="shortcut icon" href="content/theme/images/favicon.ico" type="image/x-icon" />.... <link rel="stylesheet" type="text/css" href="content/sync/css/styles.css?ver=3.18.0" />.. <link rel="stylesheet" type="text/css" href="content/theme/styles/styles.css?ver=3.18.0" />.... <script type="text/javascript">.. var supportHtml5Mode = !!(window.history && history.pushState);.. var baseUrl = document.getElementsByTagName("

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\footer-arrow-icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 40 x 40, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	2043
Entropy (8bit):	6.585701129276583
Encrypted:	false
SSDEEP:	48:YzHT/6WONnwknA9Wptoo6/cKMkNv4cHJ32a36/cKRHxB+aCU1W:YzHTS1wknmWpCfNQFLH3z2
MD5:	28AA689ED06A4A853462D2897E992799
SHA1:	2AD85AF0A54671EE275C19151DE4DAE526BE1204
SHA-256:	C5AECD0FCD8A14DC752D9D4D92B629E16A3D5B642D266E2FDFFAF0A59EC3F250
SHA-512:	3C5271F0849AAC6207BE188E3BAACA5F5DD817A0834284EAE0F2967726895C48161432BFC41EE3199E5270188A0907F61232BB69A97FFF53F98C4C1D88D66917
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/footer-arrow-icon.png
Preview:	.PNG........IHDR...(...(...... H_....PLTE.........R...y...........t..\|....B........u....8....b...v....2...v....^..)..$..H........!.....................r.\|......w.......m..X..,.......h......t.=....L.........v..w.q.........u....0}j.....pHYs.................iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164460, 2020/05/12-16:04:17 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmp:CreatorTool="Adobe Photoshop 21.2 (Macintosh)" xmp:CreateDate="2020-11-03T03:42:44-08:00" xmp:ModifyDate="2020-11-03T03:44:45-08:00" xmp:Met

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\forms2-theme-simple[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	826
Entropy (8bit):	4.713751963688756
Encrypted:	false
SSDEEP:	12:cYJwH894+LaNyj94+LaNy1CJHv/0c4Doz0Nr0EUpY:rJwgDfCJX2D0CUpY
MD5:	2B284FDD03DFA5CC9998DEC2320C6626
SHA1:	7066B6CFC1DB11CA2A58BCD1D91A77EA4AEDDA98
SHA-256:	14C8C62DC692FD8FAA04434E3FED25E7C23D596B732F9DB88F6E9F9FF5DFA61C
SHA-512:	BA8A97E95A40B984DF9F57ABEBBAFC6B9706FC156A603E6D94005BB2F09D3E7BA513E2194C0EF0AE767A56752EBB4E431CADB37A7B31A4F8AE63FE82731CE4B8
Malicious:	false
Reputation:	low
IE Cache URL:	https://app-sj01.marketo.com/js/forms2/css/forms2-theme-simple.css
Preview:	#mktoStyleLoaded {. /* css load detection, do not remove */. color:#123456;.}..mktoForm fieldset {}..mktoForm fieldset legend{}..mktoForm input[type=text],..mktoForm input[type=url],..mktoForm input[type=email],..mktoForm input[type=tel],..mktoForm input[type=number],..mktoForm input[type=date]{}...mktoForm input[type=text],..mktoForm input[type=url],..mktoForm input[type=email],..mktoForm input[type=tel],..mktoForm input[type=number],..mktoForm input[type=date],..mktoForm textarea.mktoField,..mktoForm select.mktoField {. padding:2px 3px;.}...mktoForm input[type=text]:focus,..mktoForm input[type=url]:focus,..mktoForm input[type=email]:focus,..mktoForm input[type=tel]:focus,..mktoForm input[type=number]:focus,..mktoForm input[type=date]:focus,..mktoForm select.mktoField:focus,..mktoForm textarea.mktoField:focus{}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\getForm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6316
Entropy (8bit):	5.233468567501551
Encrypted:	false
SSDEEP:	96:AINRJrVpnf8EvUNwNHOSv8odJoA6vdyFOVs2kPfPQ:jBpnMyZ3oA6vdyFis2kPfPQ
MD5:	DF7E1A8D2E473127D72E40CD434377E7
SHA1:	48B6ED9AA9A3F55215193FCCCF1E9E25979309E6
SHA-256:	F4A38768318120D9120F224C5C71813EAC513784366FE2BF97A7AE78AA78B716
SHA-512:	A951B3F6CC8D0BC08B56CD3E37A1CC9B4FDF8D8C93C0B38BD5DE4EC8F4927DF55720CD832E7C33E27D60121F5E05DD752A09CF5E65434EE36231D0566CA6B733
Malicious:	false
Reputation:	low
IE Cache URL:	https://app-sj01.marketo.com/index.php/form/getForm?munchkinId=524-VTS-832&form=1314&url=https%3A%2F%2Fwww.intermedia.com%2Fproducts%2Fsecurisync&callback=jQuery1124016440948411295997_1624013783865&_=1624013783866
Preview:	jQuery1124016440948411295997_1624013783865({"Id":1314,"Vid":1314,"Status":"approved","Name":"Global RAQ Website Form","Description":"","Layout":"left","GutterWidth":10,"OffsetWidth":10,"HasTwoButtons":true,"SubmitLabel":"Submit","ResetLabel":"Clear","ButtonLocation":"120","LabelWidth":100,"FieldWidth":150,"ToolTipType":"none","FontFamily":"Helvetica, Arial, sans-serif","FontSize":"13px","FontColor":"#333","FontUrl":null,"LineMargin":10,"ProcessorVersion":2,"CreatedByUserid":2702,"ProcessOptions":{"language":"English","locale":"en_US","profiling":{"isEnabled":false,"numberOfProfilingFields":3,"alwaysShowFields":[]},"socialSignOn":{"isEnabled":false,"enabledNetworks":[],"cfId":null,"codeSnippet":""}},"EnableDeferredMode":0,"ButtonType":null,"ButtonImageUrl":null,"ButtonText":null,"ButtonSubmissionText":"Please Wait","ButtonStyle":{"id":11,"className":"mktoSimple","css":".mktoForm .mktoButtonWrap.mktoSimple .mktoButton {\ncolor:#fff;\nborder:1px solid #75ae4c;\npadding:0.4em 1em;\nfont-si

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\getForm[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6315
Entropy (8bit):	5.233055737430835
Encrypted:	false
SSDEEP:	96:iwINRJrVpnf8EvUNwNHOSv8odJoA6vdyFOVs2kPfPQ:iTBpnMyZ3oA6vdyFis2kPfPQ
MD5:	0DC43B4A3DBF4A839EA9D2C625A31537
SHA1:	ABF6F24EE8605E91BA5FF6F401E6EF9BD3686FD9
SHA-256:	02E06177EC471FEF0BBDDCE7CEE01F39333F1B9A524C3A032B87E57A5C36094F
SHA-512:	306F82238807463E05B92D6D060E34DA95A942C7B6B30248B94DF5BC562E32A76E5B52709443E792BC60D5C8C635560E2F696DE5FFE8FD785FC878DEB549443B
Malicious:	false
Reputation:	low
IE Cache URL:	https://app-sj01.marketo.com/index.php/form/getForm?munchkinId=524-VTS-832&form=1314&url=https%3A%2F%2Fwww.intermedia.com%2Fwhy-intermedia%2Fcompliance&callback=jQuery112406704669115129673_1624013790923&_=1624013790924
Preview:	jQuery112406704669115129673_1624013790923({"Id":1314,"Vid":1314,"Status":"approved","Name":"Global RAQ Website Form","Description":"","Layout":"left","GutterWidth":10,"OffsetWidth":10,"HasTwoButtons":true,"SubmitLabel":"Submit","ResetLabel":"Clear","ButtonLocation":"120","LabelWidth":100,"FieldWidth":150,"ToolTipType":"none","FontFamily":"Helvetica, Arial, sans-serif","FontSize":"13px","FontColor":"#333","FontUrl":null,"LineMargin":10,"ProcessorVersion":2,"CreatedByUserid":2702,"ProcessOptions":{"language":"English","locale":"en_US","profiling":{"isEnabled":false,"numberOfProfilingFields":3,"alwaysShowFields":[]},"socialSignOn":{"isEnabled":false,"enabledNetworks":[],"cfId":null,"codeSnippet":""}},"EnableDeferredMode":0,"ButtonType":null,"ButtonImageUrl":null,"ButtonText":null,"ButtonSubmissionText":"Please Wait","ButtonStyle":{"id":11,"className":"mktoSimple","css":".mktoForm .mktoButtonWrap.mktoSimple .mktoButton {\ncolor:#fff;\nborder:1px solid #75ae4c;\npadding:0.4em 1em;\nfont-siz

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	217727
Entropy (8bit):	5.538610059997521
Encrypted:	false
SSDEEP:	3072:TKue7hXDDJjCXBvVFMch0sNx+n9BeG1UchEWne6SxjPa8P:Tfe7hXPJqBDMWOWJ6SxPD
MD5:	FE9A025F2E51A8DBF4638C87F937C0C8
SHA1:	5C286380093098A1F4BBF149E8018C20E50B1286
SHA-256:	548058C1A29D8B9A3EDC34D6F7CBBB825E8BCCAA59FD0BA4583E5DB742A2F519
SHA-512:	19E14C014875887CA8405E5712898F2BA9AB6FD558C3347CEDB7CAE4F13BDE5C136E2B1AE13EEB0F00FD3E33E52A5380EEF5AE698E00971F902CEC14589B5D6C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-N47LFD
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"66",. . "macros":[{. "function":"__e". },{. "function":"__k",. "vtp_decodeCookie":false,. "vtp_name":"user_id". },{. "function":"__jsm",. "vtp_javascript":["template","(function(){return(new Date).getTime().toString()})();"]. },{. "function":"__gas",. "vtp_cookieDomain":"auto",. "vtp_doubleClick":true,. "vtp_setTrackerName":false,. "vtp_useDebugVersion":false,. "vtp_fieldsToSet":["list",["map","fieldName","siteSpeedSampleRate","value","100"],["map","fieldName","allowLinker","value","true"],["map","fieldName","cookieFlags","value","samesite=none;secure"],["map","fieldName","cookieExpires","value","31536000"]],. "vtp_useHashAutoLink":false,. "vtp_autoLinkDomains":"serverdata.net, anymeeting.com, go.intermedia

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\hp-jd-power-2020-banner[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 93 x 98, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	5513
Entropy (8bit):	7.951938875984368
Encrypted:	false
SSDEEP:	96:2GpFPkrLg86S++FS1Av1Cg7/tKkLiorPjUtx4EfF0aG7JeCqJ:2GHkrLgM+8SiYwVKborPIHvG7JVqJ
MD5:	B852E491D4604A4957A15E6DFF0590B3
SHA1:	31A00A7DD8CCC3DFBFE5E76710ED08D7F51AA6A6
SHA-256:	7427202BC077491D2AEFB5CCFE99F8C6F2154477647EEE5B955C7165D11E4ACB
SHA-512:	35936B00FBA9C35F5550AF6F29D023768A05030EF945FCAD835064E5C6F62328FBF7B9221FE218AAAB2E5D8979F9FC4D4528C31E035CCBF9D5F7FED8EF85D35B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/hp-jd-power-2020-banner.png
Preview:	.PNG........IHDR...]...b......./.....PLTE...weM...hV?jW@....]K5..]J4................y.....z..]....NG6$.....h........q..g........{yaB..eVB.j...iPE7..n,....88:::<557779...))...113.. <<>$#".....,-/('#................NB-E7"......w$%(0%.'.......\|...........]......6,..........._M/.....\..........o...........}..(.......rQ.....K<#......[.xT..P1.(.................XwfBm\9......z..........................rzp\`U>=5&.......\|............nPNMTH3.....z.uofV..K~nK................jpjc.uF.i?XM:.....]d_X.................j..i..bwV,[G(............MG>TA ..............p~vh]XOj^E..............dthKBBDE?2jR,C/...........u..g.\.......r.zM..................n..............qpv.u..X.2;!&1.......}>~{.....b.g/]`h{M..q1ll......tRNS............................./.X9..w..er.wi....IDATh....S.u...;w.......Uw...~.9E..~..4p.3..)..9.NQ..!.8....(q.b..4D.).m..9.....e..K..G.....z*..;..y..\|x.~......._Az..3......z`..g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.lazyload[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	9296
Entropy (8bit):	4.288313079124391
Encrypted:	false
SSDEEP:	192:TVYMMEtutr93mzBgl13NN+8L/fVpdywYEbmvuq23dT5TFl8ToT3:TyQU73mzBgl13NN+8MhPvuqu
MD5:	9CF75FCB01680B20AA14877FBFED09D0
SHA1:	EDCEC71F9A1B394D544D545BFD04A454964B53AA
SHA-256:	01D0CBAE3C3100A8F5DAC3C2B701AC1D03D672766AEA7AD16A7DF1FFB9567D46
SHA-512:	B65FABB8C4E3CF281F522D749ABC26EC3A2B192EE71F40C184AC60675CBCCE56828ADEE14843CF493FFB9B2B241B616D809CA93D722DAFAD042E1B202F2B55F4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/js/vendor/jquery.lazyload.js
Preview:	/.. Lazy Load - jQuery plugin for lazy loading images.. .. Copyright (c) 2007-2013 Mika Tuupola.. .. Licensed under the MIT license:.. * http://www.opensource.org/licenses/mit-license.php.. .. Project home:.. * http://www.appelsiini.net/projects/lazyload.. .. Version: 1.9.3.. .. /....(function($, window, document, undefined) {.. var $window = $(window);.... $.fn.lazyload = function(options) {.. var elements = this;.. var $container;.. var settings = {.. threshold : 0,.. failure_limit : 0,.. event : "scroll",.. effect : "show",.. container : window,.. data_attribute : "original",.. skip_invisible : true,.. appear : null,.. load : null,.. placeholder : "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAYAAAAfFcSJAAAAAXNSR0IArs4c6QAAAARnQU1BAACxjwv8YQUAAAAJcEhZcwAADsQA

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	85578
Entropy (8bit):	5.366055229017455
Encrypted:	false
SSDEEP:	1536:EYE1JVoiB9JqZdXXe2pD3PgoIiulrUndZ6a4tfOR7WpfWBZ2BJda4w9W3qG9a986:v4J+OlfOhWppCW6G9a98Hr2
MD5:	2F6B11A7E914718E0290410E85366FE9
SHA1:	69BB69E25CA7D5EF0935317584E6153F3FD9A88C
SHA-256:	05B85D96F41FFF14D8F608DAD03AB71E2C1017C2DA0914D7C59291BAD7A54F8E
SHA-512:	0D40BCCAA59FEDECF7243D63B33C42592541D0330FEFC78EC81A4C6B9689922D5B211011CA4BE23AE22621CCE4C658F52A1552C92D7AC3615241EB640F8514DB
Malicious:	false
Reputation:	low
IE Cache URL:	https://ajax.googleapis.com/ajax/libs/jquery/2.2.4/jquery.min.js
Preview:	/! jQuery v2.2.4 \| (c) jQuery Foundation \| jquery.org/license /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="2.2.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?0>a?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,function(b,c){return a.call

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\jquery.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	93636
Entropy (8bit):	5.292860855150671
Encrypted:	false
SSDEEP:	1536:s6IzxETpavYSGaW4snuHEk/yosnSFngC/VEEG0vd0KO4emAp2LSEMBoviR+I1z5T:O+vIklosn/BLXjxzMhsSQ
MD5:	3576A6E73C9DCCDBBC4A2CF8FF544AD7
SHA1:	06E872300088B9BA8A08427D28ED0EFCDF9C6FF5
SHA-256:	61C6CAEBD23921741FB5FFE6603F16634FCA9840C2BF56AC8201E9264D6DACCF
SHA-512:	27D41F6CFB8596A183D8261509AEB39FCFFB3C48199C6A4CE6AB45381660C2E8E30E71B9C39163C78E98CEABC887F391B2D723EE5B92B6FBC81E48AC422E522B
Malicious:	false
Reputation:	low
IE Cache URL:	https://rtp-static.marketo.com/rtp/libs/jquery/1.8.3/jquery.min.js
Preview:	/! jQuery v1.8.3 jquery.com \| jquery.org/license /.(function(e,t){function _(e){var t=M[e]={};return v.each(e.split(y),function(e,n){t[n]=!0}),t}function H(e,n,r){if(r===t&&e.nodeType===1){var i="data-"+n.replace(P,"-$1").toLowerCase();r=e.getAttribute(i);if(typeof r=="string"){try{r=r==="true"?!0:r==="false"?!1:r==="null"?null:+r+""===r?+r:D.test(r)?v.parseJSON(r):r}catch(s){}v.data(e,n,r)}else r=t}return r}function B(e){var t;for(t in e){if(t==="data"&&v.isEmptyObject(e[t]))continue;if(t!=="toJSON")return!1}return!0}function et(){return!1}function tt(){return!0}function ut(e){return!e\|\|!e.parentNode\|\|e.parentNode.nodeType===11}function at(e,t){do e=e[t];while(e&&e.nodeType!==1);return e}function ft(e,t,n){t=t\|\|0;if(v.isFunction(t))return v.grep(e,function(e,r){var i=!!t.call(e,r,e);return i===n});if(t.nodeType)return v.grep(e,function(e,r){return e===t===n});if(typeof t=="string"){var r=v.grep(e,function(e){return e.nodeType===1});if(it.test(t))return v.filter(t,r,!n);t=v.filter(t,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\log[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stk=65389331b63b84e5636e5385d48228ccef23ab2c&dr=&dl=https%3A%2F%2Fwww.intermedia.com%2Fwhy-intermedia&dt=Worry-Free%20IT%20%26%20Cloud%20Solutions%20For%20Business%20%7C%20Intermedia&vp=1263x906&sr=1280x1024&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&ua=UA-214873-1&uac=1641651054.1624013785&stv=35&r=&cb=1624013789926
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\log[2].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stb=1&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&mln=%5B%2218003797729%22%2C%228003797729%22%5D&_stk=65389331b63b84e5636e5385d48228ccef23ab2c&stv=35&cb=1624013792326&r=
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\log[3].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stb=1&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&mln=%5B%2218003797729%22%2C%228003797729%22%5D&t=%5B%7B%22p%22%3A165%7D%2C%7B%22h%22%3A325%7D%5D&_stk=65389331b63b84e5636e5385d48228ccef23ab2c&stv=35&cb=1624013822349&r=
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\log[4].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stb=1&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&mln=%5B%2218003797729%22%2C%228003797729%22%5D&t=%5B%7B%22h%22%3A145%7D%5D&_stk=65389331b63b84e5636e5385d48228ccef23ab2c&stv=35&cb=1624013852638&r=
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\munchkin[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	11110
Entropy (8bit):	5.524178087467622
Encrypted:	false
SSDEEP:	192:UCSiK0Ss4mI70D2MZ+tQABM8joWINlV4pe8d79m878u1QsY7KZqMwJa4D8yCtffv:UCM3mn2EWQAW80WIToe8d79m878GQs6M
MD5:	19A9335FD71267D56E65BC19390F3100
SHA1:	5042BC92CCEFFA7B81EA347257B50F561D2FADA4
SHA-256:	99FA5A280296B5FC7B63433EE121A359FC68C4A37F04A87D363E751164B96FF1
SHA-512:	6C6982D1FE00427E882E82FC2ACEA0E19654D07DEC43405D9CD5266CD2964197C2E22B17BD6B10CF88D3F878B860959EA6758AD935C212D06749DF77AC218594
Malicious:	false
Reputation:	low
IE Cache URL:	https://munchkin.marketo.net/160/munchkin.js
Preview:	/. Copyright (c) 2007-2018, Marketo, Inc. All rights reserved.. * See https://developers.marketo.com/MunchkinLicense.pdf for license terms. * Marketo marketing automation web activity tracking script. * Version: 160 r843. */. (function(h){if(!h.MunchkinTracker){var l=h.document,q=l.location,D=encodeURIComponent,A=!1,u=null,t=null,E=!1,x=null,F=[],v=function(b,a,c,d){try{var f=function(){try{c.apply(this,arguments)}catch(a){}};b.addEventListener?b.addEventListener(a,f,d\|\|!1):b.attachEvent&&b.attachEvent("on"+a,f);F.push([b,a,f,d])}catch(k){}},V=function(b,a,c,d){try{b.removeEventListener?b.removeEventListener(a,c,d\|\|!1):b.detachEvent&&b.detachEvent("on"+a,c)}catch(f){}},f=function(b){return"undefined"!==typeof b&&null!==.b},G=function(b,a){return b.className.match(RegExp("(\\s\|^)"+a+"(\\s\|$)"))},W=f(h.XMLHttpRequest)&&f((new h.XMLHttpRequest).withCredentials),r=function(b){var a=null,c;if(f(b))if(0===b.length)a="";else try{a=decodeURIComponent(b)}catch(d){c=b.indexOf("?");if(-1!==c)t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\notosans-regular[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 177660, version 0.0
Category:	downloaded
Size (bytes):	177660
Entropy (8bit):	7.99071042929071
Encrypted:	true
SSDEEP:	3072:BjXDO0MzwbpXTMFuOL3d+ZnqSGQuZqCweBJlelsuCUQ9BVVjR:Bjziz2DMTAsouqeBJlel5CP9xR
MD5:	81A8568CAC4D108B27251AB7D3934878
SHA1:	162FF3E962F707F6E4F2371AA6F7693B91EB3D80
SHA-256:	BD3C4F90A93C6FE474FCFF25CCE4A6C385479BA27E2BF5246ECCF98FAC44EC18
SHA-512:	E5D9714AE1C57602732165568DE37FD2F8615A1D90FC916681640EE825E3278A64B86C8FD2FB2C94AFF656037DF69FFB124B29878B1912728670812F95D13942
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/sync/fonts/notosans-regular.woff?version=3.18.0
Preview:	wOFF..............Bp........................FFTM............~..EGDEF............1...GPOS..+(......X....GSUB.......H......OS/2.......\...`l...cmap...L........1. .gasp................glyf..<....r....._?head...X...6...6....hhea.......!...$...8hmtx...0......2..25.loca..........2..v.\maxp........... ....name...t........L4~.post......;.......}...........w._.<...........z.......C....{...+............x.c`d``..w...[...S.>0.E............x.c`d`...p.A.Q.A...C...L.-......x.c`a.a........................L,.,LL,....;00.s00h2.00....3:0......6.......0I0..R..=.rK..x...xU.........A....d.0....D.).."(....VQ..>...Zq.V..V.RJ..}j...s...@Q.....!....>.p.B.}.o...>{X....N.j....g...e..G.M.g.JYP.=...G>...EJ@.-.N..e...9..,...d.....z...9(..@.....%m...wmOJV.T...D.2.e.. ......w..Mf....4\|...-Kf..B..6...O/..Hz.l..,Uv.H.Z...I..?P:..e.....~?..<).=...'..#.<..J?3U.....[.cl.g..+.5R....+....{.Jo3_.po.9.....6.lS#.#....>~.m...y..4.m..F............v....g.k...2.r<.e..%h.......z.7.kD{.Y./.... .\....t\|?..K

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\rc-securisync-451[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 347 x 225, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	26304
Entropy (8bit):	7.984494770559438
Encrypted:	false
SSDEEP:	768:+Mi/Tg/iBM7lUvzMCmnSXFjrpgkAjDWtpU:+MEBInSpr9APcU
MD5:	75CE13A0DAA7BA5F2FC23048BAE0E693
SHA1:	1350CB37DE86F4879E37F637719273A8F4862550
SHA-256:	EEDB993411A09790C412842634E52B8843EA0211946478910E0D9AED87CB9AEF
SHA-512:	BC5700D669FF22ABEFEB6B884BC1312303CA257364A0C1AAFAEE5357E6D1BED9759733D9183271355CA158187796885F5E2AA61CA4467F6B8276555B3846E1EC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/rc-securisync-451.png
Preview:	.PNG........IHDR...[.........Q7.x....PLTEGpL.........,,,........................[[[......(Y................$R{......&V.............................^."Nt"Q..........................................Hm.....U........Pr........j.....p...................................d......Dx0i..9f................K~...`\`......8f......cx.W}......................An.......s..{q..{wzu{.~f^~...xQFF.aA6;.....Qks=t....nlpiq..im....;9Ef....I0..2"'...s..oD........:Y......EHb..n[@..A...h.....I31.p.....Zspd....tRNS..G..#5.VHw.(.. ....d.IDATx....O.X....m..3.v..:..`+.!..6Ub..I....e...fQC..[.H..Y1ZV../<....9.^.P....-.=.......s......kQ.....{q.5.555??3377==.ps......yQ..pIss333.p.........N/.s..\|&...e..e.q/\|j.....8...v....zGGGQ4u..-.^..).6>.}........8}QsI..V.z.U.t...u......EQt.M..........{}%;.=..Y.W.1.+I.gJ.R.^w]..4[..r..i..%.w.an.....1[.J.y..q9.....\T..jm7...h....867E[m.6.;.[.$..7u......B{s...~x.. .4.@...(.T4 ....eZ.<.fV.v.B1.....E...$"C)..*Xjb.9hk.m.m.n[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\share_locked[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2100
Entropy (8bit):	5.31359587282297
Encrypted:	false
SSDEEP:	48:coAXQDfRiNG7UP2riAkzJjBx8lX5cDaSlgSw:AXQDfoNFAc1BxG5ygSw
MD5:	C1DA7CED4AD18704A8D54FBEF9023307
SHA1:	1CA17AAFF18B515D6EE68D108A9A8DBB9DA8CE63
SHA-256:	EA203AFFD02A4BF5AD82DCB8172D6B113586355CE083167AEA5DD264387DCF4D
SHA-512:	ADF8440B066D26222A8AEE869CBA902FAB3585429515448D341E5E25A38DBAD5C186DECCF6A518A94B6719A8EEF872B8F76D12E56B62FDB76A46F166BC134717
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/sync/images/icons/custom/share_locked.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>.. Generator: Adobe Illustrator 18.0.0, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->..<!DOCTYPE svg PUBLIC "-//W3C//DTD SVG 1.1//EN" "http://www.w3.org/Graphics/SVG/1.1/DTD/svg11.dtd">..<svg version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" width="165px"... height="88px" viewBox="0 0 165 88" enable-background="new 0 0 165 88" xml:space="preserve">..<g id="Layer_3">...<path fill="#D4EEF6" d="M15.4,67.1c0.1,0,0.1,0,0.2,0c1.4-8.1,8.5-14.3,17-14.3c2.6,0,5,0.6,7.2,1.6c5-9.3,14.8-15.7,26.2-15.7....c14.2,0,26.1,10,29,23.4c0.5,0,1-0.1,1.5-0.1c7.9,0,14.4,6.1,15,13.9H0C3.2,70.6,8.9,67.1,15.4,67.1z"/>...<path fill="#D4EEF6" d="M149.1,53.2c-0.1,0-0.1,0-0.2,0c-1.4-8.1-8.4-14.3-16.9-14.3c-2.6,0-5,0.6-7.2,1.6....c-5-9.3-14.8-15.7-26.2-15.7c-14.2,0-26.1,10-29,23.4c-0.5,0-1-0.1-1.5-0.1c-7.9,0-14.4,6.1-15,13.9h111.3....C161.4,56.7,155.7,53.2,149.1,53.2z"/>...<polygon fill="#FFFFFF" points="115.5,8

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\st[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	69375
Entropy (8bit):	5.646865558249298
Encrypted:	false
SSDEEP:	1536:UDdYv5uf+zm74PW5RiizPkq7poAXaWXqkR9QYzc7OkFSTUmKhSP2wm48h767WnzU:UDdYvs6Wt7Lfm1h7TM
MD5:	0441B0776F5AE65AE8768F93634A9A91
SHA1:	71669103C81BB4507746262E5E8A968F5D7FFA09
SHA-256:	48F5C2A7C2388C4E92027F06D6D866DE874C6A378E14FE5EBF300549B8F2C2CF
SHA-512:	C558E22F053C6E297FF0BEA6ECEA624651176B141537AFD1ECD8CF82BD13A261DE3A0E2537ECD387AA69819DA7EDFF9398F4E04120A0F87AA6CFBB86761C2AEA
Malicious:	false
Reputation:	low
IE Cache URL:	https://d31y97ze264gaa.cloudfront.net/assets/st/js/st.js
Preview:	window._st=window._st\|\|{};window._st.integrations=window._st.integrations\|\|[];.;if(window._st.snippets){window._st.snippets++;}else{window._st.snippets=1;;(function(e){function k(){var a={},c=e.visitor,b=e.s,d=e._satellite&&e._satellite.getVisitorId?e._satellite.getVisitorId():void 0;c&&c.getMarketingCloudVisitorID&&0<c.getMarketingCloudVisitorID().length&&(a.marketingCloudId=c.getMarketingCloudVisitorID());b&&(b.visitorID?a.visitorId=b.visitorID:b.c_r&&(0<b.c_r("s_vi").length?a.visitorId=b.c_r("s_vi"):0<b.c_r("s_fid").length&&(a.visitorId=b.c_r("s_fid"))));d&&(d.getMarketingCloudVisitorID&&0<d.getMarketingCloudVisitorID().length&&(a.marketingCloudId=.d.getMarketingCloudVisitorID()),d.getAnalyticsVisitorID&&0<d.getAnalyticsVisitorID().length&&(a.visitorId=d.getAnalyticsVisitorID()));a.marketingCloudId\|\|a.visitorId\|\|(c=e._st.getCookie("s_vi"),b=e._st.getCookie("s_fid"),c?a.visitorId=c:b&&(a.visitorId=b));return a.marketingCloudId\|\|a.visitorId?a:null}var f={},h=!1;f.name=function(){retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\support_jd_banner_stripe_2020[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 4323 x 393, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	170901
Entropy (8bit):	7.957552597089136
Encrypted:	false
SSDEEP:	3072:YrWmhCkjAJ+fDazbqSOnYnVv5EI6ZMNJyZZJjo6jhRZHUhXa5xjd/n0WvPBeV3Iv:iWmhCkjA8OVv5EIHJKjoKRZHUwVd/Xvf
MD5:	50B60A9851C319BE4DDBADDBAB43B13D
SHA1:	9C0DE5F4DD4F57A45E017D6FF11B8CA89A6C70A4
SHA-256:	5F995910970636CA56E6E6E6E02876EE55F8636BE66D57D1218850D7ECF43CD5
SHA-512:	2606BBC7AA06AF07301D7DA2C6A549BB40DBF2F3D7F6324BAE81BF4F44314F7384D08CB68A78C676780CAB63A017D9089809EF77112CD1B9598BB53B5D114E1F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/support_jd_banner_stripe_2020.png
Preview:	.PNG........IHDR..............`@.....pHYs...%...%.IR$... .IDATx....\|..}...d.,. .lc.!6........im ....6i.9......m.%i.$.B... m..@J..&...4.`.[.OI.$.\|i..g...V...>.D...<...hgg..}..3.m........`p.c...m................ _...........A..l\|..................0.........`..m..4.=................ _..'..............'\..}................ /............TRY%.E.....................a.........AW6................... /...........t%.URP4..................`.............e.k....................a..........PRY%..Bv.................AE......... o.VM`g.................T.q...........H...C...................8........y.(t.9................`............+.#UP.N................0(...................................@......... .TV.S...................8........y....@...................0........@^*._.................0.............b)..f..................P.q.........V..Zv..................E......... o...KIe5;..................!............TV.....................8........y.hl...U.....................8........y.l\|-;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\uk[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	829
Entropy (8bit):	4.7307076079008095
Encrypted:	false
SSDEEP:	24:t4sbAoFcdrAhKeB0SjKjZ5ZXZQgYYk0QRnGO7V/4d0N:lFc9eBkjZ5Z78nT7hq0N
MD5:	6E069BC611DF5D6255310CF09C81820E
SHA1:	1B1085F1C166E26D73D7E79F092498BCB37E939C
SHA-256:	E36A0334B5A5BB97B63AAA8E6CE82DF606CEA57EB2032053EBE9C9C3F82F49E6
SHA-512:	A9C7F8C379BDE745B76C0890933A6CB60D40CA405F262219FBE6B131A68863EAFCBB7C9DE9A45D777A7A8DD5D7799EDBD04335994CB71DA465F83C3DB8D52D0B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/flags/uk.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="43" height="22" viewBox="4.125 4.25 43 22" enable-background="new 4.125 4.25 43 22"><path fill="#fff" d="M4.125 4.25h43v22h-43z"/><path fill="#D12027" d="M47.125 13.05h-19.35v-8.8h-4.299v8.8h-19.351v4.4h19.351v8.8h4.299v-8.8h19.35"/><path fill="#D12027" d="M32.792 18.917h3.206l11.127 5.692v1.641m-28.666-14.667h-3.205l-11.129-5.692v-1.641l14.334 7.333zm0 7.334h3.205l-14.334 7.333h-3.205l14.334-7.333zm14.333-7.334h-3.205l14.333-7.333h3.205l-14.333 7.333z"/><path fill="#18325B" d="M4.125 18.917v4.873l9.526-4.873m33.474 0v4.873l-9.525-4.873h9.525zm-43-7.334v-4.873l9.526 4.873h-9.526zm43 0v-4.873l-9.525 4.873h9.525zm-25.083 14.667v-6.707l-13.108 6.707h13.108zm7.167 0v-6.707l13.109 6.707h-13.109zm-7.167-22v6.707l-13.108-6.707h13.108zm7.167 0v6.707l13.109-6.707h-13.109z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\usa[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	609
Entropy (8bit):	4.805920208140702
Encrypted:	false
SSDEEP:	12:t4KtnlGY9s2D3PFa0G3Uq+RsTxoZqYxoZ/xoZMYxoZPq/7kv7cFkPgv:t4s8GhfoDEq+RSoZqioZJoZxoZNzT4v
MD5:	76ABB09A873C38FCE5364EC25F972AE8
SHA1:	A5E1FC9BD6FBAE64DA465B3B08A309E90BB2807E
SHA-256:	2FF1689FB3A632923DA9187B2AAA7484C1057F44B6DE57A820DCD4B4D7537ED7
SHA-512:	6557C189E2C29CF3880DF7C488A16886CD9BCA5354F0D42399A9A8489073474F48225417982B41B6E7E425747CC6616B3E9A10AF4C2C18472FD00D7C5D32299A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/flags/usa.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="43" height="22" viewBox="0 0 43 22"><path d="M588.23 256.064h80v11.91h-80v-11.91zm-1100.38.411h185v17h-185v-17zm780.38 0h159v17h-159v-17zm215 0h69v19h-69v-19zm-75 73.958h69v11.5h-69v-11.5z" fill="none"/><path fill="#fff" d="M0 0h43v22h-43v-22z"/><path fill="#E03A3E" d="M16.59 0h26.41v1.71h-26.41v-1.71zm0 3.384h26.41v1.71h-26.41v-1.71zm0 3.38h26.41v1.71h-26.41v-1.71zm0 3.382h26.41v1.71h-26.41v-1.71zm26.41 3.382v1.708h-43v-1.708h43zm0 3.38v1.71h-43v-1.71h43zm0 3.38v1.712h-43v-1.71h43v-.002z"/><path fill="#003A80" d="M0 0h16.59v11.856h-16.59v-11.856z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\user[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	365
Entropy (8bit):	4.920115345745571
Encrypted:	false
SSDEEP:	6:YK71Cxj11DsQVMS3QbaiHEYNzkv9X5cBQiuwUlckiGSEQ97UcvHOEm5HZjT6hJn4:YKMh1HgbakEYxeX5MQiuJw597UwlyHZl
MD5:	E7066551D63019537A6921BD5CEC7A18
SHA1:	EFA502AB5C5D407F5F6249323166D08A03999AC7
SHA-256:	1505B48B50A09AFBCA505D000BD1379C4289596145A6742481B06E46E148B204
SHA-512:	1FFEC742907689A635276A692A73E9E43CBACD8ED269B095AD4C789D25672DCC09AC1330E53BFAEFEB6829E92CD5565FF42C155C2E87D1592A0339F248F8EA3C
Malicious:	false
Reputation:	low
IE Cache URL:	https://us2sync.myonlinedata.net/v3/user
Preview:	{"organization_id": 4104132, "service_status": "pending_signup", "email": null, "display_name": null, "department": null, "job_title": null, "details": {}, "is_hidden_from_address_book": true, "identity": "69225e15-045b-42dd-8940-e05c2b266658", "default_key_id": "673287", "is_purge_only_allowed_for_admin": true, "web_app_token": "DUMMY", "type": "anonymous_user"}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\wf-overview-icon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 155 x 155, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	984
Entropy (8bit):	7.679069258239295
Encrypted:	false
SSDEEP:	24:hxfDuzn1NuX1/Ai37Fd/yEKzbqjJXul6cI0YT:vfdFYiZdZKmXO6h
MD5:	F9EF07918D551E48C90C5E2AF348B286
SHA1:	EB4D9979A05B1045EF5EFABD298E175098C00B34
SHA-256:	2FAFE73869280D455C9CA5F7EADFE46CD88EDD8C0E14E320F2B63E14565F3161
SHA-512:	7E62257E629FB06EBC16802CE1A2064D12F07F4A576AE23E566E0B0EE593D167A6AD32F6A222DB232B342B8FEC6B37339085A423B842D034CFD69563AED49262
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/wf-overview-icon.png
Preview:	.PNG........IHDR.............B......lPLTEGpL.B,.........%....;#..$..$....cg....z}..#..#..$..#....................$.........qv..$.......?F.(/.` .b......tRNS.0...C..h....K..D.r.....h0.~x.....IDATx...z.0.FE...h..}.w. .Pa[3I...z...3I..v.. .. .. .. ...O-.Y}...Q.x...!v.Z...@.......b.&-.,...y...c.p.\y5...).8w.#.n.fY..C..o.1m....,.d..;..^..W.VcD.Z.-%l.6S...-U...="m..=;.2j.H.(...&.6;0..[P3(.&.F...........-..CI#....y..L.0.y.4...'.D:-j...D.H.f.....j.y..4..8Q.@...K.Q`.N.F ...`...DZ...p...F.'n..&.k..n....[....us..V.........tr..0)?z.9........L.Gz^q...\|o...Z'.;.....Y....~.....S~!....k.f...._.'.r...`.]g..;.. .v:.F.....f..l.r8K......n.R...hx.=~..J......../..H.]....+.q.....Pz...........c..b.^..#ew...t.6.5..v.".6...37.W.7m..#.M.m.\s.5#..T.T....k.&..R..F...E...vi.45...o0..Xr...._.4.4...H5....H1._su........H..[....4K.jN.$Yji...F+.....:R+K..\|}.P..iV./y.1+hY^.D...^.T..g...!....9y*$.z...."..En...A..A..A..A..A..A.....?p@i.1....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\wf_sections_icons-05[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 151 x 151, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	792
Entropy (8bit):	7.521192871697012
Encrypted:	false
SSDEEP:	24:4I/hGv+9EGM/7E/43GdnH9He4iGKpNAuhn/z:4IJGm5MzAIGZH9+tGKpNjh/z
MD5:	D97F28B0F585523547ABCC404E895670
SHA1:	E57EAB5327CC4E7BA8E32D1CB597D3180027DA66
SHA-256:	6CB266CBC5BA65BDBFA5530DB25AB7933063E8818CAF7553258998361D2D8D59
SHA-512:	D5DC7F76787EB865C8B951D8469F0FA503940147CB017B8068882FE61687C030F1289AFB4AD1294C2C39CF68FCD3F99B39B94859D2E14D601E562057295189AF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/wf_sections_icons-05.png
Preview:	.PNG........IHDR............./A9K...NPLTEGpL..........o.....o.....q.....o.....o..r........o.......A...o.......e....T..aOA.....tRNS..[)...B...@...f.'Q....hIDATx.... .E......81....m;..QT....5.b.g..o7...................;%.E....pb..#.....'R..=D........1.K..."!.!q`=...d1*e.b.......Q,.N......Y......v..d..D)%h... .ZJ.N?.2..Y..j.#..R&.?..C...>...aU.m.".{.SWj.V..b..m\|j..-Zu.Tv.;.z.xi];kUm]u.S.G%!D....v[...x..v....yiK.L..C/U.M....L1.......!.2{.W.B.g.......}/C..5...Y.%.Q3'.....=.(}D...c.....#.o6..!.y..l.....C...h.z.L-.k..f...e..N.r......5..>....y)...#.^.Y[h.R..6Z......./...t.j..~.a..fj....?6.t....n.5K..6.....`......<..+.....dax%l.....3.@c....._.^.`...\.0....././.....xe...~.N..V......9.1~.............G.W..m.l...^..\.s.^..j.....................w...A.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\why-intermedia[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	178
Entropy (8bit):	4.560890767001816
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAc9FKEIHiHby4AqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiWHiHuwWSU6XlI5LP8IpfB
MD5:	CD2E0E43980A00FB6A2742D3AFD803B8
SHA1:	81FFBD1712AFE8CDF138B570C0FC9934742C33C1
SHA-256:	BD9DF047D51943ACC4BC6CF55D88EDB5B6785A53337EE2A0F74DD521AEDDE87D
SHA-512:	0344C6B2757D4D787ED4A31EC7043C9DC9BF57017E451F60CECB9AD8F5FEBF64ACF2A6C996346AE4B23297623EBF747954410AEE27EE3C2F3C6CCD15A15D0F2D
Malicious:	false
Reputation:	low
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body bgcolor="white">..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\1.c4a40125.chunk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	94636
Entropy (8bit):	5.3432581873504015
Encrypted:	false
SSDEEP:	768:kfBGuZ2XvlhIgpz1q5ma9rnFTdD1g3i0f1lIdFfeq2vdMCqyuhQfqwkLa7jKLiwo:cBGuQbPPa5nFTnBbeq2+cuOfqxW7
MD5:	FEBF7D902AE73F91794CCBCC7E8311B8
SHA1:	A642C122550C571E8EF671D5B329AF855DB75C73
SHA-256:	5D4C9E4E2736F1EB6CA99B65A38FC0576ACA0181A27ED53F20321A18DEC89256
SHA-512:	A0FD84035D8A4066482F23B2B5130387891B859A2E4C88A847FC80EAFC291461EE170D084BCF7325E02AEC25500A3F996A260E900FA59A9343F2968A8CE8E57E
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/conductor/assets/1.c4a40125.chunk.js
Preview:	(window["3eiXJRXgVuLsYGH9303q"]=window["3eiXJRXgVuLsYGH9303q"]\|\|[]).push([[1],Array(133).concat([function(t,r,e){"use strict";var n,i=e(3),o=e(7),a=e(6),u=e(10),c=e(53),s=e(16),f=e(28),l=e(8).f,h=e(32),p=e(71),v=e(12),g=e(21),d=o.DataView,y=d&&d.prototype,m=o.Int8Array,x=m&&m.prototype,S=o.Uint8ClampedArray,A=S&&S.prototype,b=m&&h(m),w=x&&h(x),E=Object.prototype,I=E.isPrototypeOf,R=v("toStringTag"),T=g("TYPED_ARRAY_TAG"),M=!(!o.ArrayBuffer\|\|!d),L=M&&!!p,P=!1,U={Int8Array:1,Uint8Array:1,Uint8ClampedArray:1,Int16Array:2,Uint16Array:2,Int32Array:4,Uint32Array:4,Float32Array:4,Float64Array:8},k=function isTypedArray(t){return a(t)&&u(U,c(t))};for(n in U)o[n]\|\|(L=!1);if((!L\|\|"function"!=typeof b\|\|b===Function.prototype)&&(b=function TypedArray(){throw TypeError("Incorrect invocation")},L))for(n in U)o[n]&&p(o[n],b);if((!L\|\|!w\|\|w===E)&&(w=b.prototype,L))for(n in U)o[n]&&p(o[n].prototype,w);if(L&&h(A)!==w&&p(A,w),i&&!u(w,R))for(n in P=!0,l(w,R,{get:function get(){return a(this)?this[T]:void 0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\2.391f7772.chunk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	55566
Entropy (8bit):	5.247007859531232
Encrypted:	false
SSDEEP:	768:cDXCQJqzmvtZyuiV+mqO8ikf30OZxoBVczh3y6Zsu:cDXCQIKvtZmEmV8ikftgU
MD5:	D4F4094FB08B73360126836A86255481
SHA1:	BE09BCA4311124B25937C79177A6BC281BD6BD1D
SHA-256:	529A93E7619B60C50091D5D4C05302194A29305A462A7D689F91AB946C287719
SHA-512:	968F6A9A3A623CB62313A2939B364C2A09ABE2543F29CA1175A158DFBE8F15BAC56B8165057CB1C0A1DF5E4B5D1597DF2EF6A09681E2EBE794B6EB9B0A86C48A
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/conductor/assets/2.391f7772.chunk.js
Preview:	(window["3eiXJRXgVuLsYGH9303q"]=window["3eiXJRXgVuLsYGH9303q"]\|\|[]).push([[2],Array(130).concat([function(t,e,r){var n=r(135),o=r(188).f,i=r(149),a=r(158),u=r(192),s=r(221),c=r(217);t.exports=function(t,e){var r,f,l,p,d,h=t.target,v=t.global,y=t.stat;if(r=v?n:y?n[h]\|\|u(h,{}):(n[h]\|\|{}).prototype)for(f in e){if(p=e[f],l=t.noTargetGet?(d=o(r,f))&&d.value:r[f],!c(v?f:h+(y?".":"#")+f,t.forced)&&void 0!==l){if(typeof p===typeof l)continue;s(p,l)}(t.sham\|\|l&&l.sham)&&i(p,"sham",!0),a(r,f,p,t)}}},function(t,e,r){var n=r(142);t.exports=function(t){if(!n(t))throw TypeError(String(t)+" is not an object");return t}},function(t,e){t.exports=!1},,function(t,e){t.exports=function(t){if("function"!=typeof t)throw TypeError(String(t)+" is not a function");return t}},function(t,e){t.exports="object"==typeof window&&window&&window.Math==Math?window:"object"==typeof self&&self&&self.Math==Math?self:Function("return this")()},function(t,e,r){var n=r(164)("wks"),o=r(172),i=r(135).Symbol,a=r(225);t.exports=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\3.1104c0c2.chunk[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	7252
Entropy (8bit):	5.04066026219023
Encrypted:	false
SSDEEP:	192:ikozfde3PHpN/g4Mt2E+uKqyoqiPtE41qcp43Hp6o:i7zfdW/g4MtBK/qtESr6XAo
MD5:	47626329B55086CF19E6CB5F10A3AFD1
SHA1:	2EC87F320CB29E7D381CA92D38205FA63F17622E
SHA-256:	F83596F4A0A3BD6431651E2547AC64A4898F040958A3D8D7F3D4BA0DF74AD091
SHA-512:	32D3B0199213845E13EA227E7A348C5C358A656646C645EC1B0E9BC7DB585B24754461FAB7EF164E57E38EE55E00B75E36325275E12BFCF9320D0534CF96A05B
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/conductor/assets/3.1104c0c2.chunk.js
Preview:	(window["3eiXJRXgVuLsYGH9303q"]=window["3eiXJRXgVuLsYGH9303q"]\|\|[]).push([[3],{553:function(t,e,r){var n=function(t){"use strict";var e,r=Object.prototype,n=r.hasOwnProperty,o="function"===typeof Symbol?Symbol:{},i=o.iterator\|\|"@@iterator",a=o.asyncIterator\|\|"@@asyncIterator",c=o.toStringTag\|\|"@@toStringTag";function wrap(t,e,r,n){var o=e&&e.prototype instanceof Generator?e:Generator,i=Object.create(o.prototype),a=new Context(n\|\|[]);return i._invoke=function makeInvokeMethod(t,e,r){var n=u;return function invoke(o,i){if(n===s)throw new Error("Generator is already running");if(n===l){if("throw"===o)throw i;return doneResult()}for(r.method=o,r.arg=i;;){var a=r.delegate;if(a){var c=maybeInvokeDelegate(a,r);if(c){if(c===f)continue;return c}}if("next"===r.method)r.sent=r._sent=r.arg;else if("throw"===r.method){if(n===u)throw n=l,r.arg;r.dispatchException(r.arg)}else"return"===r.method&&r.abrupt("return",r.arg);n=s;var y=tryCatch(t,e,r);if("normal"===y.type){if(n=r.done?l:h,y.arg===f)continu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\advert[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	https://mc.yandex.ru/metrika/advert.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	49153
Entropy (8bit):	5.520906949461031
Encrypted:	false
SSDEEP:	768:/yR3fYFBLbfs5sP5XqY3TyPnHpl1WY3SoavFVv6PU+CgYUD0lgEw0stZM:/y9gZfl5h3UHpaY3SoRCw0sk
MD5:	6DF1787C4BE82D1BB24F8BFFA10C7738
SHA1:	3634E839429E462E49C5F42B75FBFB4BA318AF6D
SHA-256:	2CB09C7B3E19BFC41743CA3624EF81C3258D56525647FEAC76AA757E0292627A
SHA-512:	CB3CE2BCEB61F390298C21E470423CCEB6DD93E648A7DD0467195B11FEF30BF7A086DFF47C4494E2533498D1448C1A22AAB1414C14FD73278F1C92E0F7BC3F94
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var n=this\|\|self,p=function(a,b){a=a.split(".");var c=n;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q={},r=function(){q.TAGGING=q.TAGGING\|\|[];q.TAGGING[1]=!0};var t=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},v=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var x=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var y=window,z=document,A=function(a,b){z.addEventListener?z.addEventListener(a,b,!1):z.attachEvent&&z.attachEvent("on"+a,b)};var B=/:[0-9]+$/,C=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},F=function(a,b){b&&(b=String(b).toLowerCase());if("p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\collect[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	70
Entropy (8bit):	2.9889227488523016
Encrypted:	false
SSDEEP:	3:CUdrllHhqwdrllHh/:HJqyJ/
MD5:	A1CA693368CFE6AB208F1F1BB8C2EF58
SHA1:	31A655D748475A8A3E5246F591EA2A81F6BFA938
SHA-256:	89BC4F148F94BA4EDA1E4AAA2FD899D5495C9A297CF848CF7670F78A3251EBA7
SHA-512:	F12907B9BA0AA9B6EF125C6CEDB7E4137B300BA9FA1210F6E94CFFBBFDC7395F300CD36BC171FE8EF0D10AF27A65EF26EA0FE53A74F82D05604FC161F6E66145
Malicious:	false
Reputation:	low
Preview:	GIF89a.............,...........D..;GIF89a.............,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fbevents[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	95938
Entropy (8bit):	5.395551905316836
Encrypted:	false
SSDEEP:	1536:5M+OWtI6ay9Ies1zKqQqfUThe7Kdv0a9sIOs1jaV7vu5Om20C+QNSMngySZYSlIa:5zNpkjSVnYDGeI
MD5:	38EEDE6B7D7BC51D9D0935E3850DAD20
SHA1:	D0B0061C020A48B5DFB8CC19C15694D8B7E6896F
SHA-256:	547F226C6E04B6654144617685448D360E2A92D908C6FB646761A1E6D4850004
SHA-512:	164B13C0764FFA43CCB45455BB20CF4E32ADEC23DA1666E2E2D613172070B9E734E9F007A3593D1457B023920D359084A7BDAB8D80F37A09824D763A07B06D48
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\fbevents[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	95938
Entropy (8bit):	5.395551905316836
Encrypted:	false
SSDEEP:	1536:5M+OWtI6ay9Ies1zKqQqfUThe7Kdv0a9sIOs1jaV7vu5Om20C+QNSMngySZYSlIa:5zNpkjSVnYDGeI
MD5:	38EEDE6B7D7BC51D9D0935E3850DAD20
SHA1:	D0B0061C020A48B5DFB8CC19C15694D8B7E6896F
SHA-256:	547F226C6E04B6654144617685448D360E2A92D908C6FB646761A1E6D4850004
SHA-512:	164B13C0764FFA43CCB45455BB20CF4E32ADEC23DA1666E2E2D613172070B9E734E9F007A3593D1457B023920D359084A7BDAB8D80F37A09824D763A07B06D48
Malicious:	false
Reputation:	low
IE Cache URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\files[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	736
Entropy (8bit):	5.212378745168149
Encrypted:	false
SSDEEP:	12:Yw4tJLnwskwflepB4uxokmjf6F+zbkmjfBU/f8X9PvK9LrmX6q:YptJYGlsmbM+Emb2fYnK4XN
MD5:	26F1B6B72E74DB9758B1A6E41C8F4150
SHA1:	7A954F50D1A72F4555263BF0C7F61EFFFE688339
SHA-256:	1937B14907EC62026C0FB9EEC3B7906BA9FA7AD67B6C175ADF1144ED12462434
SHA-512:	920A1045B059A87E80D55D9E2A8C138B7A9E82EDA070C0908EA7CE31ECB600CDA131ADEFBB5AB724BF506E3A94563662B819E3A0D3070B6CF0502E75CAAC7CC2
Malicious:	false
Reputation:	low
IE Cache URL:	https://us2sync.myonlinedata.net/metadata/v4.1/organizations/4104132/users/externalshare_IpnIUjFRDCv9PeEVchmZ5r003e9fc4/files?include_last_version=true&include_owner=true&include_tags=true&path=%2F
Preview:	{"total_item_count": 1, "items": [{"path": "/", "id": "Lw==", "owner_path": "/8eba0a5f-2b83-494f-b349-7124438d7911/filesync/TEST!/VoIPTesterSetup_v5.0 (1).exe", "type": "file", "is_trashed": 0, "effective_permission_level": "read", "owner": {"display_name": "AFM Demo User", "identity": "8eba0a5f-2b83-494f-b349-7124438d7911", "type": "regular_user"}, "last_version": {"author": {"display_name": "AFM Demo User", "identity": "8eba0a5f-2b83-494f-b349-7124438d7911", "type": "regular_user"}, "client_modification_date": "2021-06-17T15:28:00.0Z", "creation_date": "2021-06-17T15:30:28.0Z", "id": "4104132-10008-1033-1", "sha256": "00e7b6850960437b789013952bce32210c85cf8898ad8aff86a074634aad5cea", "size": 18607104, "version_number": 1}}]}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\intm-logo-wide[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	8214
Entropy (8bit):	4.718687101554578
Encrypted:	false
SSDEEP:	96:xvfpgWnFlQZcFlSP1iElKFlQZP5FlSzhhFlQZjFlS9r4q29d1Rut5WazGhn1Jsqx:hpgWyiElcO9jD+GhEqhqDM+7Y
MD5:	5A60366C9E2C66D01677BF49D15B7559
SHA1:	26B9E1368545507B8430B08AE0A5008373704107
SHA-256:	5D71E23C21819077F7EBCDCB8A7B9BFEA9F9B9DB0726C01F73180DB2FB85059D
SHA-512:	14C09F5BDA591B0A1508E909DA7DC4DB09BC0767F50B2866B10EC26E225E4322D3B31A21EF32743EE309A3A9E7F01308C72A39319C51A7A57B751E3327255688
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/intm-logo-wide.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 24.2.3, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 496.34 56" style="enable-background:new 0 0 496.34 56;" xml:space="preserve">.<style type="text/css">...st0{fill:#FF960C;}...st1{fill:#009AF6;}...st2{fill:#74B800;}...st3{fill:#FF3F3F;}...st4{fill:#231F20;stroke:#231F20;stroke-width:0.0634;stroke-miterlimit:10;}...st5{fill:#231F20;}.</style>.<g>..<g>...<rect x="113.09" y="0.85" class="st0" width="20.92" height="54.01"/>...<rect y="0.85" class="st1" width="20.92" height="54.01"/>...<rect x="37.74" y="0.85" class="st2" width="20.92" height="54.01"/>...<rect x="75.41" y="0.85" class="st3" width="20.92" height="54.01"/>..</g>..<g>...<path class="st4" d="M163.55,55.97c-1.35,0-2.44-0.47-3.24-1.27c-1.22-1.22-1.29-2.35-1.29-5.31c0-2.97,0.07-4.09,1.29-5.31....c0.8-0.8,1.89-1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\jquery-custom-ui.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	129230
Entropy (8bit):	5.207533151505277
Encrypted:	false
SSDEEP:	1536:u0rIkpH0/jhNhY//gL2BTzXjk5XtzQt6oD7ITBjI2M05Dt5jFNQdVthRLEOee1Cr:zrwhXGHPcGFzLEOe0CfhGmxErXSv
MD5:	5A9F8DD85D85AFD20544BD437A505338
SHA1:	0BE5CCE9FF0CDF0B3489A67E9F9F2B4830BC7D4B
SHA-256:	35F273E01E70DB780AE423347DFFECFC27CC348BA4ABBD6099331559A7C5CD31
SHA-512:	3E5738EB6C73B431583409117BA590B376DA4773B85D7A5B1887AE81B4F5CAE00AF96D29DB1F752F9AE849642DABE41A7BCDC6E99C0AD8A09D92AA3D40E81F0E
Malicious:	false
Reputation:	low
IE Cache URL:	https://rtp-static.marketo.com/rtp/libs/jqueryui/1.9.2f/jquery-custom-ui.min.js
Preview:	(function(b,f){var a=0,e=/^ui-id-\d+$/;b.ui=b.ui\|\|{};if(b.ui.version){return}b.extend(b.ui,{version:"1.9.2",keyCode:{BACKSPACE:8,COMMA:188,DELETE:46,DOWN:40,END:35,ENTER:13,ESCAPE:27,HOME:36,LEFT:37,NUMPAD_ADD:107,NUMPAD_DECIMAL:110,NUMPAD_DIVIDE:111,NUMPAD_ENTER:108,NUMPAD_MULTIPLY:106,NUMPAD_SUBTRACT:109,PAGE_DOWN:34,PAGE_UP:33,PERIOD:190,RIGHT:39,SPACE:32,TAB:9,UP:38}});b.fn.extend({_focus:b.fn.focus,focus:function(g,h){return typeof g==="number"?this.each(function(){var i=this;setTimeout(function(){b(i).focus();if(h){h.call(i)}},g)}):this._focus.apply(this,arguments)},scrollParent:function(){var g;if((b.ui.ie&&(/(static\|relative)/).test(this.css("position")))\|\|(/absolute/).test(this.css("position"))){g=this.parents().filter(function(){return(/(relative\|absolute\|fixed)/).test(b.css(this,"position"))&&(/(auto\|scroll)/).test(b.css(this,"overflow")+b.css(this,"overflow-y")+b.css(this,"overflow-x"))}).eq(0)}else{g=this.parents().filter(function(){return(/(auto\|scroll)/).test(b.css(this,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	95816
Entropy (8bit):	5.499438440314399
Encrypted:	false
SSDEEP:	1536:B1+XJVesTp0ZfITFDvJLWiyo7yGxNdDjjh4pVM6XCqv1895/Pty6BHFo93sAtT01:Bg5VeC0CDvJzi2dT2M5qOrKttTVnc9
MD5:	0CF95A92F21874296132A62BD48009DD
SHA1:	27B5A3EA9F20C43E402E413D21DDA8C967E39D95
SHA-256:	FF80923943F362EFA62AAF278C3CCF585336327C49A34A58D0E4EA115415D60A
SHA-512:	FF314931BE33B7C64707B8477BFBF0301C4854EF92F3989A16F7C2F2A3BEA084FC16DB6EF5E560676609378427529E170CEB723468B320F2082EEBB1D60E4D01
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/gtm/js?id=GTM-KJF2NWF&cid=1641651054.1624013785
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"38",. . "macros":[{. "function":"__e". },{. "function":"__dee". },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":false. },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__exs",. "vtp_measurementId":"r6fbIoynSqexBSoAMqp9wQ",. "vtp_sections":["list",2]. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "vtp_experimentKey":"GTM-KJF2NWF_OPT-WC8ZZ",. "function":"__c",. "vtp_value":0. },{. "function":"__cie",. "vtp_experimentState":["macro",4],. "vtp_trafficCoverage":["macro",5],. "vtp_trafficCoverageHash":["macro",6]. },{. "function":"__c",. "vtp_value":false. },{. "functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\linkedin[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	765
Entropy (8bit):	4.548722016962115
Encrypted:	false
SSDEEP:	12:t4MTt3MFYaHbA90sGrpRzWBSFU35ws5+UM4LA+GXfQSU0eDtA3L3KA30dc6jb:t4MTt0YcA90sEfmF5+UMNsSU0AAnf8b
MD5:	8628F5D87595ABB35032DF3F72616F3A
SHA1:	C6C911C21F1AE88C10F88BD4701FB41A5648E62E
SHA-256:	42F783331A40FA41DCA92D62F4105A10129ECEB77EF41703196881200F647BB0
SHA-512:	DA815F8DB47C8B9FF2946861013679D20653A532B8AA6C37CCA8A76108D7EFE00F632471EDA3D8542AF970706D9895DB2FC5F2443D9FB2E625A5C942D82DA503
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/tracked/img/social/linkedin.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="40.5" height="40.5"><path fill="#fff" d="M20.25.25c-11.05 0-20 8.95-20 20s8.95 20 20 20 20-8.95 20-20-8.95-20-20-20zm9.279 28.09c0 .721-.6 1.301-1.329 1.301h-15.34c-.74 0-1.33-.58-1.33-1.301v-15.52c0-.71.59-1.29 1.33-1.29h15.34c.729 0 1.329.58 1.329 1.29v15.52z"/><path fill="#fff" d="M23.66 18.32c1.79 0 3.13 1.17 3.13 3.68v4.689h-2.72v-4.379c0-1.101-.391-1.851-1.37-1.851-.761 0-1.21.511-1.4.99-.069.18-.09.43-.09.67v4.569h-2.72s.03-7.419 0-8.181h2.72v1.16l-.021.03h.021v-.03c.36-.557 1-1.347 2.45-1.347z"/><rect x="14.27" y="18.51" fill="#fff" width="2.72" height="8.182"/><path fill="#fff" d="M15.65 14.57c.92 0 1.5.61 1.51 1.41 0 .78-.59 1.41-1.53 1.41h-.02c-.92 0-1.5-.63-1.5-1.41 0-.8.6-1.41 1.54-1.41z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\log[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CUnl/7yltxlHh/:/+/
MD5:	07FFF40B5DD495ACA2AC4E1C3FBC60AA
SHA1:	E8AC224BA9EE97E87670ED6F3A2F0128B7AF9FE4
SHA-256:	A065920DF8CC4016D67C3A464BE90099C9D28FFE7C9E6EE3A18F257EFC58CBD7
SHA-512:	49B8DAF1F5BA868BC8C6B224C787A75025CA36513EF8633D1D8F34E48EE0B578F466FCC104A7BED553404DDC5F9FAFF3FEF5F894B31CD57F32245E550FAD656A
Malicious:	false
Reputation:	low
IE Cache URL:	https://st2.dialogtech.com/st/log?_stk=65389331b63b84e5636e5385d48228ccef23ab2c&dr=https%3A%2F%2Fwww.intermedia.com%2Fwhy-intermedia&dl=https%3A%2F%2Fwww.intermedia.com%2Fwhy-intermedia%2Fcompliance&dt=IT%20Compliance%20Solutions%20For%20Regulated%20Industries%20%7C%20Intermedia&vp=1263x906&sr=1280x1024&bid=47319750-cfd8-11eb-8c0d-010f428ac588&pid=47342f60-cfd8-11eb-8c0d-010f428ac588&stn=&sgn=0&ua=UA-214873-1&uac=1641651054.1624013785&stv=35&r=&cb=1624013792217
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\logo_footer[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5723
Entropy (8bit):	3.9859257963829005
Encrypted:	false
SSDEEP:	96:LlovKQDmtlbN3AjJ+1ExtTcKjvd0DPzwVeSUb3vIz:LUytdN3AcujHeDPzwQ7gz
MD5:	59EAAE579953618D99219E4AFF0EF9C4
SHA1:	4731CF4159078CC8556B7762033CED94C3B69C80
SHA-256:	0D8B52244F88CAAE91DEE1F45B9D296631B105D317946EE70097D0267BB48364
SHA-512:	30F47F2679609D65154725795268E85FC707B97966F729AA40CB315819A212566CAE7C5981F484984BC5396F25C4BDDC5C2BD3B986C5D7C8F4D8FBDCACAE31CB
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/theme/images/logo_footer.svg
Preview:	<svg width="75" height="40" viewBox="0 0 75 40" xmlns="http://www.w3.org/2000/svg"><title>logo</title><g fill="#777A82" fill-rule="nonzero"><path d="M.271 20.407h1.356v6.915H.271v-6.915zm8.678 6.915l-2.78-4.271v4.271H4.814v-6.915h1.22l2.78 4.271v-4.271h1.355v6.915H8.95zM16 21.627v5.763h-1.356v-5.763h-1.83v-1.22h4.949v1.22H16zm4.542 5.695v-6.915h4.543v1.22h-3.187v1.627h2.712v1.22h-2.712v1.695h3.187v1.22l-4.543-.067zm11.119 0l-1.356-2.78h-.95v2.78H28v-6.915h2.712c1.424 0 2.237.949 2.237 2.101 0 .95-.61 1.56-1.288 1.831l1.56 2.983h-1.56zm-1.017-5.695h-1.288v1.83h1.288c.61 0 1.017-.406 1.017-.949-.068-.474-.407-.88-1.017-.88M40.881 27.322v-4.068l-1.356 2.644h-.88l-1.357-2.644v4.068h-1.356v-6.915h1.356l1.83 3.729 1.831-3.73h1.356v6.916h-1.424zm4.61 0v-6.915h4.543v1.22h-3.187v1.627h2.712v1.22h-2.712v1.695h3.187v1.22l-4.542-.067zm11.797-.61c-.474.474-1.085.678-1.83.678h-2.509v-6.915h2.509c.745 0 1.356.203 1.83.678.746.813.678 1.762.678 2.78.068.948.136 1.965-.678 2.779m-.949-4.678c-.203-.271-

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\mostimpt-securisync[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 359 x 254, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	4763
Entropy (8bit):	7.899451853736675
Encrypted:	false
SSDEEP:	96:loT7VvLKBFwd/YZuncjE9RijCCnr8p5LQPmvRXie4jgfLboavG:loT7VvSu/YZuL9RijlnKdWmvRTDEv
MD5:	D27B5B10F218D9DCD6F8D4EA51F07E15
SHA1:	0ECBB98B01C01B617C608D1560336D847054EA9E
SHA-256:	90EC47439C588211F361E9479EE40FEAB870A589054DD7600774BE49B7128821
SHA-512:	3087FA19228A41E79F2227ABCAD9ACA6D3F7A6E884E76F28B470FEB45701990BFB694F7EA16F1CFF96BCFC1A08C1428E21713C2F3FFA23CB8A0FB2C7B7B09195
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.intermedia.com/assets/images/mostimpt-securisync.png
Preview:	.PNG........IHDR...g..........x4.....PLTEGpL...........................QQV...............)%$....."................FEDTW]........^_d........xx\|ihj.......................Y..DZ....m...147.......p.jB..&..>S.72....tRNS...../..00j.hz....IDATx...{....g.s....IB.$. %.:........m..V.b..RP(..!$/.....5..\|y.9.\J..l..).8..<..Z.......m[......\|%(..PN...Vr.].9..4.~.Y..l2.M&..zA..9h.,AE.^..V..\|...-\|.\|.s.EP(...(.....@.....'..r......m......X..'..d..../.._.>R.w3K.M.P..E.c.V"}...g1...9..3..G.ir.W....<../.g..s./....=.C<.'1...=....#.....g9......p^....+-p..<zg.`_..q7.$F.V........O^if._W..g+.4....zz..\|bm..f.......~Y.a}.E...m5..?..dXf>{..\|...+..."G...9.N[(r...7...yl..O...-...D.{....".=pn....I..e.0....$.,-`.\..9.g..xn.......[.KE....T.../.xj...'...r.......,.D.......i..[b..r..o........q.$..8T.[W'..w.d~.{.\|.....I..j^d..K..n.RK......>...Z....ae.......z:..?.........<.. ..pnM...a.......G...s.....<.......}..a...1...%..\..P..zc.{...y^..R.X.........@.sV.......IN..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\munchkin[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1284
Entropy (8bit):	5.4895916405964735
Encrypted:	false
SSDEEP:	24:mbL7pIgWcbMdA0POeQSfmFtHXRWYxRWZgRK+uKF69FpqsPg6F/ysbVFyIF/IFKeQ:U7phWzA6ZcVwYxwTlLpqgg6FKWrSuCMd
MD5:	5379C4A40FF8AE9D2FC6484DD1C57349
SHA1:	797FA2B713AD85F8535AFFF56E8A21FBD3328CE8
SHA-256:	026C5DB877DA222D2316BF1197B8947A96C7623D51A4D462C91BF927DECE3429
SHA-512:	9D9C2F436FC04B79ABDF40A0DCF2F2360DBF35846FB76CE3D32BD045C29860EA926FA97F023CFCCA2FDC0B8A6EE16BE5F193AFF399631C85562E3641A07FE779
Malicious:	false
Reputation:	low
IE Cache URL:	https://munchkin.marketo.net/munchkin.js
Preview:	/. Copyright (c) 2007-2018, Marketo, Inc. All rights reserved.. * See https://developers.marketo.com/MunchkinLicense.pdf for license terms. * Marketo marketing automation web activity tracking script. * Version: prod r859. */. (function(b){if(!b.Munchkin){var c=b.document,e=[],k,l={fallback:"160"},g=[],m=function(){if(!k){for(;0<e.length;){var f=e.shift();b.MunchkinTracker[f[0]].apply(b.MunchkinTracker,f[1])}k=!0}},n=function(f){var a=c.createElement("script"),b=c.getElementsByTagName("base")[0]\|\|c.getElementsByTagName("script")[0];a.type="text/javascript";a.async=!0;a.src=f;a.onreadystatechange=function(){"complete"!==this.readyState&&"loaded"!==this.readyState\|\|m()};a.onload=m;b.parentNode.insertBefore(a,b)},h={ASSOCIATE_LEAD:"ASSOCIATE_LEAD",.CLICK_LINK:"CLICK_LINK",VISIT_WEB_PAGE:"visitWebPage",init:function(b){var a;a=l[b];if(!a&&0<g.length){a=b;var c=0,d;if(0!==a.length)for(d=0;d<a.length;d+=1)c+=a.charCodeAt(d);a=g[c%g.length]}a\|\|(a=l.fallback);e.push(["init",arguments]);"150

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\notosans-semibold[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 179696, version 0.0
Category:	downloaded
Size (bytes):	179696
Entropy (8bit):	7.992262500911683
Encrypted:	true
SSDEEP:	3072:pSq5sCxuHphGx/vFofJ/FJf30gkn9+LzBcg3Q13Aw6V6uhY/osuhJ9o7zgkFpNBA:pSq5TxuJ3J/fvJk9mcg38wrhR57Koe+
MD5:	D37A9E1A68AD99613B0734A8813333C4
SHA1:	CED8191EB7B0DA02CBF9879FABFFB252F2160D49
SHA-256:	1F825E1387E3131C7A317CFE05B0519A1AF23D41CA99CB7B5F53C6129F35E79A
SHA-512:	DF6406618280121909CD7033B11CADE97C17E412DA0376C25F3F5D744E3A0F46245981C05DC014EE1CDC9867C3EF086D8B503B2CAD8819BABD7C920464CCDDE7
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/content/sync/fonts/notosans-semibold.woff?version=3.18.0
Preview:	wOFF..............C.........................FFTM............~..EGDEF..$<........1...GPOS..2....:..Y...GSUB..'P...H......OS/2.......[...`l..cmap...d........1. .gasp..$4............glyf..<............head...X...6...6....hhea.......!...$...6hmtx...0...1..2....uloca...0......2..t.Pmaxp........... ....name..........VE.X.post.....;.......}............_.<...........z.......C....{...+............x.c`d``..w...[.....>0.E......+.....x.c`d`...p.A.Q.A...C...L.-......x.c`a.a.``e``........1.....(..............<...&.......;......,..n30..2.2@....) .....g....x...xV...../ ...a........(..}...P4XP\../HE..TAA...+.-.~...R..u.[U,X...]r.;s...B.<...;w.3s.e.=^&...\..I......)..%...R7C..F.&?J..$....<...l.3.H....T.Q....].s3.;....A'_?[r..P..zU......7J....i?.......;..T1f..a.....tw.V...g....+.GHc..L..?I.^$.N......!#.gh+.ok..H..%E.J.........f.4...(.]n.<.... .ZnO..+..y.o....^..Vn;0~..oK@.k...7..\|.....k..h.e}A]_.K.c..U.h..-9v._.b]{_.#.i.n.l...-.\...2..-oF?P...E~.w..(-\/9.........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\partials[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	196038
Entropy (8bit):	4.737807318699203
Encrypted:	false
SSDEEP:	768:eUVE7b8/gP0uJSvbH+wIiijOUJdXdS8AC35ExDZYcaWDvHqI5z/OeI41V49:eUVE7b8/TrgSw35ExDZd3iI5zP0
MD5:	148A97118941BBEC7D56679793EB8863
SHA1:	A58D45A992A922F5B518830E9CB73625B0FC636E
SHA-256:	2A6E3B046303941C763D4F4E16F48613A03EBA41F6456AB05E98DDA83212B129
SHA-512:	E011E02FF5A016A4A3BAA4A0208740DB7B46F6F9A00DAC4033CECCCA33489BA85FB3E50396400E20C32B90F222C59E8690F5C844FD75C72796AF07F7609A1C1A
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/scripts/partials.js?version=3.18.0
Preview:	angular.module("syncApp").run(["$templateCache", function($templateCache) {$templateCache.put("app/components/audio/audio.html","<div class=\"mb24 validation-input\">\r\n <audio>\r\n {{ \'FILESYNC.AUDIO_PLAYER.NOT_SUPPORT_AUDIO\' \| locale }}\r\n </audio>\r\n <div class=\"audioplayer {{vm.isDark ? \'is-dark\' : \'\'}}\">\r\n\r\n <div ng-if=\"!vm.isLoaded\" class=\"audioplayer__loader\">\r\n <dwngd:app-progress-spinner [size]=\"36\"></dwngd:app-progress-spinner>\r\n </div>\r\n\r\n \r\n <div ng-if=\"!vm.isDark\">\r\n <div class=\"btn-playback-control fl\" style=\"margin: 7px 0 7px 16px;\" ng-hide=\"vm.isPlaying\" ng-click=\"vm.play()\">\r\n\r\n <div class=\"cursor-pointer btn-play-light\">\r\n <svg xmlns=\"http://www.w3.org/2000/svg\" width=\"42\" height=\"42\" viewBox=\"0 0 42 42\"><style type=\"text/css\">.st0 { fill: #FFFFFF; }.st1 { clip-path: url(#SVGID_2_); }.st2 {fill: none;stroke:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\player_api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	980
Entropy (8bit):	5.305794466576843
Encrypted:	false
SSDEEP:	24:E1HXIbtEHvk6YtpqAK/HJ2TAXzK5vuHM8aJLtdRWZ4FhQ:E1HXmtEP0PcSAXW5kaJLzwYhQ
MD5:	533EFF24EBBE43EF4C6E147992020DC3
SHA1:	A550239FD617A992D8C62510702C8A25723F6150
SHA-256:	805C978B06B771610476FAF71921CFF8D013C59D45423B70DC0328E753A90BAF
SHA-512:	D86CBA041461E6F8D579009B3E8AA12AD6E70E5A4F03AF4043730FDA146E35CDFFF3C4932F4F3477BA5EF054A5DF608363C253A05F2E14A29D56D35D2B4DD972
Malicious:	false
Reputation:	low
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/997fe684\/www-widgetapi.vflset\/www-widgetapi.js';try{var ttPolicy=window.trustedTypes.createPolicy("youtube-widget-api",{createScriptURL:function(x){return x}});scriptUrl=ttPolicy.createScriptURL(scriptUrl)}catch(e){}if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;for(var i=0;i<l.length;i++)try{l[i]()}catch(e$0){}};YT.setConfig=function(c){for(var k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",n)}var b=.document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\PSUEOSZZ\polyfills.bundle[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with NEL line terminators
Category:	downloaded
Size (bytes):	149679
Entropy (8bit):	5.32740054924391
Encrypted:	false
SSDEEP:	1536:IhznfVKKcP9tC/MPvO3Y67V/MyeOLy+JFcgB:cznxcMvVEyeSRcs
MD5:	95DACC88598C45155D69D26688ED62CF
SHA1:	5C9AE7F5CAF56177DF1037723C16D34BE89F54AC
SHA-256:	67207F98601FF8596D2C2B50657BE692E9EC71F2BE70D5FD8E197B26EDB6114E
SHA-512:	6706A06DEA4FAC680FB82783F0C7781C6ACA65B63FFB156AF0984B4BCD69D6B3FC2E446DC733E6936C33529BA9925F4C46A6B53902B52B2A44BFC7666F66F28A
Malicious:	false
Reputation:	low
IE Cache URL:	https://securisync.intermedia.net/us2/scripts/polyfills.bundle.js?version=3.18.0
Preview:	!function(t){function e(n){if(r[n])return r[n].exports;var o=r[n]={i:n,l:!1,exports:{}};return t[n].call(o.exports,o,o.exports,e),o.l=!0,o.exports}var n=window.webpackJsonp;window.webpackJsonp=function(r,i,a){for(var u,c,s,f=0,l=[];f<r.length;f++)c=r[f],o[c]&&l.push(o[c][0]),o[c]=0;for(u in i)Object.prototype.hasOwnProperty.call(i,u)&&(t[u]=i[u]);for(n&&n(r,i,a);l.length;)l.shift()();if(a)for(f=0;f<a.length;f++)s=e(e.s=a[f]);return s};var r={},o={2:0};e.e=function(t){function n(){u.onerror=u.onload=null,clearTimeout(c);var e=o[t];0!==e&&(e&&e[1](new Error("Loading chunk "+t+" failed.")),o[t]=void 0)}var r=o[t];if(0===r)return new Promise(function(t){t()});if(r)return r[2];var i=new Promise(function(e,n){r=o[t]=[e,n]});r[2]=i;var a=document.getElementsByTagName("head")[0],u=document.createElement("script");u.type="text/javascript",u.charset="utf-8",u.async=!0,u.timeout=12e4,e.nc&&u.setAttribute("nonce",e.nc),u.src=e.p+""+t+".chunk.js";var c=setTimeout(n,12e4);return u.onerror=u.onload=n

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 18, 2021 03:55:14.787266970 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:14.787271023 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:14.919220924 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:14.919356108 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:14.923212051 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:14.923383951 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:14.926377058 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:14.926516056 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.057949066 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.060482979 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.060549021 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.060594082 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.060605049 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.060625076 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.060740948 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.062006950 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.064071894 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.064114094 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.064152956 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.064181089 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.064233065 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.064256907 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.105951071 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.106031895 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.115791082 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.238105059 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.238356113 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.242085934 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.242325068 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.251327038 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251379013 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251421928 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251458883 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251497030 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251502037 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.251534939 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251571894 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251610041 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251646042 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.251651049 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.251729012 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.370006084 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.370063066 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.370090008 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.370109081 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.383222103 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.383249998 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.383292913 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.383300066 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.383310080 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.383338928 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.383356094 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.383387089 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.456964016 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.457695007 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.459599018 CEST	49682	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.460549116 CEST	49683	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.461464882 CEST	49684	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.462400913 CEST	49685	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.592894077 CEST	443	49683	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593065977 CEST	49683	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593410015 CEST	443	49680	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593488932 CEST	49680	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593713999 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593756914 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593780994 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593794107 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593797922 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593832016 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593854904 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593872070 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593877077 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593908072 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593916893 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593945980 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593955040 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.593982935 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.593991995 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594027996 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594028950 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594072104 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594074011 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594109058 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594118118 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594146967 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594156027 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594177961 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594191074 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594206095 CEST	443	49682	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594223976 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594326019 CEST	49682	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594409943 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594451904 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594459057 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594491005 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594495058 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594527006 CEST	443	49681	199.193.202.116	192.168.2.3
Jun 18, 2021 03:55:15.594552994 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594573975 CEST	49681	443	192.168.2.3	199.193.202.116
Jun 18, 2021 03:55:15.594573975 CEST	443	49681	199.193.202.116	192.168.2.3

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jun 18, 2021 03:55:13.476360083 CEST	49594	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:13.543822050 CEST	53	49594	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:14.715959072 CEST	54260	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:14.777049065 CEST	53	54260	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:21.095062017 CEST	51904	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:21.172477007 CEST	53	51904	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:21.756947994 CEST	61328	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:21.818114042 CEST	53	61328	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:23.413613081 CEST	54130	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:23.475003004 CEST	53	54130	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:24.329157114 CEST	56961	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:24.392811060 CEST	53	56961	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:25.070135117 CEST	59353	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:25.130974054 CEST	53	59353	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:31.084148884 CEST	52238	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:31.149883032 CEST	53	52238	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:32.914650917 CEST	49873	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:32.973870993 CEST	53	49873	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:34.408607960 CEST	53196	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:34.616717100 CEST	53	53196	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:34.639190912 CEST	56777	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:34.708750963 CEST	53	56777	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:34.829817057 CEST	58643	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:34.852447033 CEST	60985	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:34.854914904 CEST	50200	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:34.896383047 CEST	53	58643	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:34.902998924 CEST	53	60985	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:34.915568113 CEST	53	50200	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.355463028 CEST	51281	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.370819092 CEST	49199	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.422420025 CEST	53	51281	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.438430071 CEST	53	49199	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.492196083 CEST	50620	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.507596016 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.519365072 CEST	60152	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.534586906 CEST	57544	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.553493977 CEST	55984	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.569797993 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.588465929 CEST	53	60152	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.595166922 CEST	53	57544	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.611592054 CEST	53	55984	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.611898899 CEST	64185	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.639223099 CEST	53	50620	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.678220987 CEST	53	64185	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.684437990 CEST	65110	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.748497009 CEST	53	65110	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.814750910 CEST	58361	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:36.879014015 CEST	53	58361	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:36.962023020 CEST	63492	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.025609970 CEST	53	63492	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.323956966 CEST	60831	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.379206896 CEST	60100	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.391290903 CEST	53	60831	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.444061041 CEST	53	60100	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.449728012 CEST	53195	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.499779940 CEST	53	53195	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.614053965 CEST	50141	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.672804117 CEST	53	50141	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.728439093 CEST	53023	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.735054016 CEST	49563	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.740183115 CEST	51352	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.787585974 CEST	53	53023	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.794106007 CEST	53	49563	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.812952995 CEST	53	51352	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:37.826893091 CEST	59349	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:37.882910013 CEST	53	59349	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:38.394568920 CEST	57084	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:38.398597956 CEST	58823	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:38.456568003 CEST	53	57084	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:38.457277060 CEST	53	58823	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:38.698909044 CEST	57568	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:38.904936075 CEST	53	57568	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:39.793983936 CEST	50540	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:39.864290953 CEST	53	50540	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:41.415890932 CEST	54366	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:41.474689007 CEST	53	54366	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:43.504798889 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:43.566591024 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:44.085089922 CEST	57762	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:44.177246094 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:44.199409008 CEST	53	57762	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:44.236129045 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:44.504981041 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:44.566561937 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:45.208070040 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:45.266805887 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:45.567527056 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:45.629060984 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:46.256812096 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:46.315620899 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:47.697460890 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:47.750658035 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:48.317445993 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:48.367628098 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:51.708306074 CEST	53034	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:51.761842012 CEST	53	53034	8.8.8.8	192.168.2.3
Jun 18, 2021 03:55:52.364770889 CEST	55435	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:55:52.423279047 CEST	53	55435	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:03.473010063 CEST	50713	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:03.534152985 CEST	53	50713	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:52.858690977 CEST	56132	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:52.909586906 CEST	53	56132	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:54.114897966 CEST	58987	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:54.168564081 CEST	53	58987	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:55.726486921 CEST	56579	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:55.791218996 CEST	53	56579	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:57.661360025 CEST	60633	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:57.711998940 CEST	53	60633	8.8.8.8	192.168.2.3
Jun 18, 2021 03:56:58.900764942 CEST	61292	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:56:58.951828003 CEST	53	61292	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:00.246893883 CEST	63619	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:00.308537006 CEST	53	63619	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:02.634489059 CEST	64938	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:02.686223984 CEST	53	64938	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:04.071021080 CEST	61946	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:04.130961895 CEST	53	61946	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:05.801796913 CEST	64910	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:05.855627060 CEST	53	64910	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:07.227418900 CEST	52123	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:07.281131029 CEST	53	52123	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:08.751152992 CEST	56130	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:08.810437918 CEST	53	56130	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:10.447621107 CEST	56338	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:10.506598949 CEST	53	56338	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:11.916481018 CEST	59420	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:11.974042892 CEST	53	59420	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:13.281503916 CEST	58784	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:13.346143961 CEST	53	58784	8.8.8.8	192.168.2.3
Jun 18, 2021 03:57:14.797444105 CEST	63978	53	192.168.2.3	8.8.8.8
Jun 18, 2021 03:57:14.863173962 CEST	53	63978	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jun 18, 2021 03:55:14.715959072 CEST	192.168.2.3	8.8.8.8	0xb22b	Standard query (0)	securisync.intermedia.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.095062017 CEST	192.168.2.3	8.8.8.8	0x489b	Standard query (0)	cdn.heapanalytics.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.756947994 CEST	192.168.2.3	8.8.8.8	0x7e71	Standard query (0)	auth.myonlinedata.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.413613081 CEST	192.168.2.3	8.8.8.8	0x1c68	Standard query (0)	heapanalytics.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:24.329157114 CEST	192.168.2.3	8.8.8.8	0x6c4f	Standard query (0)	auth.us2sync.myonlinedata.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:25.070135117 CEST	192.168.2.3	8.8.8.8	0x2c3f	Standard query (0)	us2sync.myonlinedata.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:31.084148884 CEST	192.168.2.3	8.8.8.8	0x9f26	Standard query (0)	securisync.intermedia.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:32.914650917 CEST	192.168.2.3	8.8.8.8	0x578f	Standard query (0)	www.intermedia.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.408607960 CEST	192.168.2.3	8.8.8.8	0x2471	Standard query (0)	app-sj01.marketo.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.854914904 CEST	192.168.2.3	8.8.8.8	0x4273	Standard query (0)	abrtp1-cdn.marketo.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.355463028 CEST	192.168.2.3	8.8.8.8	0xf0fc	Standard query (0)	rtp-static.marketo.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.370819092 CEST	192.168.2.3	8.8.8.8	0x1c0e	Standard query (0)	abrtp1.marketo.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.492196083 CEST	192.168.2.3	8.8.8.8	0xb91f	Standard query (0)	www.intermedia.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.507596016 CEST	192.168.2.3	8.8.8.8	0x3c52	Standard query (0)	tracking.g2crowd.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.519365072 CEST	192.168.2.3	8.8.8.8	0xd195	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.534586906 CEST	192.168.2.3	8.8.8.8	0xa579	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.553493977 CEST	192.168.2.3	8.8.8.8	0xedda	Standard query (0)	cdn.jsdelivr.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.611898899 CEST	192.168.2.3	8.8.8.8	0x8e4f	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.684437990 CEST	192.168.2.3	8.8.8.8	0x40e9	Standard query (0)	d31y97ze264gaa.cloudfront.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.814750910 CEST	192.168.2.3	8.8.8.8	0x5775	Standard query (0)	js.driftt.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.962023020 CEST	192.168.2.3	8.8.8.8	0xea2f	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.323956966 CEST	192.168.2.3	8.8.8.8	0xca6b	Standard query (0)	st1.dialogtech.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.379206896 CEST	192.168.2.3	8.8.8.8	0x939e	Standard query (0)	cc.cdn.civiccomputing.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.449728012 CEST	192.168.2.3	8.8.8.8	0x4ffb	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.614053965 CEST	192.168.2.3	8.8.8.8	0x5f2b	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.728439093 CEST	192.168.2.3	8.8.8.8	0x8efe	Standard query (0)	apikeys.civiccomputing.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.740183115 CEST	192.168.2.3	8.8.8.8	0xe387	Standard query (0)	www.google.ch	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.826893091 CEST	192.168.2.3	8.8.8.8	0xc666	Standard query (0)	mc.yandex.ru	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.394568920 CEST	192.168.2.3	8.8.8.8	0x6039	Standard query (0)	munchkin.marketo.net	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.398597956 CEST	192.168.2.3	8.8.8.8	0x7bd8	Standard query (0)	mc.webvisor.org	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.698909044 CEST	192.168.2.3	8.8.8.8	0x1d43	Standard query (0)	524-vts-832.mktoresp.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:39.793983936 CEST	192.168.2.3	8.8.8.8	0x3f86	Standard query (0)	widget.trustpilot.com	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:41.415890932 CEST	192.168.2.3	8.8.8.8	0x8a10	Standard query (0)	st2.dialogtech.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jun 18, 2021 03:55:14.777049065 CEST	8.8.8.8	192.168.2.3	0xb22b	No error (0)	securisync.intermedia.net		199.193.202.116	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.172477007 CEST	8.8.8.8	192.168.2.3	0x489b	No error (0)	cdn.heapanalytics.com	d38au5kn48shwv.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:21.172477007 CEST	8.8.8.8	192.168.2.3	0x489b	No error (0)	d38au5kn48shwv.cloudfront.net		13.224.99.69	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.172477007 CEST	8.8.8.8	192.168.2.3	0x489b	No error (0)	d38au5kn48shwv.cloudfront.net		13.224.99.37	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.172477007 CEST	8.8.8.8	192.168.2.3	0x489b	No error (0)	d38au5kn48shwv.cloudfront.net		13.224.99.86	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.172477007 CEST	8.8.8.8	192.168.2.3	0x489b	No error (0)	d38au5kn48shwv.cloudfront.net		13.224.99.34	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:21.818114042 CEST	8.8.8.8	192.168.2.3	0x7e71	No error (0)	auth.myonlinedata.net		162.244.197.119	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		52.200.121.85	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		54.164.185.110	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		3.229.228.113	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		100.25.68.79	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		52.45.77.86	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		75.101.164.61	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		3.209.197.155	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:23.475003004 CEST	8.8.8.8	192.168.2.3	0x1c68	No error (0)	heapanalytics.com		54.164.131.238	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:24.392811060 CEST	8.8.8.8	192.168.2.3	0x6c4f	No error (0)	auth.us2sync.myonlinedata.net		199.193.200.116	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:25.130974054 CEST	8.8.8.8	192.168.2.3	0x2c3f	No error (0)	us2sync.myonlinedata.net		199.193.200.116	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:31.149883032 CEST	8.8.8.8	192.168.2.3	0x9f26	No error (0)	securisync.intermedia.net		199.193.202.116	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:32.973870993 CEST	8.8.8.8	192.168.2.3	0x578f	No error (0)	www.intermedia.com		162.244.197.215	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	app-sj01.marketo.com	sj01.mktoedge.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	sj01.mktoedge.com		104.16.93.80	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	sj01.mktoedge.com		104.16.92.80	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	sj01.mktoedge.com		104.16.95.80	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	sj01.mktoedge.com		104.16.96.80	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.616717100 CEST	8.8.8.8	192.168.2.3	0x2471	No error (0)	sj01.mktoedge.com		104.16.94.80	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:34.915568113 CEST	8.8.8.8	192.168.2.3	0x4273	No error (0)	abrtp1-cdn.marketo.com	wildcard.marketo.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.422420025 CEST	8.8.8.8	192.168.2.3	0xf0fc	No error (0)	rtp-static.marketo.com	wildcard.marketo.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.438430071 CEST	8.8.8.8	192.168.2.3	0x1c0e	No error (0)	abrtp1.marketo.com		192.28.144.84	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.569797993 CEST	8.8.8.8	192.168.2.3	0x3c52	No error (0)	tracking.g2crowd.com		104.18.27.190	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.569797993 CEST	8.8.8.8	192.168.2.3	0x3c52	No error (0)	tracking.g2crowd.com		104.18.26.190	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.588465929 CEST	8.8.8.8	192.168.2.3	0xd195	No error (0)	snap.licdn.com	wildcard.licdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.595166922 CEST	8.8.8.8	192.168.2.3	0xa579	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.595166922 CEST	8.8.8.8	192.168.2.3	0xa579	No error (0)	scontent.xx.fbcdn.net		157.240.17.15	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.611592054 CEST	8.8.8.8	192.168.2.3	0xedda	No error (0)	cdn.jsdelivr.net	cdn.jsdelivr.net.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.639223099 CEST	8.8.8.8	192.168.2.3	0xb91f	No error (0)	www.intermedia.net		162.244.197.215	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.678220987 CEST	8.8.8.8	192.168.2.3	0x8e4f	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.678220987 CEST	8.8.8.8	192.168.2.3	0x8e4f	No error (0)	stats.l.doubleclick.net		74.125.140.154	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.678220987 CEST	8.8.8.8	192.168.2.3	0x8e4f	No error (0)	stats.l.doubleclick.net		74.125.140.155	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.678220987 CEST	8.8.8.8	192.168.2.3	0x8e4f	No error (0)	stats.l.doubleclick.net		74.125.140.157	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.678220987 CEST	8.8.8.8	192.168.2.3	0x8e4f	No error (0)	stats.l.doubleclick.net		74.125.140.156	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.748497009 CEST	8.8.8.8	192.168.2.3	0x40e9	No error (0)	d31y97ze264gaa.cloudfront.net		13.224.89.41	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.748497009 CEST	8.8.8.8	192.168.2.3	0x40e9	No error (0)	d31y97ze264gaa.cloudfront.net		13.224.89.98	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.748497009 CEST	8.8.8.8	192.168.2.3	0x40e9	No error (0)	d31y97ze264gaa.cloudfront.net		13.224.89.7	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.748497009 CEST	8.8.8.8	192.168.2.3	0x40e9	No error (0)	d31y97ze264gaa.cloudfront.net		13.224.89.141	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.879014015 CEST	8.8.8.8	192.168.2.3	0x5775	No error (0)	js.driftt.com	dl7g9llrghqi1.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:36.879014015 CEST	8.8.8.8	192.168.2.3	0x5775	No error (0)	dl7g9llrghqi1.cloudfront.net		13.224.99.29	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.879014015 CEST	8.8.8.8	192.168.2.3	0x5775	No error (0)	dl7g9llrghqi1.cloudfront.net		13.224.99.11	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.879014015 CEST	8.8.8.8	192.168.2.3	0x5775	No error (0)	dl7g9llrghqi1.cloudfront.net		13.224.99.106	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:36.879014015 CEST	8.8.8.8	192.168.2.3	0x5775	No error (0)	dl7g9llrghqi1.cloudfront.net		13.224.99.82	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.025609970 CEST	8.8.8.8	192.168.2.3	0xea2f	No error (0)	px.ads.linkedin.com	mix.linkedin.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.025609970 CEST	8.8.8.8	192.168.2.3	0xea2f	No error (0)	mix.linkedin.com	glb-na.mix.linkedin.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.025609970 CEST	8.8.8.8	192.168.2.3	0xea2f	No error (0)	glb-na.mix.linkedin.com	pop-eda6.mix.linkedin.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.025609970 CEST	8.8.8.8	192.168.2.3	0xea2f	No error (0)	pop-eda6.mix.linkedin.com		108.174.11.69	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.391290903 CEST	8.8.8.8	192.168.2.3	0xca6b	No error (0)	st1.dialogtech.com	stnumreq.dialogtech.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.391290903 CEST	8.8.8.8	192.168.2.3	0xca6b	No error (0)	stnumreq.dialogtech.com		107.162.156.70	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.444061041 CEST	8.8.8.8	192.168.2.3	0x939e	No error (0)	cc.cdn.civiccomputing.com	d3bipqqt7o7bp0.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.444061041 CEST	8.8.8.8	192.168.2.3	0x939e	No error (0)	d3bipqqt7o7bp0.cloudfront.net		13.224.99.111	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.444061041 CEST	8.8.8.8	192.168.2.3	0x939e	No error (0)	d3bipqqt7o7bp0.cloudfront.net		13.224.99.114	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.444061041 CEST	8.8.8.8	192.168.2.3	0x939e	No error (0)	d3bipqqt7o7bp0.cloudfront.net		13.224.99.105	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.444061041 CEST	8.8.8.8	192.168.2.3	0x939e	No error (0)	d3bipqqt7o7bp0.cloudfront.net		13.224.99.106	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.499779940 CEST	8.8.8.8	192.168.2.3	0x4ffb	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.672804117 CEST	8.8.8.8	192.168.2.3	0x5f2b	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.787585974 CEST	8.8.8.8	192.168.2.3	0x8efe	No error (0)	apikeys.civiccomputing.com	apikeys-lb.civiccomputing.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:37.787585974 CEST	8.8.8.8	192.168.2.3	0x8efe	No error (0)	apikeys-lb.civiccomputing.com		80.75.66.243	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.812952995 CEST	8.8.8.8	192.168.2.3	0xe387	No error (0)	www.google.ch		142.250.186.131	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.882910013 CEST	8.8.8.8	192.168.2.3	0xc666	No error (0)	mc.yandex.ru		93.158.134.119	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.882910013 CEST	8.8.8.8	192.168.2.3	0xc666	No error (0)	mc.yandex.ru		87.250.251.119	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.882910013 CEST	8.8.8.8	192.168.2.3	0xc666	No error (0)	mc.yandex.ru		77.88.21.119	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:37.882910013 CEST	8.8.8.8	192.168.2.3	0xc666	No error (0)	mc.yandex.ru		87.250.250.119	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.456568003 CEST	8.8.8.8	192.168.2.3	0x6039	No error (0)	munchkin.marketo.net	wildcard.marketo.net.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:38.457277060 CEST	8.8.8.8	192.168.2.3	0x7bd8	No error (0)	mc.webvisor.org		154.47.36.17	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.457277060 CEST	8.8.8.8	192.168.2.3	0x7bd8	No error (0)	mc.webvisor.org		80.239.201.104	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:38.904936075 CEST	8.8.8.8	192.168.2.3	0x1d43	No error (0)	524-vts-832.mktoresp.com		192.28.147.68	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:39.864290953 CEST	8.8.8.8	192.168.2.3	0x3f86	No error (0)	widget.trustpilot.com		13.224.99.68	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:39.864290953 CEST	8.8.8.8	192.168.2.3	0x3f86	No error (0)	widget.trustpilot.com		13.224.99.35	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:39.864290953 CEST	8.8.8.8	192.168.2.3	0x3f86	No error (0)	widget.trustpilot.com		13.224.99.129	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:39.864290953 CEST	8.8.8.8	192.168.2.3	0x3f86	No error (0)	widget.trustpilot.com		13.224.99.87	A (IP address)	IN (0x0001)
Jun 18, 2021 03:55:41.474689007 CEST	8.8.8.8	192.168.2.3	0x8a10	No error (0)	st2.dialogtech.com	stproducer.dialogtech.com		CNAME (Canonical name)	IN (0x0001)
Jun 18, 2021 03:55:41.474689007 CEST	8.8.8.8	192.168.2.3	0x8a10	No error (0)	stproducer.dialogtech.com		107.162.137.162	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jun 18, 2021 03:55:15.060625076 CEST	199.193.202.116	443	192.168.2.3	49681	CN=securisync.intermedia.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Jun 07 09:14:05 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sun Sep 05 09:14:05 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:15.064181089 CEST	199.193.202.116	443	192.168.2.3	49680	CN=securisync.intermedia.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Jun 07 09:14:05 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sun Sep 05 09:14:05 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:21.268469095 CEST	13.224.99.69	443	192.168.2.3	49687	CN=cdn.heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Sep 24 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue Oct 26 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:21.268778086 CEST	13.224.99.69	443	192.168.2.3	49686	CN=cdn.heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Sep 24 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue Oct 26 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:22.254671097 CEST	162.244.197.119	443	192.168.2.3	49689	CN=auth.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 01 01:07:10 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Aug 30 01:07:10 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:22.255641937 CEST	162.244.197.119	443	192.168.2.3	49688	CN=auth.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 01 01:07:10 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Aug 30 01:07:10 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:23.911974907 CEST	52.200.121.85	443	192.168.2.3	49691	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:23.912605047 CEST	52.200.121.85	443	192.168.2.3	49692	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:23.912938118 CEST	52.200.121.85	443	192.168.2.3	49690	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:23.913583994 CEST	52.200.121.85	443	192.168.2.3	49693	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:23.915632010 CEST	52.200.121.85	443	192.168.2.3	49695	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:23.916145086 CEST	52.200.121.85	443	192.168.2.3	49694	CN=heapanalytics.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Thu Dec 24 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sun Jan 23 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:24.669610023 CEST	199.193.200.116	443	192.168.2.3	49697	CN=us2sync.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 15 01:08:59 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 13 01:08:58 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:24.670825958 CEST	199.193.200.116	443	192.168.2.3	49696	CN=us2sync.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 15 01:08:59 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 13 01:08:58 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:25.402071953 CEST	199.193.200.116	443	192.168.2.3	49698	CN=us2sync.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 15 01:08:59 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 13 01:08:58 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:25.403218031 CEST	199.193.200.116	443	192.168.2.3	49699	CN=us2sync.myonlinedata.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Tue Jun 15 01:08:59 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Mon Sep 13 01:08:58 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:31.430675983 CEST	199.193.202.116	443	192.168.2.3	49700	CN=securisync.intermedia.net CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=R3, O=Let's Encrypt, C=US CN=ISRG Root X1, O=Internet Security Research Group, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Mon Jun 07 09:14:05 CEST 2021 Fri Sep 04 02:00:00 CEST 2020 Wed Jan 20 20:14:03 CET 2021	Sun Sep 05 09:14:05 CEST 2021 Mon Sep 15 18:00:00 CEST 2025 Mon Sep 30 20:14:03 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=R3, O=Let's Encrypt, C=US	CN=ISRG Root X1, O=Internet Security Research Group, C=US	Fri Sep 04 02:00:00 CEST 2020	Mon Sep 15 18:00:00 CEST 2025
					CN=ISRG Root X1, O=Internet Security Research Group, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Jan 20 20:14:03 CET 2021	Mon Sep 30 20:14:03 CEST 2024
Jun 18, 2021 03:55:33.310467005 CEST	162.244.197.215	443	192.168.2.3	49702	CN=*.intermedia.com, O="Intermedia.Net, Inc.", L=Sunnyvale, ST=California, C=US CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 22 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Sun Jan 23 00:59:59 CET 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:33.310467005 CEST	162.244.197.215	443	192.168.2.3	49702	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:33.311729908 CEST	162.244.197.215	443	192.168.2.3	49701	CN=*.intermedia.com, O="Intermedia.Net, Inc.", L=Sunnyvale, ST=California, C=US CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 22 01:00:00 CET 2020 Mon Nov 06 13:23:45 CET 2017	Sun Jan 23 00:59:59 CET 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:33.311729908 CEST	162.244.197.215	443	192.168.2.3	49701	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:34.776410103 CEST	104.16.93.80	443	192.168.2.3	49704	CN=app-sj01.marketo.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jun 08 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jun 08 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:34.776410103 CEST	104.16.93.80	443	192.168.2.3	49704	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:34.867510080 CEST	104.16.93.80	443	192.168.2.3	49703	CN=app-sj01.marketo.com, O="Cloudflare, Inc.", L=San Francisco, ST=California, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Tue Jun 08 02:00:00 CEST 2021 Mon Jan 27 13:48:08 CET 2020	Wed Jun 08 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:34.867510080 CEST	104.16.93.80	443	192.168.2.3	49703	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.658472061 CEST	104.18.27.190	443	192.168.2.3	49719	CN=*.g2crowd.com CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Aug 30 02:00:00 CEST 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Wed Sep 29 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Jun 18, 2021 03:55:36.661117077 CEST	104.18.27.190	443	192.168.2.3	49718	CN=*.g2crowd.com CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Sun Aug 30 02:00:00 CEST 2020 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019	Wed Sep 29 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Sectigo ECC Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust ECC Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
Jun 18, 2021 03:55:36.681539059 CEST	157.240.17.15	443	192.168.2.3	49722	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 26 02:00:00 CEST 2021 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 25 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.681539059 CEST	157.240.17.15	443	192.168.2.3	49722	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.685983896 CEST	157.240.17.15	443	192.168.2.3	49723	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed May 26 02:00:00 CEST 2021 Tue Oct 22 14:00:00 CEST 2013	Wed Aug 25 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.685983896 CEST	157.240.17.15	443	192.168.2.3	49723	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.717977047 CEST	192.28.144.84	443	192.168.2.3	49717	CN=*.marketo.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Dec 09 01:00:00 CET 2019 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Mon Dec 13 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 18, 2021 03:55:36.728183031 CEST	192.28.144.84	443	192.168.2.3	49716	CN=*.marketo.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Dec 09 01:00:00 CET 2019 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Mon Dec 13 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 18, 2021 03:55:36.816128969 CEST	74.125.140.154	443	192.168.2.3	49729	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 24 03:34:09 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 16 03:34:08 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.816128969 CEST	74.125.140.154	443	192.168.2.3	49729	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.816245079 CEST	74.125.140.154	443	192.168.2.3	49728	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Mon May 24 03:34:09 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Mon Aug 16 03:34:08 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.816245079 CEST	74.125.140.154	443	192.168.2.3	49728	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.859931946 CEST	13.224.89.41	443	192.168.2.3	49730	CN=*.cloudfront.net CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Mar 19 01:00:00 CET 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Fri Mar 18 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:36.861207008 CEST	13.224.89.41	443	192.168.2.3	49731	CN=*.cloudfront.net CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Mar 19 01:00:00 CET 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Fri Mar 18 00:59:59 CET 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:36.984647989 CEST	162.244.197.215	443	192.168.2.3	49727	CN=www.intermedia.net, OU=Internet Services, O="Intermedia.Net, Inc.", L=Mountain View, ST=California, C=US CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri May 22 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Thu Jul 21 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.984647989 CEST	162.244.197.215	443	192.168.2.3	49727	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.986481905 CEST	162.244.197.215	443	192.168.2.3	49726	CN=www.intermedia.net, OU=Internet Services, O="Intermedia.Net, Inc.", L=Mountain View, ST=California, C=US CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri May 22 02:00:00 CEST 2020 Mon Nov 06 13:23:45 CET 2017	Thu Jul 21 14:00:00 CEST 2022 Sat Nov 06 13:23:45 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:36.986481905 CEST	162.244.197.215	443	192.168.2.3	49726	CN=GeoTrust RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:45 CET 2017	Sat Nov 06 13:23:45 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.048418045 CEST	13.224.99.29	443	192.168.2.3	49733	CN=drift.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Mon Sep 21 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 23 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:37.049096107 CEST	13.224.99.29	443	192.168.2.3	49732	CN=drift.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Mon Sep 21 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 23 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:37.350429058 CEST	108.174.11.69	443	192.168.2.3	49735	CN=px.ads.linkedin.com, O=LinkedIn Corporation, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Apr 15 02:00:00 CEST 2021 Wed Sep 23 02:00:00 CEST 2020	Sat Oct 16 01:59:59 CEST 2021 Mon Sep 23 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.350429058 CEST	108.174.11.69	443	192.168.2.3	49735	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.363770008 CEST	108.174.11.69	443	192.168.2.3	49734	CN=px.ads.linkedin.com, O=LinkedIn Corporation, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Apr 15 02:00:00 CEST 2021 Wed Sep 23 02:00:00 CEST 2020	Sat Oct 16 01:59:59 CEST 2021 Mon Sep 23 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.363770008 CEST	108.174.11.69	443	192.168.2.3	49734	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.534344912 CEST	13.224.99.111	443	192.168.2.3	49741	CN=*.cdn.civiccomputing.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Nov 21 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue Dec 21 00:59:59 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:37.538531065 CEST	13.224.99.111	443	192.168.2.3	49740	CN=*.cdn.civiccomputing.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Nov 21 01:00:00 CET 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue Dec 21 00:59:59 CET 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:37.544786930 CEST	107.162.156.70	443	192.168.2.3	49739	CN=*.dialogtech.com, OU=Operations, O="DialogTech, Inc.", L=Chicago, ST=Illinois, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Feb 06 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Wed May 11 02:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.544786930 CEST	107.162.156.70	443	192.168.2.3	49739	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.545629025 CEST	107.162.156.70	443	192.168.2.3	49738	CN=*.dialogtech.com, OU=Operations, O="DialogTech, Inc.", L=Chicago, ST=Illinois, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Feb 06 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Wed May 11 02:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.545629025 CEST	107.162.156.70	443	192.168.2.3	49738	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.923552036 CEST	80.75.66.243	443	192.168.2.3	49746	CN=apikeys.civiccomputing.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Apr 29 12:49:05 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Wed Jul 28 12:49:05 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.923552036 CEST	80.75.66.243	443	192.168.2.3	49746	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.923692942 CEST	80.75.66.243	443	192.168.2.3	49747	CN=apikeys.civiccomputing.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Thu Apr 29 12:49:05 CEST 2021 Wed Oct 07 21:21:40 CEST 2020	Wed Jul 28 12:49:05 CEST 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:37.923692942 CEST	80.75.66.243	443	192.168.2.3	49747	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:38.004976034 CEST	142.250.186.131	443	192.168.2.3	49751	CN=*.google.ch CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon May 17 06:37:25 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Aug 09 06:37:24 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 18, 2021 03:55:38.007740974 CEST	142.250.186.131	443	192.168.2.3	49750	CN=*.google.ch CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GTS CA 1C3, O=Google Trust Services LLC, C=US CN=GTS Root R1, O=Google Trust Services LLC, C=US CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Mon May 17 06:37:25 CEST 2021 Thu Aug 13 02:00:42 CEST 2020 Fri Jun 19 02:00:42 CEST 2020	Mon Aug 09 06:37:24 CEST 2021 Thu Sep 30 02:00:42 CEST 2027 Fri Jan 28 01:00:42 CET 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GTS CA 1C3, O=Google Trust Services LLC, C=US	CN=GTS Root R1, O=Google Trust Services LLC, C=US	Thu Aug 13 02:00:42 CEST 2020	Thu Sep 30 02:00:42 CEST 2027
					CN=GTS Root R1, O=Google Trust Services LLC, C=US	CN=GlobalSign Root CA, OU=Root CA, O=GlobalSign nv-sa, C=BE	Fri Jun 19 02:00:42 CEST 2020	Fri Jan 28 01:00:42 CET 2028
Jun 18, 2021 03:55:38.099687099 CEST	93.158.134.119	443	192.168.2.3	49752	CN=mc.yandex.ru, O=Yandex LLC, OU=ITO, L=Moscow, C=RU CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Sat Feb 27 22:04:27 CET 2021 Wed Jan 21 13:00:00 CET 2015 Wed Oct 22 14:07:37 CEST 2008	Mon Aug 09 23:04:27 CEST 2021 Sat Jan 18 13:00:00 CET 2025 Thu Jun 10 12:46:39 CEST 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU	CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	Wed Jan 21 13:00:00 CET 2015	Sat Jan 18 13:00:00 CET 2025
					CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Wed Oct 22 14:07:37 CEST 2008	Thu Jun 10 12:46:39 CEST 2027
Jun 18, 2021 03:55:38.101265907 CEST	93.158.134.119	443	192.168.2.3	49753	CN=mc.yandex.ru, O=Yandex LLC, OU=ITO, L=Moscow, C=RU CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Sat Feb 27 22:04:27 CET 2021 Wed Jan 21 13:00:00 CET 2015 Wed Oct 22 14:07:37 CEST 2008	Mon Aug 09 23:04:27 CEST 2021 Sat Jan 18 13:00:00 CET 2025 Thu Jun 10 12:46:39 CEST 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU	CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	Wed Jan 21 13:00:00 CET 2015	Sat Jan 18 13:00:00 CET 2025
					CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Wed Oct 22 14:07:37 CEST 2008	Thu Jun 10 12:46:39 CEST 2027
Jun 18, 2021 03:55:38.621454000 CEST	154.47.36.17	443	192.168.2.3	49756	CN=mc.webvisor.com, O=Yandex LLC, OU=ITO, L=Moscow, C=RU CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Thu Mar 11 18:04:05 CET 2021 Wed Jan 21 13:00:00 CET 2015 Wed Oct 22 14:07:37 CEST 2008	Thu Sep 02 19:04:05 CEST 2021 Sat Jan 18 13:00:00 CET 2025 Thu Jun 10 12:46:39 CEST 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU	CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	Wed Jan 21 13:00:00 CET 2015	Sat Jan 18 13:00:00 CET 2025
					CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Wed Oct 22 14:07:37 CEST 2008	Thu Jun 10 12:46:39 CEST 2027
Jun 18, 2021 03:55:38.660644054 CEST	154.47.36.17	443	192.168.2.3	49757	CN=mc.webvisor.com, O=Yandex LLC, OU=ITO, L=Moscow, C=RU CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Thu Mar 11 18:04:05 CET 2021 Wed Jan 21 13:00:00 CET 2015 Wed Oct 22 14:07:37 CEST 2008	Thu Sep 02 19:04:05 CEST 2021 Sat Jan 18 13:00:00 CET 2025 Thu Jun 10 12:46:39 CEST 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Yandex CA, OU=Yandex Certification Authority, O=Yandex LLC, C=RU	CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	Wed Jan 21 13:00:00 CET 2015	Sat Jan 18 13:00:00 CET 2025
					CN=Certum Trusted Network CA, OU=Certum Certification Authority, O=Unizeto Technologies S.A., C=PL	CN=Certum CA, O=Unizeto Sp. z o.o., C=PL	Wed Oct 22 14:07:37 CEST 2008	Thu Jun 10 12:46:39 CEST 2027
Jun 18, 2021 03:55:39.293730974 CEST	192.28.147.68	443	192.168.2.3	49759	CN=*.mktoresp.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jan 17 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jan 21 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 18, 2021 03:55:39.294816017 CEST	192.28.147.68	443	192.168.2.3	49760	CN=*.mktoresp.com, OU=IT, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Jan 17 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jan 21 13:00:00 CET 2022 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
Jun 18, 2021 03:55:39.954566002 CEST	13.224.99.68	443	192.168.2.3	49762	CN=*.trustpilot.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Apr 03 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue May 03 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:39.954834938 CEST	13.224.99.68	443	192.168.2.3	49761	CN=*.trustpilot.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Apr 03 02:00:00 CEST 2021 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Tue May 03 01:59:59 CEST 2022 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jun 18, 2021 03:55:41.623861074 CEST	107.162.137.162	443	192.168.2.3	49767	CN=*.dialogtech.com, OU=Operations, O="DialogTech, Inc.", L=Chicago, ST=Illinois, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Feb 06 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Wed May 11 02:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:41.623861074 CEST	107.162.137.162	443	192.168.2.3	49767	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:41.628313065 CEST	107.162.137.162	443	192.168.2.3	49768	CN=*.dialogtech.com, OU=Operations, O="DialogTech, Inc.", L=Chicago, ST=Illinois, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Feb 06 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Wed May 11 02:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jun 18, 2021 03:55:41.628313065 CEST	107.162.137.162	443	192.168.2.3	49768	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5888 Parent PID: 792

General

Start time:	03:56:01
Start date:	18/06/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7b7980000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 5936 Parent PID: 5888

General

Start time:	03:56:02
Start date:	18/06/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5888 CREDAT:17410 /prefetch:2
Imagebase:	0x1260000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Windows Analysis Report https://securisync.intermedia.net/us2/s/IpnIUjFRDCv9PeEVchmZ5r003e9fc4

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5888 Parent PID: 792

General

Analysis Process: iexplore.exe PID: 5936 Parent PID: 5888

General

Disassembly