Play interactive tour

Edit tour

Analysis Report http://sdfsdfsd.rf.gd/a.html

Overview

General Information

Sample URL:	http://sdfsdfsd.rf.gd/a.html
Analysis ID:	393127
Infos:
Most interesting Screenshot:

Detection

HTMLPhisher

Score:	76
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Phishing site detected (based on favicon image match)

Yara detected HtmlPhish10

Phishing site detected (based on logo template match)

Form action URLs do not match main URL

Found iframes

HTML body contains low number of good links

HTML title does not match URL

None HTTPS page querying sensitive user data (password, username or email)

Potential browser exploit detected (process start blacklist hit)

Submit button contains javascript call

Suspicious form URL found

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Startup

System is w10x64

iexplore.exe (PID: 5084 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4004 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5084 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

TokenBrokerCookies.exe (PID: 724 cmdline: C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1 MD5: 17F27A76AC8E9869C8F1BE286D88570A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

Dropped Files

Source	Rule	Description	Author	Strings
C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a[1].htm	JoeSecurity_HtmlPhish_10	Yara detected HtmlPhish_10	Joe Security

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: http://sdfsdfsd.rf.gd/a.html

SlashNext: detection malicious, Label: Fake Login Page type: Phishing & Social usering

Antivirus detection for URL or domain

Show sources

Source: http://sdfsdfsd.rf.gd/a.html?i=1	SlashNext: Label: Fake Login Page type: Phishing & Social usering
Source: http://sdfsdfsd.rf.gd/a.html?i=1	UrlScan: Label: phishing brand: microsoft			Perma Link

Phishing:

Phishing site detected (based on favicon image match)

Show sources

Source: http://sdfsdfsd.rf.gd/a.html?i=1

Matcher: Template: microsoft matched with high similarity

Yara detected HtmlPhish10

Show sources

Source: Yara match	File source: 701188.pages.csv, type: HTML
Source: Yara match	File source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a[1].htm, type: DROPPED

Phishing site detected (based on logo template match)

Show sources

Source: http://sdfsdfsd.rf.gd/a.html?i=1

Matcher: Template: microsoft matched

Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Form action: https://jst.aquilamis.com/bower_components/eonasdan-bootstrap-datetimepicker/src/js/locales/login.php rf aquilamis
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Form action: https://jst.aquilamis.com/bower_components/eonasdan-bootstrap-datetimepicker/src/js/locales/login.php rf aquilamis

Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Iframe src: https://www.office.com/prefetch/prefetch
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Iframe src: ./Sign in to your account_files/prefetch(1).html

Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Number of links: 0
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Number of links: 0
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: Title: Sign in to your account does not match URL
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Title: Sign in to your account does not match URL
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Title: Sign in to your account does not match URL

Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Has password / email / username input fields
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Has password / email / username input fields

Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: On click: goNext()
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: On click: goNext()

Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Form action: https://jst.aquilamis.com/bower_components/eonasdan-bootstrap-datetimepicker/src/js/locales/login.php
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: Form action: https://jst.aquilamis.com/bower_components/eonasdan-bootstrap-datetimepicker/src/js/locales/login.php

Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="author".. found
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: No <meta name="author".. found
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381#	HTTP Parser: No <meta name="copyright".. found
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: No <meta name="copyright".. found
Source: http://sdfsdfsd.rf.gd/a.html?i=1	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 172.67.71.120:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.71.120:443 -> 192.168.2.6:49700 version: TLS 1.2

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\System32\TokenBrokerCookies.exe

Source: global traffic	HTTP traffic detected: GET /a.html HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sdfsdfsd.rf.gdConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /aes.js HTTP/1.1Accept: application/javascript, /;q=0.8Referer: http://sdfsdfsd.rf.gd/a.htmlAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sdfsdfsd.rf.gdConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /a.html?i=1 HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: http://sdfsdfsd.rf.gd/a.htmlAccept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sdfsdfsd.rf.gdConnection: Keep-AliveCookie: __test=0c169eb4baa09ef03237782f3958f19a
Source: global traffic	HTTP traffic detected: GET /Sign%20in%20to%20your%20account_files/ellipsis_grey.svg HTTP/1.1Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5Referer: http://sdfsdfsd.rf.gd/a.html?i=1Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sdfsdfsd.rf.gdConnection: Keep-AliveCookie: __test=0c169eb4baa09ef03237782f3958f19a
Source: global traffic	HTTP traffic detected: GET /Sign%20in%20to%20your%20account_files/prefetch(1).html HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, /Referer: http://sdfsdfsd.rf.gd/a.html?i=1Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: sdfsdfsd.rf.gdConnection: Keep-AliveCookie: __test=0c169eb4baa09ef03237782f3958f19a

Source: unknown

DNS traffic detected: queries for: sdfsdfsd.rf.gd

Source: aes[1].js.2.dr	String found in binary or memory: http://code.google.com/p/slowaes/
Source: boot.worldwide.0.mouse[1].js.2.dr	String found in binary or memory: http://github.com/jquery/globalize
Source: ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: aes[1].js.2.dr	String found in binary or memory: http://mpercival.com
Source: {C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/
Source: ~DFDB00A957EC34D917.TMP.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.html
Source: ~DFDB00A957EC34D917.TMP.1.dr, a[1].htm.2.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.html?i=1
Source: ~DFDB00A957EC34D917.TMP.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.html?i=1.Sign
Source: ~DFDB00A957EC34D917.TMP.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.html?i=1b
Source: {C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.htmlRoot
Source: {C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: http://sdfsdfsd.rf.gd/a.htmla.html?i=1Root
Source: aes[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/
Source: aes[1].js.2.dr	String found in binary or memory: http://www.josh-davis.org
Source: ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: aes[1].js.2.dr	String found in binary or memory: http://www.progressive-coding.com
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__3zcano9dkna
Source: imagestore.dat.2.dr, reprocess[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2.js
Source: 404[1].htm.2.dr	String found in binary or memory: https://app.infinityfree.net/login
Source: 404[1].htm.2.dr	String found in binary or memory: https://app.infinityfree.net/register
Source: a[1].htm0.2.dr	String found in binary or memory: https://code.jquery.com/jquery-3.3.1.min.js
Source: 404[1].htm.2.dr	String found in binary or memory: https://forum.infinityfree.net
Source: 404[1].htm.2.dr	String found in binary or memory: https://forum.infinityfree.net/
Source: ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: 404[1].htm.2.dr	String found in binary or memory: https://ifastnet.com/portal/aff.php?aff=23782
Source: 404[1].htm.2.dr	String found in binary or memory: https://infinityfree.net/errors/404/
Source: 404[1].htm.2.dr	String found in binary or memory: https://infinityfree.net/images/logo.png
Source: a[1].htm0.2.dr	String found in binary or memory: https://jst.aquilamis.com/bower_components/eonasdan-bootstrap-datetimepicker/src/js/locales/login.ph
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://login.live.com/Me.htm?v=3
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code
Source: a[1].htm0.2.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf8
Source: {C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://login.microsof
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: TokenBrokerCookies.exe, 00000005.00000002.395549981.000001E4F16B0000.00000004.00000020.sdmp	String found in binary or memory: https://login.microsoftonline.com/
Source: TokenBrokerCookies.exe, 00000005.00000002.395560466.000001E4F16B9000.00000004.00000020.sdmp	String found in binary or memory: https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft
Source: a[1].htm0.2.dr	String found in binary or memory: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2
Source: reprocess[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com/jsdisabled
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/bundles/app-bundle-26924b509a4ae71a71c2.js
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/bundles/app-bundle-5956190057a09e174c9a.css
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/bundles/polyfills-bundle-f9c3341f2bd879f34b38.js
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/bundles/sharedscripts-46c2082441.js
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/bundles/staticscripts-e10017f14c.js
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://officehome.cdn.office.net/images/content/images/fluent-background-sources/header-default-des
Source: prefetch[1].htm.2.dr	String found in binary or memory: https://outlook.office365.com/owa/prefetch.aspx
Source: 404[1].htm.2.dr	String found in binary or memory: https://quantcast.mgr.consensu.org
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/images/0/sprite1.mouse.css
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/images/0/sprite1.mouse.png
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/0/boot.worldwide.mouse.css
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.eot?#iefix
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.svg
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.ttf
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.woff
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.0.mouse.js
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.1.mouse.js
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.2.mouse.js
Source: prefetch[1].htm0.2.dr	String found in binary or memory: https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.3.mouse.js
Source: 404[1].htm.2.dr	String found in binary or memory: https://schema.org
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0-small.jpg?
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0.jpg?x=a5db
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.png?x=5bc2
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.svg?x=2b5d
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.png?x=0ad
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.svg?x=5ac
Source: imagestore.dat.2.dr, a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/favicon_a_eupayfgghqiai7
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.png?x=ed9
Source: a[1].htm0.2.dr	String found in binary or memory: https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5
Source: 404[1].htm.2.dr	String found in binary or memory: https://support.infinityfree.net/
Source: 404[1].htm.2.dr	String found in binary or memory: https://support.infinityfree.net/websites/redirecting-to-404-error/
Source: 404[1].htm.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49700
Source: unknown	Network traffic detected: HTTP traffic on port 49699 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49699
Source: unknown	Network traffic detected: HTTP traffic on port 49700 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49718
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49718 -> 443

Source: unknown	HTTPS traffic detected: 172.67.71.120:443 -> 192.168.2.6:49699 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.67.71.120:443 -> 192.168.2.6:49700 version: TLS 1.2

Source: classification engine

Classification label: mal76.phis.win@5/41@10/3

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C79D150E-A1EF-11EB-90E5-ECF4BB2D2496}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF98D5E46384074168.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\TokenBrokerCookies.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5084 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5084 CREDAT:17410 /prefetch:2	Jump to behavior
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1	Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Jump to behavior

Source: TokenBrokerCookies.exe, 00000005.00000002.395560466.000001E4F16B9000.00000004.00000020.sdmp

Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll}}0FP

Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1			Jump to behavior

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Command and Scripting Interpreter1	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	Security Software Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scripting1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Ingress Tool Transfer1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	Exploitation for Client Execution1	Logon Script (Windows)	Logon Script (Windows)	Scripting1	Security Account Manager	System Information Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Non-Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Obfuscated Files or Information1	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Application Layer Protocol3	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
http://sdfsdfsd.rf.gd/a.html	0%	Virustotal		Browse
http://sdfsdfsd.rf.gd/a.html	0%	Avira URL Cloud	safe
http://sdfsdfsd.rf.gd/a.html	100%	SlashNext	Fake Login Page type: Phishing & Social usering

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Label	Link
secure.aadcdn.microsoftonline-p.com	0%	Virustotal		Browse
aadcdn.msauth.net	1%	Virustotal		Browse

URLs

Source	Detection	Scanner	Label	Link
http://sdfsdfsd.rf.gd/a.html?i=1	100%	SlashNext	Fake Login Page type: Phishing & Social usering
http://sdfsdfsd.rf.gd/a.html?i=1	100%	UrlScan	phishing brand: microsoft	Browse
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0.jpg?x=a5db	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0-small.jpg?	0%	Avira URL Cloud	safe
http://www.progressive-coding.com	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.png?x=0ad	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2.js	0%	Avira URL Cloud	safe
https://quantcast.mgr.consensu.org	0%	URL Reputation	safe
https://quantcast.mgr.consensu.org	0%	URL Reputation	safe
https://quantcast.mgr.consensu.org	0%	URL Reputation	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.svg?x=5ac	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/favicon_a_eupayfgghqiai7	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.svg?x=2b5d	0%	Avira URL Cloud	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.png?x=ed9	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	0%	URL Reputation	safe
https://login.microsof	0%	URL Reputation	safe
https://login.microsof	0%	URL Reputation	safe
https://login.microsof	0%	URL Reputation	safe
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	0%	Avira URL Cloud	safe
http://mpercival.com	0%	Avira URL Cloud	safe
http://www.josh-davis.org	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__3zcano9dkna	0%	Avira URL Cloud	safe
https://aadcdn.msauth.net	0%	URL Reputation	safe
https://aadcdn.msauth.net	0%	URL Reputation	safe
https://aadcdn.msauth.net	0%	URL Reputation	safe
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.png?x=5bc2	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
infinityfree.net	172.67.71.120	true	false		high
sdfsdfsd.rf.gd	185.27.134.202	true	false		high
HHN-efz.ms-acdc.office.com	52.97.150.2	true	false		high
www.office.com	unknown	unknown	false		high
secure.aadcdn.microsoftonline-p.com	unknown	unknown	false	0%, Virustotal, Browse	unknown
code.jquery.com	unknown	unknown	false		high
r4.res.office365.com	unknown	unknown	false		high
login.microsoftonline.com	unknown	unknown	false		high
aadcdn.msauth.net	unknown	unknown	false	1%, Virustotal, Browse	unknown
outlook.office365.com	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
http://sdfsdfsd.rf.gd/aes.js	false		high
http://sdfsdfsd.rf.gd/a.html?i=1	false	100%, UrlScan, Browse SlashNext: Fake Login Page type: Phishing & Social usering	high
http://sdfsdfsd.rf.gd/Sign%20in%20to%20your%20account_files/prefetch(1).html	false		high
http://sdfsdfsd.rf.gd/a.html?i=1	false	100%, UrlScan, Browse SlashNext: Fake Login Page type: Phishing & Social usering	high
http://sdfsdfsd.rf.gd/a.html	false		high
http://sdfsdfsd.rf.gd/Sign%20in%20to%20your%20account_files/ellipsis_grey.svg	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://app.infinityfree.net/login	404[1].htm.2.dr	false		high
https://login.microsoftonline.com/	TokenBrokerCookies.exe, 00000005.00000002.395549981.000001E4F16B0000.00000004.00000020.sdmp	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.svg	prefetch[1].htm0.2.dr	false		high
https://outlook.office365.com/owa/prefetch.aspx	prefetch[1].htm.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.2.mouse.js	prefetch[1].htm0.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0.jpg?x=a5db	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://infinityfree.net/images/logo.png	404[1].htm.2.dr	false		high
https://login.windows-ppe.net	Me[1].htm.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.ttf	prefetch[1].htm0.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/images/0/sprite1.mouse.png	prefetch[1].htm0.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://sdfsdfsd.rf.gd/a.html?i=1b	~DFDB00A957EC34D917.TMP.1.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/0/boot.worldwide.mouse.css	prefetch[1].htm0.2.dr	false		high
https://forum.infinityfree.net	404[1].htm.2.dr	false		high
https://forum.infinityfree.net/	404[1].htm.2.dr	false		high
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~	imagestore.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://app.infinityfree.net/register	404[1].htm.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.woff	prefetch[1].htm0.2.dr	false		high
https://infinityfree.net/errors/404/	404[1].htm.2.dr	false		high
https://login.microsoftonline.com	Me[1].htm.2.dr	false		high
https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2	a[1].htm0.2.dr	false		high
http://sdfsdfsd.rf.gd/a.htmlRoot	{C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false		high
https://login.microsoftonline.com/jsdisabled	reprocess[1].htm.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0-small.jpg?	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://ifastnet.com/portal/aff.php?aff=23782	404[1].htm.2.dr	false		high
http://www.progressive-coding.com	aes[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://code.jquery.com/jquery-3.3.1.min.js	a[1].htm0.2.dr	false		high
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2	reprocess[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://github.com/jquery/globalize	boot.worldwide.0.mouse[1].js.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.png?x=0ad	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2.js	reprocess[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/	aes[1].js.2.dr	false		high
https://support.infinityfree.net/	404[1].htm.2.dr	false		high
https://quantcast.mgr.consensu.org	404[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://knockoutjs.com/	ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	false		high
https://github.com/douglascrockford/JSON-js	ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	false		high
https://schema.org	404[1].htm.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.0.mouse.js	prefetch[1].htm0.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.3.mouse.js	prefetch[1].htm0.2.dr	false		high
http://sdfsdfsd.rf.gd/a.htmla.html?i=1Root	{C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.svg?x=5ac	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.eot?#iefix	prefetch[1].htm0.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/favicon_a_eupayfgghqiai7	imagestore.dat.2.dr, a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://www.opensource.org/licenses/mit-license.php)	ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js.2.dr	false		high
https://r4.res.office365.com/owa/prem/15.20.4020.16/scripts/boot.worldwide.1.mouse.js	prefetch[1].htm0.2.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.svg?x=2b5d	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://sdfsdfsd.rf.gd/	{C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.png?x=ed9	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown
http://sdfsdfsd.rf.gd/a.html?i=1.Sign	~DFDB00A957EC34D917.TMP.1.dr	false		high
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico	imagestore.dat.2.dr, reprocess[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.microsof	{C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(	imagestore.dat.2.dr	false	Avira URL Cloud: safe	unknown
https://support.infinityfree.net/websites/redirecting-to-404-error/	404[1].htm.2.dr	false		high
http://mpercival.com	aes[1].js.2.dr	false	Avira URL Cloud: safe	unknown
http://www.josh-davis.org	aes[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/images/0/sprite1.mouse.css	prefetch[1].htm0.2.dr	false		high
https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__3zcano9dkna	reprocess[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://aadcdn.msauth.net	reprocess[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft	TokenBrokerCookies.exe, 00000005.00000002.395560466.000001E4F16B9000.00000004.00000020.sdmp	false		high
https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_grey.png?x=5bc2	a[1].htm0.2.dr	false	Avira URL Cloud: safe	unknown

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.97.150.2	HHN-efz.ms-acdc.office.com	United States	8075	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
185.27.134.202	sdfsdfsd.rf.gd	United Kingdom	34119	WILDCARD-ASWildcardUKLimitedGB	false
172.67.71.120	infinityfree.net	United States	13335	CLOUDFLARENETUS	false

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	393127
Start date:	20.04.2021
Start time:	08:47:04
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 47s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	browseurl.jbs
Sample URL:	http://sdfsdfsd.rf.gd/a.html
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	6
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal76.phis.win@5/41@10/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://login.microsoftonline.com/common/reprocess?ctx=rQIIAXWRO2_TUACFc_MwLSCoWGDswARy4nfiiA4hcZ2E2A6O3dZeItfx48bP2DeE5BewIHVg6oiEkCompgqE2DtVgglWBlQJCXVAjKQ_gOVMR5-OzvegRFbJ5n2GZlirfsjjvMXROMOTBG4xFIfTLM3RFEFOWILO7lzfQu--Tj7_edR9-ePG4OLyy6cTcNdHKM2btdpisagmrgttp2onUe0UgHMAfgJwXKw4Ma6PToo5R3N1muGoxppG8STL81VJU31F1BlppSNpakIZEoRMSauB5jHS9CmSRJ2StUlk7JuhFOmMMTVYRbMXSkdHZsePlDZBmOIuHOzvhvKaoYh7vjQNlsZKWMmRTn4r3lZac-RTV5FkcOVcFjfdJIvGaZKj49JboKRO3Ju0kzh2bFS9qjkxgraFYBIPsyR1MgSdfKc1U-XelOxanDmSGS8Yj4LnASFEROIqoc8m6p5gisFyZgxmPWt2yPYzlTOIpZaKMJuyFg_DgfvE16h2iFBg0l6wtDNZ2A_GJs6SndZAsqgof0an-MFjXqWEnt1osKY59zx3tpwPrfB9CVvfGiXxWenWelQMJ9tplrgwdM7L4KJ8kyg1NzawLXCvsF34WwavK2tbvwz3o2RG4hv--6j06rRwVqk9hKHHBhRNacOJwB9IklKPPFX1uSHZ7_aZrsApi5xvEMOY2WGa5BEGjjDsNwZeXCt82Pyf6381# Browsing link: https://login.live.com/oauth20_authorize.srf?response_type=code&client_id=51483342-085c-4d86-bf88-cf50c7252078&scope=openid+profile+email+offline_access&response_mode=form_post&redirect_uri=https%3a%2f%2flogin.microsoftonline.com%2fcommon%2ffederation%2foauth2&state=rQIIAXWSvW_TUBTF4yQNbUFQISQYOzCBnDw_fySO6FBa10mJ7eDYbe0lch1_vPgzzmtD8hewIHVgyoiEkCompgqE2DtVgqmsDKgSEuqAGHHZu9zlnvPT1Tn3UYmqUs2HDM2wVn2fJ3mLo0mGpwBpMZAjaZbmaAioAQvo7O7yCn7_bfDlz5PWqx83OxeXXz_PiaV-iA6dqp1Ex8R9H-N03KzVJpNJNXFdZP9f1E4I4owgfhLEvLjgxKTeOy6OOZqr0wwHGzkZ8hTL81VJU31F1BlppmNpaCIZASBDadbRPEYaPseSqENZG0TGrhlKkc4YQ4NVNHuibOrY3PQjZQMAU9xCnd2tUM4ZirjjS8NgasyEmRzp1HnxjrJ-gH14NZIMzZzL4pKbZFE_TcZ4XnpHKKkTtwcbSRw7Nq5eyZwYI9vCKIm7WZI6GUbOeG19pMrtIdWyOLMnM17Q7wUvAiBEIHGV0GcTdUcwxWA6MjqjtjXaZ7czlTPAVEtFlA1Zi0dhx33ma3AjxDgwaS-Y2pks7AZ9k2SpzfWOZMFofEin5N5TXoVC2240WNM88Dx3ND3oWuGHUiWPNUri09Lt_KgYDVbTLHFR6JyViYvyLVBqLi5WVogHhdXC3zLxZiFv7pfhfpLMSHzLf--VXp8UThdqj1HosQGkodYdCPyeJCn1yFNVn-tS261tpiVwymTMN0A3ZtaYJnVUIY4qld-V4ssbhY9L13V9vnwv_5cGCXgSsquAb1K5tW7-Aw2&estsfed=1&uaid=64d4ac74f6bf483c8de40b4ceaf2d3bd&signup=1&lw=1&fl=easi2&fci=4345a7b9-9a63-4910-a426-35363201d503&mkt=en-US Browsing link: https://www.microsoft.com/en-US/servicesagreement/ Browsing link: https://privacy.microsoft.com/en-US/privacystatement
Warnings:	Show All Exclude process from analysis (whitelisted): ielowutil.exe, RuntimeBroker.exe, backgroundTaskHost.exe Excluded IPs from analysis (whitelisted): 168.61.161.212, 40.88.32.150, 52.147.198.201, 13.107.4.50, 88.221.62.148, 104.43.139.144, 92.123.151.195, 69.16.175.10, 69.16.175.42, 104.42.151.234, 20.190.160.6, 20.190.160.73, 20.190.160.129, 20.190.160.69, 20.190.160.8, 20.190.160.132, 20.190.160.4, 20.190.160.71, 13.107.246.19, 13.107.213.19, 13.107.9.156, 20.190.160.136, 20.190.160.67, 20.190.160.134, 20.190.160.75, 20.190.160.2, 184.30.20.59, 152.199.19.161 Excluded domains from analysis (whitelisted): cds.s5x3j6q5.hwcdn.net, standard.t-0009.t-msedge.net, 2-01-3cf7-0009.cdx.cedexis.net, www.tm.lg.prod.aadmsa.akadns.net, home-office365-com.b-0004.b-msedge.net, b1ns.c-0001.c-msedge.net, wu-fg-shim.trafficmanager.net, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, dual.t-0009.t-msedge.net, login.live.com, e13761.dscg.akamaiedge.net, watson.telemetry.microsoft.com, b1ns.au-msedge.net, aadcdnoriginwus2.azureedge.net, e1875.dscg.akamaiedge.net, ie9comview.vo.msecnd.net, secure.aadcdn.microsoftonline-p.com.edgekey.net, b-0004.dc-msedge.net, skypedataprdcolcus17.cloudapp.net, c-0001.c-msedge.net, download.windowsupdate.com, skypedataprdcolcus16.cloudapp.net, www.tm.a.prd.aadg.akadns.net, firstparty-azurefd-prod.trafficmanager.net, login.msa.msidentity.com, skypedataprdcoleus16.cloudapp.net, t-0009.t-msedge.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, Edge-Prod-FRAr3.ctrl.t-0009.t-msedge.net, aadcdnoriginwus2.afd.azureedge.net, skypedataprdcolwus16.cloudapp.net, r4.res.office365.com.edgekey.net, cs9.wpc.v0cdn.net Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C79D150E-A1EF-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8557920584879424
Encrypted:	false
SSDEEP:	96:rVZL7ZK2wWTtUAfKf71MGDTwJRVs+fV0xfGlX:rVZL7ZK2wWTtXfKxMAOVtfV0xMX
MD5:	9E495D0369D5B8E269490CDE630A54C9
SHA1:	6E5FE68D09A83EEB56F259810936E9893DDB7910
SHA-256:	27FD9213242AE9CBCF97796C4454927418A134F68F883954FA7DE2DC37C44118
SHA-512:	C496725C084CE29402CD54FF2810E3A5B4DE40C940BDB0AEB0A68E0A7E8CDE86301CF94D97DCD61D46FB65F03E04E66BF39A52D55C6BD666E3797E1CCA594683
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C79D1510-A1EF-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	46904
Entropy (8bit):	2.534409386483005
Encrypted:	false
SSDEEP:	384:rUnULPHMB6v920hyrEW3SHPblugb0hyrEW3SHPblug/ODrEIx2iT:GQyrE5HRug+yrE5HRugGgiT
MD5:	3E93044EAC34A591658594426264558D
SHA1:	82CFFF08D31C35FC390D4EFE2240D52E94D16FDF
SHA-256:	EEFF7BC7CF1C7CF92391A22BFF5AE8B2040ED71E0C10BA5FB018325EA90C5459
SHA-512:	B702D6FC473BB47DBF35CB5F05F18E1CB24D4E0A68F740243A003F8DED792A9A79D53C75A367D68F7E9AE60A992E629FA5524BBA443D1A39208EE40409ECBA48
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{CDD0F16C-A1EF-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5646985796338064
Encrypted:	false
SSDEEP:	48:Iw4GcprMGwpa1G4pQhGrapbScGQpK6G7HpRWTGIpG:rMZkQn6xBS0AVTiA
MD5:	782D8601976A649E02CD95186ADA1C11
SHA1:	2EC633A4BED5B87B1972E46D34D5B033BE3F633E
SHA-256:	4F5A242A57FFE61BD2C3E2E5BD288D99EE6841F4F240A1E8A62A0157A5D5BE61
SHA-512:	EB392AAA47B0E924E9BE57ED02DD4349B6D0917FEA56DCB3AA8ECB59268B8EBD4DBA762C8150F485AC13B53F31806D90E03D1457BA384A9743C402CD3FE7451B
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	37288
Entropy (8bit):	3.1657130208448936
Encrypted:	false
SSDEEP:	96:Mo+oJoJoGoRo9QQQQQfMzMCMCMrM6M9QQQQQt:d23X6P9
MD5:	8D91ABAC80C3E6E5A82EBAE163BFAE9E
SHA1:	78168002BBBE5F198857F0DEC8799A1F145D2AF3
SHA-256:	712D6B1825AC3F10AD03277D4F5A3E5003ED49528060DA6872D1F4EB1ED88C43
SHA-512:	DDA01E28CCECE66370FF61F37ED7D1AEAF00684D6BE2CCCCB529E506075B2D019B75E9384CA849833FCE3A65B799A7B2CBD7762BC31649F18D45309695E86204
Malicious:	false
Reputation:	low
Preview:	q.h.t.t.p.s.:././.s.e.c.u.r.e...a.a.d.c.d.n...m.i.c.r.o.s.o.f.t.o.n.l.i.n.e.-.p...c.o.m./.e.s.t.s./.2...1...8.1.4.8...1.6./.c.o.n.t.e.n.t./.i.m.a.g.e.s./.f.a.v.i.c.o.n._.a._.e.u.p.a.y.f.g.g.h.q.i.a.i.7.k.9.s.o.l.6.l.g.2...i.c.o.~(................h(......(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/ErrorPageTemplate.css
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\Me[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	2347
Entropy (8bit):	5.290031538794594
Encrypted:	false
SSDEEP:	48:gCgF0+kNL5iQ6+GhB+SYWzGuesAFcsGJOzgO6FIEv+sj+M++sx+suse+swsosmC0:gC3Na5+GX+Ti2XsYE2sqAsosushswsoB
MD5:	E86EF8B6111E5FB1D1665BCDC90888C9
SHA1:	994BF7651CB967CD9053056AF2D69ACB74DB7F29
SHA-256:	3410242720DE50B090D07A23AEE2DAD879B31D36F2615732962EC4CFA8A9D458
SHA-512:	2486B491681EE91A9CD1ECC9AA011A3FB34B48358C5D7A4D503A5357BC5CE4CA22999F918D40AC60A3063940D5F326FC7E4E5713D89D5C102DE68824E371B3AB
Malicious:	false
Reputation:	low
Preview:	<script type="text/javascript">!function(n,t){for(var e in t)n[e]=t[e]}(this,function(n){function t(i){if(e[i])return e[i].exports;var s=e[i]={exports:{},id:i,loaded:!1};return n[i].call(s.exports,s,s.exports,t),s.loaded=!0,s.exports}var e={};return t.m=n,t.c=e,t.p="",t(0)}([function(n,t){function e(n){for(var t=g[c],e=0,i=t.length;e<i;++e)if(t[e]===n)return!0;return!1}function i(n){if(!n)return null;for(var t=n+"=",e=document.cookie.split(";"),i=0,s=e.length;i<s;i++){var o=e[i].replace(/^\s(\w+)\s=\s*/,"$1=").replace(/(\s+$)/,"");if(0===o.indexOf(t))return o.substring(t.length)}return null}function s(n,t,e){if(n)for(var i=n.split(":"),s=null,o=0,a=i.length;o<a;++o){var l=null,c=i[o].split("$");if(0===o&&(s=parseInt(c.shift()),!s))return;var p=c.length;if(p>=1){var f=r(s,c[0]);if(!f\|\|e[f])continue;l={signInName:f,idp:"msa",isSignedIn:!0}}if(p>=3&&(l.firstName=r(s,c[1]),l.lastName=r(s,c[2])),p>=4){var g=c[3],m=g.split("\|");l.otherHashedAliases=m}if(p>=5){var h=parseInt(c[4],16);h&&(l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\aes[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	31206
Entropy (8bit):	5.029849776271767
Encrypted:	false
SSDEEP:	768:1yopGg+XzZFJSYWSKmpLThmSCSKB5VLLTqm5T712:1JpH+XzlSum5T712
MD5:	78A66859739B0C9E18BC5B4538C03BF9
SHA1:	77AA2FBBC258645904620937B387D3DEEDBD16EA
SHA-256:	D2701C86A2A31A641520E72121749DBBABEED4B1A59AECE20BBF14F9C9DE82BC
SHA-512:	69941C2E73A0894731BDA171369D1D3AD09F6D30A0A02CAA2340FAC4B50C2082B353988B45911F01D0D95D12E78D33C7FCE05003F4102F8127C8B7DF2F5721AE
Malicious:	false
Reputation:	low
IE Cache URL:	http://sdfsdfsd.rf.gd/aes.js
Preview:	/.. aes.js: implements AES - Advanced Encryption Standard.. * from the SlowAES project, http://code.google.com/p/slowaes/.. * .. * Copyright (c) 2008 .Josh Davis ( http://www.josh-davis.org ),.. ......Mark Percival ( http://mpercival.com ),.. .. * Ported from C code written by Laurent Haan ( http://www.progressive-coding.com ).. * .. * Licensed under the Apache License, Version 2.0.. * http://www.apache.org/licenses/.. /....var slowAES = {.../... * START AES SECTION... */...aes:{....// structure of valid key sizes....keySize:{.....SIZE_128:16,.....SIZE_192:24,.....SIZE_256:32....},........// Rijndael S-box....sbox:[....0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,....0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,....0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,....0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\boot.worldwide.0.mouse[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	663451
Entropy (8bit):	5.363528939418139
Encrypted:	false
SSDEEP:	12288:YhqbL1Q9eTw/suNyIzaJS/pWYawUWufSywDr2ou5YP1B:YhqbLu9e8/sMzaJS/pWYawUWufSywDrd
MD5:	28F6EC975640EB85D7DEB22869E678DF
SHA1:	2D0762DA50E6A1642B7963A32B6D18539400E654
SHA-256:	B88D28CE1DD239D22B340EE75A22564D491D730E30163F6897760E021922145A
SHA-512:	205A6EC0A44ED189D515ABFA1034763AA8F054F88555B927CA0DE81090CD594F8C39D0994E07E4058C8A6F5809797CC79FDD6A5FC932A3B2F1FC2A24FDC2DCD9
Malicious:	false
Reputation:	low
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.0.mouse.js'] = (new Date()).getTime();../* Empty file */;Function.__typeName="Function";Function.__class=!0;Function.createCallback=function(n,t){return function(){var r=arguments.length;if(r>0){for(var u=[],i=0;i<r;i++)u[i]=arguments[i];u[r]=t;return n.apply(this,u)}return n.call(this,t)}};Function.prototype.bind=Function.prototype.bind\|\|function(n){if(typeof this!="function")throw new TypeError("bind(): we can only bind to functions");var u=Array.prototype.slice.call(arguments,1),r=this,t=function(){},i=function(){return r.apply(this instanceof t?this:n,u.concat(Array.prototype.slice.call(arguments)))};this.prototype&&(t.prototype=this.prototype);i.prototype=new t;return i};Function.createDelegate=function(n,t){return function(){return t.apply(n,arguments)}};Function.emptyFunction=Function.emptyMethod=function(){};Error.__typeNam

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/bullet.png
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\ellipsis_white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	915
Entropy (8bit):	3.877322891561989
Encrypted:	false
SSDEEP:	24:t4CvnAVRf83f1QqCSzGUdiHTVtpRduf1QqCWbVHTVeUV0Uv6f1QqCWbVHTVeUV0W:fnL1QqC4GuiHFXS1QqCWRHQ3V1QqCWRV
MD5:	5AC590EE72BFE06A7CECFD75B588AD73
SHA1:	DDA2CB89A241BC424746D8CF2A22A35535094611
SHA-256:	6075736EA9C281D69C4A3D78FF97BB61B9416A5809919BABE5A0C5596F99AAEA
SHA-512:	B9135D934B9EA50B51BB0316E383B114C8F24DFE75FEF11DCBD1C96170EA59202F6BAFE11AAF534CC2F4ED334A8EA4DBE96AF2504130896D6203BFD2DA69138F
Malicious:	false
Reputation:	low
IE Cache URL:	https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/ellipsis_white.svg?x=5ac590ee72bfe06a7cecfd75b588ad73
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="16" height="16" viewBox="0 0 16 16"><title>assets</title><path fill="#ffffff" d="M1.143,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.107,1.107,0,0,1-.446.089A1.107,1.107,0,0,1,.7,9.054a1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893A1.164,1.164,0,0,1,.7,6.946a1.107,1.107,0,0,1,.446-.089M8,6.857a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,8,6.857m6.857,0a1.107,1.107,0,0,1,.446.089,1.164,1.164,0,0,1,.607.607,1.161,1.161,0,0,1,0,.893,1.164,1.164,0,0,1-.607.607,1.161,1.161,0,0,1-.893,0,1.164,1.164,0,0,1-.607-.607,1.161,1.161,0,0,1,0-.893,1.164,1.164,0,0,1,.607-.607A1.107,1.107,0,0,1,14.857,6.857Z"/></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\microsoft_logo[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
IE Cache URL:	https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/microsoft_logo.svg?x=ee5c8d9fb6248c938fd0dc19370e90bd
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\prefetch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	2745
Entropy (8bit):	5.304333452185501
Encrypted:	false
SSDEEP:	48:ozeVcGOwjKONPwgII1eRLCFfaUrn36IIhO:ZVjOwjKvgII1y2fak36IIA
MD5:	CA4CFE7CF9F222896459FFDE2BB8582A
SHA1:	D9FAC1ABA71EA6CAD8F37F60A7B92A96801A744B
SHA-256:	E79EB7D412A2B5BE3AC8500E099E4BF0E5CB28AB67BF6D68AC422D624422C581
SHA-512:	048C136EDD31541724653F98C206E597E2F9AF5A350E4E6D9C6B70FCD678BC3F890042BACE612BC7AFBC03B38076F4A15FD559DFB01F884AEACAA43A96606B74
Malicious:	false
Reputation:	low
Preview:	..<!DOCTYPE html>..<html>..<head>.. <title>Prefetch</title>.. <meta http-equiv="x-ua-compatible" content="IE=Edge">.... .. <style>.. @font-face {.. font-family: 'office365icons';.. src: url('https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.eot?#iefix') format('embedded-opentype'),url('https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.woff') format('woff'),url('https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.ttf') format('truetype'),url('https://r4.res.office365.com/owa/prem/15.20.4020.16/resources/styles/fonts/office365icons.svg') format('svg');.. }.. </style>.. .... <script type="text/javascript">.. var pf = (function(){function h(n){for(var r=n+"=",u=document.cookie.split(";"),t,i=0;i<u.length;++i){for(t=u[i];t.charAt(0)==" ";)t=t.substring(1,t.length);if(t.indexOf(r)==0)retur

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\0-small[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 72x72, segment length 16, baseline, precision 8, 50x28, frames 3
Category:	downloaded
Size (bytes):	3006
Entropy (8bit):	3.009694812062996
Encrypted:	false
SSDEEP:	12:tWK1TbpOMo7FL2cDPilY1Qtc150XyoseAfQx9Jq4U3DXCFSAt78aULgf5GY48:AK1hNo7FCWwNtc1spAYx9VOCUiXVf5x
MD5:	138BCEE624FA04EF9B75E86211A9FE0D
SHA1:	23BBCDAAEBD6C9A6E57E96E44493B2212860FCAB
SHA-256:	F89E908280791803BBF1F33B596FF4A2179B355A8E15AD02EBAA2B1DA11127EA
SHA-512:	D20765E5738F4AC5A91396B5F5D88057C3B5125840BCE42039AC9D5D75B1C3FB9629ACA6290A475625DFE60887CF59D4FB52108D024FF4FA8094C9B8458F9F33
Malicious:	false
Reputation:	low
IE Cache URL:	https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0-small.jpg?x=138bcee624fa04ef9b75e86211a9fe0d
Preview:	......JFIF.....H.H.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	441128
Entropy (8bit):	5.429482346913976
Encrypted:	false
SSDEEP:	6144:YZXDgNWEcCYAaItcWnvJWDoICrNxM623WkY5L9OtHbAE0HKA5ka:4XD/lXWnvYDsxXybyf
MD5:	E714859310B26C9EBA3C2910628402B5
SHA1:	F1D9A4A5CE5EF599A3231B31526034536B926EF5
SHA-256:	194B80CA3D4D40425984BB7900C623A05D932FD2B7D42F99F4071A2E9C85B292
SHA-512:	C87CC1ECDD38FF1DB68AC9287E352BF3E908D64EB4D656608992A9EC375153EC6CC79F60BBA080D336114F6269C834A9A14F518477A2D79BE9C6EF14C5099CA8
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/shared/1.0/content/js/ConvergedLogin_PCore_5xSFkxCybJ66PCkQYoQCtQ2.js
Preview:	/!. ------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------. * . * This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise.. * . * json2.js (2016-05-01). * https://github.com/douglascrockford/JSON-js. * License: Public Domain. * . * Provided for Informational Purposes Only. * . * ----------------------------------------------- END OF THIRD PARTY NOTICE ------------------------------------------. */!function(e){function n(n){for(var t,i,o=n[0],r=n[1],s=0,c=[];s<o.length;s++)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	831
Entropy (8bit):	5.4708679941204155
Encrypted:	false
SSDEEP:	24:k3ToymIsYv5WuVLZ9hNBM0F9LiWLc/DHVXRq:wx5WuFZzPMUSHdRq
MD5:	712CA05FF55889CD944EAA8CE5D93413
SHA1:	C4538C4ECCA80A506059FB5E9874D9F2F1B8F50E
SHA-256:	8EC1C6706F99C070BFD8BD2FE6670884758780D40DF01FE9707FC9AFD6A466B6
SHA-512:	043EAE9DA7A36CE3410B04D7FCF4B7D0970719F39BE03CEC115B4240F44894D1E185893E3366722A345A097BAA81164A663961D943245DCA845F6A5B29213470
Malicious:	true
Yara Hits:	Rule: JoeSecurity_HtmlPhish_10, Description: Yara detected HtmlPhish_10, Source: C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a[1].htm, Author: Joe Security
Reputation:	low
IE Cache URL:	http://sdfsdfsd.rf.gd/a.html
Preview:	<html><body><script type="text/javascript" src="/aes.js" ></script><script>function toNumbers(d){var e=[];d.replace(/(..)/g,function(d){e.push(parseInt(d,16))});return e}function toHex(){for(var d=[],d=1==arguments.length&&arguments[0].constructor==Array?arguments[0]:arguments,e="",f=0;f<d.length;f++)e+=(16>d[f]?"0":"")+d[f].toString(16);return e.toLowerCase()}var a=toNumbers("f655ba9d09a112d4968c63579db590b4"),b=toNumbers("98344c2eee86c3994890592585b49f80"),c=toNumbers("0ebbf7158ce32bbda216494bbb907bdd");document.cookie="__test="+toHex(slowAES.decrypt(c,2,a,b))+"; expires=Thu, 31-Dec-37 23:55:55 GMT; path=/"; location.href="http://sdfsdfsd.rf.gd/a.html?i=1";</script><noscript>This site requires Javascript to work, please enable Javascript in your browser or use a browser with Javascript support</noscript></body></html>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\converged.v2.login.min_kb8fbtudybay5t8ts3k87g2[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	107790
Entropy (8bit):	5.291439087111367
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmWGQvz6yVUn1:xkJ4yVU1
MD5:	29BF0506D51D6016B2E53F134B72BCEE
SHA1:	A4D7D4609C4988849E0AC4E92423DAAEF7D7F671
SHA-256:	1B31B0FFABF72E2545AAAD397417BA58F66EB3D57A232E115085136A497FFB34
SHA-512:	D9A0D6BFCA0D1393B55DD5472D99E78F948F72EE0C58F2E7FDBB1ED4275B730A2DE1730AF9E92696A32ECC017E3463D6DA0934EAFF65C63C7ED5FC817C4C8B84
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_kb8fbtudybay5t8ts3k87g2.css
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\ellipsis_grey[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.112791906195054
Encrypted:	false
SSDEEP:	3:PIyPhxn0+7/y9xwv7YqRAEtZ6UzUbjKGnMuR0Lk3XmynKQc0Asb1HbkUEZcKBcD:pn0+Dy9xwhmEr6VjTMu9nPnq02+KqD
MD5:	33196BD447BF8D1CEAE6CAC6DE2219C9
SHA1:	3A848E7BA17F8D1A30A09E470F1EFB06DAD9CAD4
SHA-256:	DCDAA01C96932BEE57D294CBA7940B0CB3E384AE78A74345A16DAC22BAC8C270
SHA-512:	B80B3076D5644EC80B5F96C34D8152AAA4D4FA8CBC7382629D67471013E31C5EE935EA9DB264EC36774547CCEA31D703A83682E5105B7AE0A1D8BCBA65B9CD6F
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="https://infinityfree.net/errors/404/">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\jquery-3.3.1.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	86927
Entropy (8bit):	5.289226719276158
Encrypted:	false
SSDEEP:	1536:jLiBdiaWLOczCmZx6+VWuGzQNOzdn6x2RZd9SEnk9HB96c9Yo/NWLbVj3kC6t3:5kn6x2xe9NK6nC69
MD5:	A09E13EE94D51C524B7E2A728C7D4039
SHA1:	0DC32DB4AA9C5F03F3B38C47D883DBD4FED13AAE
SHA-256:	160A426FF2894252CD7CEBBDD6D6B7DA8FCD319C65B70468F10B6690C45D02EF
SHA-512:	F8DA8F95B6ED33542A88AF19028E18AE3D9CE25350A06BFC3FBF433ED2B38FEFA5E639CDDFDAC703FC6CAA7F3313D974B92A3168276B3A016CEB28F27DB0714A
Malicious:	false
Reputation:	low
IE Cache URL:	https://code.jquery.com/jquery-3.3.1.min.js
Preview:	/! jQuery v3.3.1 \| (c) JS Foundation and other contributors \| jquery.org/license /.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(e,t){"use strict";var n=[],r=e.document,i=Object.getPrototypeOf,o=n.slice,a=n.concat,s=n.push,u=n.indexOf,l={},c=l.toString,f=l.hasOwnProperty,p=f.toString,d=p.call(Object),h={},g=function e(t){return"function"==typeof t&&"number"!=typeof t.nodeType},y=function e(t){return null!=t&&t===t.window},v={type:!0,src:!0,noModule:!0};function m(e,t,n){var i,o=(t=t\|\|r).createElement("script");if(o.text=e,n)for(i in v)n[i]&&(o[i]=n[i]);t.head.appendChild(o).parentNode.removeChild(o)}function x(e){return null==e?e+"":"object"==typeof e\|\|"function"==typeof e?l[c.call(e)]\|\|"object":typeof e}var b="3.3.1",w=function(e,t){return new w.fn.init(e,t)},

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\red_x[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4692
Entropy (8bit):	7.929034471918412
Encrypted:	false
SSDEEP:	96:Sn/2mON/mv8Z7QuHy9TZhjR0ZmegAmURrkxeDlOyMX:SnO8i7QhVTvUbDlq
MD5:	5F3C13A459A72438E42B2289C7AF2034
SHA1:	F43551BE102CD1EB0B2E87DC24F980720194A56B
SHA-256:	A7A63CA1370CD6FC3470FA81BB1DCB21BCE31B0048A36E5BCE8914EEB88DAAB1
SHA-512:	14E82E281DC91ED57EAB780279D167413185DB3FA7BE49FBDB4942888E7F4E30B1A0536B269258FB8C3975BCF2BC189B51AAC4F70BF44887BC17506DF6ECB507
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/red_x.png
Preview:	.PNG........IHDR...0...0.....W.......IDATx^.Y.tTe....RK......D..6.......(.G..d;c..8.`........3.....2"Qq.g@.0.aK.I.V.R{.en..?.N<8.8...%.{......+....^.j<...$..('.......F..'.....7...7._A:.......6...0X^^.V2jTV^^......+L<.w...Q]]]...G....}kk......N..V........4.......3gfO.<.P..Xw7.g."x.4.jk...G..........UQ...1p.8%/.:`.9r......kok...x..........I~:.o.Y\.....V..4....o.....P.f..m..T.....c."-;...6t...O=...c...h.M.,((.w..._q..'..G..._.....7.>u..h{......8z.i..H.6.zO...].}.0.!X..L].....=`.0M..3.D.Q._s.(.U\lVWW7n.=..D....r..$....,]Z........UUp....4D...z{;.....7T..Z0M.2.q....t)..a.....{....g?./..o...s..)b... .U...../Y2...._z....G.B.....B..$i..L..#..,..+ s...A.bX.`@7.)"@.'M.G.EzQ..u....kj..>"l.#?a.E./..b..7m.UWB!.?..........$..I..0. m).8'..P..h..k@...]..C..{.L..qm9...W_.yX.....@.Kh..7/^<..Q.~=..N....;..D4ZD%i...B....0O.f.....ua1a5(.........~..>. .#.i.&.\|.(....H~.'...pE..Ekx.Yd^r.b'O"~..RHDe..P...n... ....%lA.....a.b..F.i.X..a.....i,....f.q...7=.`[..l.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\reprocess[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	dropped
Size (bytes):	192700
Entropy (8bit):	5.648838170226926
Encrypted:	false
SSDEEP:	3072:B8H/l9D+BxkJ4yVUYmkUNG2ym+d/PngTehK8iD2g/9K5:y/lZ+zkUNGzZ5
MD5:	206BC740FE74CD98DFE2529B16D3DB4E
SHA1:	87E7A03D98AD81E0E8877814E70BF3473FA59218
SHA-256:	B9619DA94F3A2E5C571D53DD84FC09D6CB3993056925C79728D966D39C106CD3
SHA-512:	7D6051686D6138B9953734FA541408F3CC07431EFB223591334BADDCEF8239EFA4C6A375638FF3585A553C3320A90B56596F981E0743568C8855B53BDD7D7FE4
Malicious:	false
Reputation:	low
Preview:	.... Copyright (C) Microsoft Corporation. All rights reserved. -->..<!DOCTYPE html>..<html dir="ltr" class="" lang="en">..<head>.. <title>Sign in to your account</title>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">.. <meta http-equiv="Pragma" content="no-cache">.. <meta http-equiv="Expires" content="-1">.. <link rel="preconnect" href="https://aadcdn.msauth.net" crossorigin>..<meta http-equiv="x-dns-prefetch-control" content="on">..<link rel="dns-prefetch" href="//aadcdn.msauth.net">..<link rel="dns-prefetch" href="//aadcdn.msftauth.net">.... <meta name="PageID" content="ConvergedSignIn" />.. <meta name="SiteID" content="" />.. <meta name="ReqLC" content="1033" />.. <meta name="LocLC" content="en-US" />.... <meta name="referrer" content="origin" />....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\ux.converged.login.strings-en.min__3zcano9dknadzhd-kyrsq2[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	42748
Entropy (8bit):	5.400118539812042
Encrypted:	false
SSDEEP:	768:M2MXCo7yAF1tlfretkUNKNa8DRN2ym+d/PngTehK8ObrUkPTPRUbx3Tg/qzqG3lH:oHF1tlfretkUNKNa8DRN2ym+d/PngTen
MD5:	FF765C6A73BD74A9C00D985DFA461149
SHA1:	F718A092F293C832AB14BB14081BA04886612ADB
SHA-256:	7B093E919D7C30AA1999611E4DEAEBB88FE1C65E353727BC5BCC584C8A36677F
SHA-512:	3BE74EA07F7945CEAAAB30B938F83BE4C84D6386AD0503B2F4A533100B63564E1B367CDA8B455A3CA637339DAC16F33585343F04CBD83AF070A9096ECEED79F8
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min__3zcano9dknadzhd-kyrsq2.js
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(7),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\404[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	17344
Entropy (8bit):	4.900369066098725
Encrypted:	false
SSDEEP:	192:de2iKmwabuu97wiBy/hzMLQcEfQAXLphWkBugy0GAEfERaI+smbP4I+DQzmZyBvA:Fouuh+fGWPia7u4
MD5:	99215DEA1046F0FD26767D2210E22D61
SHA1:	2BC41BBAA8F344628256636C0CD7F6B3C656B233
SHA-256:	626C29AA1A6AA664CB094FE757C38E7D85F46FC75689BE35EB33B83D9B8FBD66
SHA-512:	377BF2125590E157F7C1436D8BDBB3AA1DD274A0218042A476CE7B3D6B673340B4D2117E0BEAE2389AD904B22EA60D37F7CD7FEB12D462FF75F6F727E8219730
Malicious:	false
Reputation:	low
IE Cache URL:	https://infinityfree.net/errors/404/
Preview:	<!DOCTYPE html>.<html lang="en-us" dir="ltr">.<head>.<title>404 Page Not Found - InfinityFree</title>.<meta charset="utf-8">.<meta name="format-detection" content="telephone=no" />.<meta name="viewport" content="width=device-width, initial-scale=1">..<meta name="generator" content="Jekyll v3.8.5" />.<meta property="og:title" content="404 Page Not Found" />.<meta name="author" content="InfinityFree" />.<meta property="og:locale" content="en_US" />.<meta name="description" content="Free Web Hosting with Unlimited Disk Space, Unlimited Bandwidth and Unlimited Websites from InfinityFree. With PHP and MySQL and no forced ads on your site." />.<meta property="og:description" content="Free Web Hosting with Unlimited Disk Space, Unlimited Bandwidth and Unlimited Websites from InfinityFree. With PHP and MySQL and no forced ads on your site." />.<link rel="canonical" href="https://infinityfree.net/errors/404/" />.<meta property="og:url" content="https://infinityfree.net/errors/404/" />.<meta pro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/background_gradient.jpg
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\forbidframing[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2882
Entropy (8bit):	4.101264567053427
Encrypted:	false
SSDEEP:	48:upYP3V4V1UXvCavVbQdZKUqVtLQI7I6FQ3:u1qlW8rJId3
MD5:	5CD4CA3D0F819A2F671983A0692C6DDD
SHA1:	BBD2807010E5BA10F26DA2BFA0123944D9521C53
SHA-256:	916E48D15E96253E73408F0C85925463F3EE6DA0C5600CB42DBA50545C50133B
SHA-512:	4420B522CBE8931BBA82B4B6F7E78737F3BB98FC61496826ACB69CFFF266D1AC911B84CB0AEEADD05BD893A5D85D52D51777ED3F62512C4786593689BF2DF7F0
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/forbidframing.htm
Preview:	.<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN" "http://www.w3.org/TR/html4/loose.dtd">....<html dir="LTR">.... <head>.. <link rel="stylesheet" type="text/css" href="ErrorPageTemplate.css" >.... <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.... <title>Framing Forbidden</title>.... <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onload="initUnframeContent();">.... <table width="450" cellpadding="0" cellspacing="0" border="0">.... Error title -->.. <tr>.. <td id="infoIconAlign" width="60" align="left" valign="top" rowspan="2">.. <img src="red_x.png" id="infoIcon" alt="Info icon">.. </td>.. <td id="unableDisplayAlign" valign="middle" align=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	3651
Entropy (8bit):	4.094801914706141
Encrypted:	false
SSDEEP:	96:wO4DZ+Stb/jY+eo4hAryAes9mBYYQgWLDm9:wToSBjlevudl9nO
MD5:	EE5C8D9FB6248C938FD0DC19370E90BD
SHA1:	D01A22720918B781338B5BBF9202B241A5F99EE4
SHA-256:	04D29248EE3A13A074518C93A18D6EFC491BF1F298F9B87FC989A6AE4B9FAD7A
SHA-512:	C77215B729D0E60C97F075998E88775CD0F813B4D094DC2FDD13E5711D16F4E5993D4521D0FBD5BF7150B0DBE253D88B1B1FF60901F053113C5D7C1919852D58
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/shared/1.0/content/images/microsoft_logo_ee5c8d9fb6248c938fd0dc19370e90bd.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="108" height="24" viewBox="0 0 108 24"><title>assets</title><path d="M44.836,4.6V18.4h-2.4V7.583H42.4L38.119,18.4H36.531L32.142,7.583h-.029V18.4H29.9V4.6h3.436L37.3,14.83h.058L41.545,4.6Zm2,1.049a1.268,1.268,0,0,1,.419-.967,1.413,1.413,0,0,1,1-.39,1.392,1.392,0,0,1,1.02.4,1.3,1.3,0,0,1,.4.958,1.248,1.248,0,0,1-.414.953,1.428,1.428,0,0,1-1.01.385A1.4,1.4,0,0,1,47.25,6.6a1.261,1.261,0,0,1-.409-.948M49.41,18.4H47.081V8.507H49.41Zm7.064-1.694a3.213,3.213,0,0,0,1.145-.241,4.811,4.811,0,0,0,1.155-.635V18a4.665,4.665,0,0,1-1.266.481,6.886,6.886,0,0,1-1.554.164,4.707,4.707,0,0,1-4.918-4.908,5.641,5.641,0,0,1,1.4-3.932,5.055,5.055,0,0,1,3.955-1.545,5.414,5.414,0,0,1,1.324.168,4.431,4.431,0,0,1,1.063.39v2.233a4.763,4.763,0,0,0-1.1-.611,3.184,3.184,0,0,0-1.15-.217,2.919,2.919,0,0,0-2.223.9,3.37,3.37,0,0,0-.847,2.416,3.216,3.216,0,0,0,.813,2.338,2.936,2.936,0,0,0,2.209.837M65.4,8.343a2.952,2.952,0,0,1,.5.039,2.1,2.1,0,0,1,.375.1v2.358a2.04,2.04,0,0,0-.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\G62TDH9B\signin-options_4e48046ce74f4b89d45037c90576bfac[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	dropped
Size (bytes):	1592
Entropy (8bit):	4.205005284721148
Encrypted:	false
SSDEEP:	48:ztSAS1OtmCtc7aIVmt4yyR9S2lKUyDWwh:RoOtmCtc7aCmVQHSRh
MD5:	4E48046CE74F4B89D45037C90576BFAC
SHA1:	4A41B3B51ED787F7B33294202DA72220C7CD2C32
SHA-256:	8E6DB1634F1812D42516778FC890010AA57F3E39914FB4803DF2C38ABBF56D93
SHA-512:	B2BBA2A68EDAA1A08CFA31ED058AFB5E6A3150AABB9A78DB9F5CCC2364186D44A015986A57707B57E2CC855FA7DA57861AD19FC4E7006C2C239C98063FE903CF
Malicious:	false
Reputation:	low
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="48" height="48" viewBox="0 0 48 48"><defs><style>.a{fill:none;}.b{fill:#404040;}</style></defs><rect class="a" width="48" height="48"/><path class="b" d="M40,32.578V40H32V36H28V32H24V28.766A10.689,10.689,0,0,1,19,30a10.9,10.9,0,0,1-5.547-1.5,11.106,11.106,0,0,1-2.219-1.719A11.373,11.373,0,0,1,9.5,24.547a10.4,10.4,0,0,1-1.109-2.625A11.616,11.616,0,0,1,8,19a10.9,10.9,0,0,1,1.5-5.547,11.106,11.106,0,0,1,1.719-2.219A11.373,11.373,0,0,1,13.453,9.5a10.4,10.4,0,0,1,2.625-1.109A11.616,11.616,0,0,1,19,8a10.9,10.9,0,0,1,5.547,1.5,11.106,11.106,0,0,1,2.219,1.719A11.373,11.373,0,0,1,28.5,13.453a10.4,10.4,0,0,1,1.109,2.625A11.616,11.616,0,0,1,30,19a10.015,10.015,0,0,1-.125,1.578,10.879,10.879,0,0,1-.359,1.531Zm-2,.844L27.219,22.641a14.716,14.716,0,0,0,.562-1.782A7.751,7.751,0,0,0,28,19a8.786,8.786,0,0,0-.7-3.5,8.9,8.9,0,0,0-1.938-2.859A9.269,9.269,0,0,0,22.5,10.719,8.9,8.9,0,0,0,19,10a8.786,8.786,0,0,0-3.5.7,8.9,8.9,0,0,0-2.859,1.938A9.269,9.269,0,0,0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\0[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, baseline, precision 8, 1920x1080, frames 3
Category:	downloaded
Size (bytes):	283351
Entropy (8bit):	7.975896455873056
Encrypted:	false
SSDEEP:	6144:hPgRhluS12CyK8XGsLzsr5XONnQ4/bEmhZSIj6xU2zyOX/:2vz1pyWsLoXqN/YWPUU2OOX/
MD5:	A5DBD4393FF6A725C7E62B61DF7E72F0
SHA1:	55B292F885FFC92ABCE18750B07AA4ACFA4E903E
SHA-256:	211A907DE2DA0FF4A0E90917AC8054E2F35C351180977550C26E51B4909F2BEB
SHA-512:	850586A05B67EF25492BD50A090F1EC0A0CC21DC4E4EFEB35E19CDC78A98F9415A3807318FA02664EADE87F0E2D8FA2A2958CD0D712329800FC05689E01DC614
Malicious:	false
Reputation:	low
IE Cache URL:	https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/backgrounds/0.jpg?x=a5dbd4393ff6a725c7e62b61df7e72f0
Preview:	.....Phttp://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c142 79.160924, 2017/07/13-01:06:39 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about=""/> </rdf:RDF> </x:xmpmeta>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\2_bc3d32a696895f78c19df6c717586a5d[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\a[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	206154
Entropy (8bit):	4.167919474045698
Encrypted:	false
SSDEEP:	1536:Sip95AK9ko5nuDYkxOeZkpI2XUC7qv3SrxEhPeyY:fDSoxYeyY
MD5:	961C00A81A92222E3FB9F4EA1B276AA1
SHA1:	D1A92F9F2A333259547A43BB7D6620D190F84012
SHA-256:	9DEE1028969FE4E8FBF95D56C9BE49D468D6A869A026258C56CD20BA42CB0EB2
SHA-512:	1A2108ED452215C4F3199AD1A69B435862FC474C14F5BC19D368A035FAE267AD72AF9C6C99BB34B4452DE18649031773D8C0EB782B4C3C44DB822F40EA4203E9
Malicious:	false
Reputation:	low
IE Cache URL:	http://sdfsdfsd.rf.gd/a.html?i=1
Preview:	...<html dir="ltr" class="gr__login_microsoftonline_com" lang="en">....<head>.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Sign in to your account</title>.... <meta http-equiv="X-UA-Compatible" content="IE=edge">.. <meta name="viewport" content="width=device-width, initial-scale=1.0, maximum-scale=2.0, user-scalable=yes">.. <meta http-equiv="Pragma" content="no-cache">.. <meta http-equiv="Expires" content="-1">.. <meta name="PageID" content="ConvergedSignIn">.. <meta name="SiteID" content="">.. <meta name="ReqLC" content="1033">.. <meta name="LocLC" content="en-US">.... <noscript>.. <meta http-equiv="Refresh" content="0; URL=https://login.microsoftonline.com/jsdisabled" />.. </noscript>.... <style type="text/css">.. html {.. font-family: sans-serif;.. -ms-text-size-adjust: 100%;.. -webkit-text-size-adjust: 100%.. }.. .. body {.. margi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\boot.worldwide.1.mouse[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	modified
Size (bytes):	659833
Entropy (8bit):	5.352834927843576
Encrypted:	false
SSDEEP:	12288:0uMOQrWEWbnByixmwgVZsVM3cFuG4zeeIOj:0uMOJpBJgWacF4Fj
MD5:	ADCFFBA6C2C732CAD6281BEB67FF5AED
SHA1:	2E75B585ED6B3F55800552FA60AD9AEFE817E00B
SHA-256:	DB634CA50571852873DE98052D47A9B162AA8F23761E2CDBBE586EE7077DC88B
SHA-512:	439EE94C94786C3195AEC151419070B13C9DFE2FE97D0A90E9F562CA3538A1777148EF4FEFA53CEF29EC0631463FC60F494D1D954A1A742D56186873A32C51F5
Malicious:	false
Reputation:	low
Preview:	.window.scriptsLoaded = window.scriptsLoaded \|\| {}; window.scriptProcessStart = window.scriptProcessStart \|\| {}; window.scriptProcessStart['boot.worldwide.1.mouse.js'] = (new Date()).getTime();..;_a.d.G=function(n,t){this.b=n;this.a=t};_a.d.G.prototype={b:0,a:0};_a.fo=function(n){this.s=n};_a.fo.prototype={s:null,t:null,i:function(){return this.s.currentTarget},e:function(){return this.t?this.t.x:this.s.pageX},f:function(){return this.t?this.t.y:this.s.pageY},o:function(){return this.s.relatedTarget},b:function(){return this.s.target},n:function(){return this.s.timeStamp\|\|+new Date},a:function(){var n=this.s.which;!n&&_a.o.a().K&&this.s.type==="keypress"&&(n=this.u());return n},u:function(){return this.s.keyCode},m:function(){return this.s.originalEvent},j:function(){return this.s.type},k:function(){return this.s.originalEvent.touches},q:function(){return this.s.isDefaultPrevented()},g:function(){return this.s.shiftKey},h:function(){return _j.G.a().P?this.s.metaKey:this.s.ctrlKey},l:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\converged.v2.login.min_kb8fbtudybay5t8ts3k87g2[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	107790
Entropy (8bit):	5.291439087111367
Encrypted:	false
SSDEEP:	1536:QpHDgBvguhw+EViazA/PWrF7qvEAFiQcpmWGQvz6yVUn1:xkJ4yVU1
MD5:	29BF0506D51D6016B2E53F134B72BCEE
SHA1:	A4D7D4609C4988849E0AC4E92423DAAEF7D7F671
SHA-256:	1B31B0FFABF72E2545AAAD397417BA58F66EB3D57A232E115085136A497FFB34
SHA-512:	D9A0D6BFCA0D1393B55DD5472D99E78F948F72EE0C58F2E7FDBB1ED4275B730A2DE1730AF9E92696A32ECC017E3463D6DA0934EAFF65C63C7ED5FC817C4C8B84
Malicious:	false
Reputation:	low
Preview:	/! Copyright (C) Microsoft Corporation. All rights reserved. //*!.------------------------------------------- START OF THIRD PARTY NOTICE -----------------------------------------..This file is based on or incorporates material from the projects listed below (Third Party IP). The original copyright notice and the license under which Microsoft received such Third Party IP, are set forth below. Such licenses and notices are provided for informational purposes only. Microsoft licenses the Third Party IP to you under the licensing terms for the Microsoft product. Microsoft reserves all other rights not expressly granted under this agreement, whether by implication, estoppel or otherwise...//-----------------------------------------------------------------------------.twbs-bootstrap-sass (3.3.0).//-----------------------------------------------------------------------------..The MIT License (MIT)..Copyright (c) 2013 Twitter, Inc..Permission is hereby granted, free of charge, to any person

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
IE Cache URL:	https://secure.aadcdn.microsoftonline-p.com/ests/2.1.8148.16/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\httpErrorPagesScripts[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	12105
Entropy (8bit):	5.451485481468043
Encrypted:	false
SSDEEP:	192:x20iniOciwd1BtvjrG8tAGGGVWnvyJVUrUiki3ayimi5ezLCvJG1gwm3z:xPini/i+1Btvjy815ZVUwiki3ayimi5f
MD5:	9234071287E637F85D721463C488704C
SHA1:	CCA09B1E0FBA38BA29D3972ED8DCECEFDEF8C152
SHA-256:	65CC039890C7CEB927CE40F6F199D74E49B8058C3F8A6E22E8F916AD90EA8649
SHA-512:	87D691987E7A2F69AD8605F35F94241AB7E68AD4F55AD384F1F0D40DC59FFD1432C758123661EE39443D624C881B01DCD228A67AFB8700FE5E66FC794A6C0384
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/httpErrorPagesScripts.js
Preview:	...function isExternalUrlSafeForNavigation(urlStr)..{..var regEx = new RegExp("^(http(s?)\|ftp\|file)://", "i");..return regEx.exec(urlStr);..}..function clickRefresh()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..window.location.replace(location.substring(poundIndex+1));..}..}..function navCancelInit()..{..var location = window.location.href;..var poundIndex = location.indexOf('#');..if (poundIndex != -1 && poundIndex+1 < location.length && isExternalUrlSafeForNavigation(location.substring(poundIndex+1)))..{..var bElement = document.createElement("A");..bElement.innerText = L_REFRESH_TEXT;..bElement.href = 'javascript:clickRefresh()';..navCancelContainer.appendChild(bElement);..}..else..{..var textNode = document.createTextNode(L_RELOAD_TEXT);..navCancelContainer.appendChild(textNode);..}..}..function getDisplayValue(elem

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\prefetch(1)[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	220
Entropy (8bit):	5.112791906195054
Encrypted:	false
SSDEEP:	3:PIyPhxn0+7/y9xwv7YqRAEtZ6UzUbjKGnMuR0Lk3XmynKQc0Asb1HbkUEZcKBcD:pn0+Dy9xwhmEr6VjTMu9nPnq02+KqD
MD5:	33196BD447BF8D1CEAE6CAC6DE2219C9
SHA1:	3A848E7BA17F8D1A30A09E470F1EFB06DAD9CAD4
SHA-256:	DCDAA01C96932BEE57D294CBA7940B0CB3E384AE78A74345A16DAC22BAC8C270
SHA-512:	B80B3076D5644EC80B5F96C34D8152AAA4D4FA8CBC7382629D67471013E31C5EE935EA9DB264EC36774547CCEA31D703A83682E5105B7AE0A1D8BCBA65B9CD6F
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN">.<html><head>.<title>302 Found</title>.</head><body>.<h1>Found</h1>.<p>The document has moved <a href="https://infinityfree.net/errors/404/">here</a>.</p>.</body></html>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\prefetch[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	955
Entropy (8bit):	5.0114192474523165
Encrypted:	false
SSDEEP:	24:xQHYLcyQWkcjB3G6cyQWkcq26cyQWkcyh6cyQWkcQ6cyQWkcxUcyQWkK9V2:xQHSK/CB37K/BLK/BwK/CK/DK/II
MD5:	8F6D965F984AF9801151DCA30E1BDD4F
SHA1:	62884DD772E6BC5D1D03A0E84BF164AAB235F1CD
SHA-256:	9DA3DF0FE4AEDDF853D0B19FAB229B007D88E862299FEE874E8896E2BB65923E
SHA-512:	9037FFEFE1CA34E3C031A916A785821772EB8E3871C7CF35B8771F539AE8353E031BA421448F04C4DF283743479EBF001017A89330F8303BC66ACD39083787C6
Malicious:	false
Reputation:	low
Preview:	..<html>..<head>.. <title>A prefetch page for OfficeHome app</title>..</head>..<body style="width:0;height:0;">.. <link rel="prefetch" href="https://officehome.cdn.office.net/bundles/polyfills-bundle-f9c3341f2bd879f34b38.js" />.. <link rel="prefetch" href="https://officehome.cdn.office.net/bundles/sharedscripts-46c2082441.js" />.. <link rel="prefetch" href="https://officehome.cdn.office.net/bundles/staticscripts-e10017f14c.js" />.. <link rel="prefetch" href="https://officehome.cdn.office.net/bundles/app-bundle-26924b509a4ae71a71c2.js" />.. <link rel="prefetch" href="https://officehome.cdn.office.net/bundles/app-bundle-5956190057a09e174c9a.css" />.. <link rel="prefetch" href="https://officehome.cdn.office.net/images/content/images/fluent-background-sources/header-default-desktop-652cc04392.svg" />.... <iframe src="https://outlook.office365.com/owa/prefetch.aspx"></iframe>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OTUW0Q90\ux.converged.login.strings-en.min__3zcano9dknadzhd-kyrsq2[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	42748
Entropy (8bit):	5.400118539812042
Encrypted:	false
SSDEEP:	768:M2MXCo7yAF1tlfretkUNKNa8DRN2ym+d/PngTehK8ObrUkPTPRUbx3Tg/qzqG3lH:oHF1tlfretkUNKNa8DRN2ym+d/PngTen
MD5:	FF765C6A73BD74A9C00D985DFA461149
SHA1:	F718A092F293C832AB14BB14081BA04886612ADB
SHA-256:	7B093E919D7C30AA1999611E4DEAEBB88FE1C65E353727BC5BCC584C8A36677F
SHA-512:	3BE74EA07F7945CEAAAB30B938F83BE4C84D6386AD0503B2F4A533100B63564E1B367CDA8B455A3CA637339DAC16F33585343F04CBD83AF070A9096ECEED79F8
Malicious:	false
Reputation:	low
Preview:	!function(e){function o(n){if(i[n])return i[n].exports;var t=i[n]={exports:{},id:n,loaded:!1};return e[n].call(t.exports,t,t.exports,o),t.loaded=!0,t.exports}var i={};return o.m=e,o.c=i,o.p="",o(0)}([function(e,o,i){i(2);var n=i(1),t=i(5),r=i(7),a=r.StringsVariantId,s=r.AllowedIdentitiesType;n.registerSource("str",function(e,o){if(e.WF_STR_SignupLink_AriaLabel_Text="Create a Microsoft account",e.WF_STR_SignupLink_AriaLabel_Generic_Text="Create a new account",e.CT_STR_CookieBanner_Link_AriaLabel="Learn more about Microsoft's Cookie Policy",e.WF_STR_HeaderDefault_Title=o.iLoginStringsVariantId===a.CombinedSigninSignupV2WelcomeTitle?"Welcome":"Sign in",e.STR_Footer_IcpLicense_Text=".ICP.13015306.-10",o.oAppCobranding&&o.oAppCobranding.friendlyAppName){var i=o.fBreakBrandingSigninString?"to continue to {0}":"Continue to {0}";e.WF_STR_App_Title=t.format(i,o.oAppCobranding.friendlyAppName)}switch(o.oAppCobranding&&o.oAppCobranding.signinDescription&&(e.WF_STR_Default_Desc=o.oAppCobrand

C:\Users\user\AppData\Local\Temp\~DF98D5E46384074168.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	13029
Entropy (8bit):	0.4824057117110077
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lob9lob9lWM93m0O:kBqoIcir0O
MD5:	A49EACACEB5933ACBE9DACB973DCA466
SHA1:	E96C8CFE5ADF55E63E55BA7B0972F0B949862DAF
SHA-256:	A7BA259D8D6BF2AADAB3174573743DCD470ECF379F5D30A68723EA88D52F0B57
SHA-512:	B19CBE942642D4EA3919D3E1AD655C6562FC3147ADE003388161D0AC8B6E2C4436460DC44633D7D4B980AFF6200BCE66840D0F7DB73C23B01D485C8316B73433
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFBB3A46FBF624C8E4.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	25441
Entropy (8bit):	0.3298637733618917
Encrypted:	false
SSDEEP:	24:c9lLh9lLh9lIn9lIn9lRx/9lRJ9lTb9lTb9lSSU9lSSU9laAa/9laAetJq6L+d06:kBqoxxJhHWSVSEabKL+
MD5:	9B9BEDE802150CA8C07545E5197EC327
SHA1:	ED40AC394931AEB4F7D5959F61A0E3053FB8050C
SHA-256:	BBEEE8D44AB69DFFE266C4F64358390201C4250CADF6D6D4C54D5673B7C2A604
SHA-512:	F48923E2C163BCFE3FC61E40F6534C5CED66FAEEE3D54E630655852424FBFDD3001DB000DA719111CA623BA90AF930E5B0D737D2A520686ACF43929343CD29FC
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Temp\~DFDB00A957EC34D917.TMP Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	57594
Entropy (8bit):	1.2456717187256212
Encrypted:	false
SSDEEP:	384:kBqoxKAuqR+lLpY7zQo+0hyrEW3SHPblugq0hyrEW3SHPblug5u5yEIx2iq:kyrE5HRugjyrE5HRugrgiq
MD5:	F4E79CAAED6A3A094A4D4B4A797ECE2C
SHA1:	768697FE488621432A4A7AE9C9897067C8026362
SHA-256:	CF4B13B84B06420A60BDD8A1945EFBCFD94A9067D07C167226AB9EBABE657B7C
SHA-512:	DCF22245011E6A0781DE609927B544324D7AD572E17C475651A704B2E91AA87CE3BEA4F4B6DD05942C889CAA8448628BF0A206B95C87F6B69D0B2A8B6B463D66
Malicious:	false
Reputation:	low
Preview:	.............................%..H..M..{y..+.0...(................... ...............................................%..H..M..{y..+.0...(................... ..........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Timestamp	Protocol	SID	Message	Source IP	Dest IP
04/20/21-08:47:53.648763	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:47:53.685488	ICMP	449	ICMP Time-To-Live Exceeded in Transit	84.17.52.126	192.168.2.6
04/20/21-08:47:53.689205	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:47:53.725529	ICMP	449	ICMP Time-To-Live Exceeded in Transit	5.56.20.161	192.168.2.6
04/20/21-08:47:53.725978	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:47:53.765105	ICMP	449	ICMP Time-To-Live Exceeded in Transit	91.206.52.152	192.168.2.6
04/20/21-08:47:53.765572	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:47:57.389973	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:01.477607	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:05.390565	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:09.391772	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:13.513651	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:17.391801	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:21.538364	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:25.385604	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50
04/20/21-08:48:29.399812	ICMP	384	ICMP PING	192.168.2.6	13.107.4.50

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2021 08:48:00.429680109 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.429872036 CEST	49693	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.496397018 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.496565104 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.496577978 CEST	80	49693	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.496742010 CEST	49693	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.498239994 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.563971996 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.564075947 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.564218998 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.622869968 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.689104080 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689169884 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689193964 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689218998 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689238071 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689255953 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689277887 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689295053 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689311028 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689311028 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.689323902 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.689344883 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.689352036 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.689522982 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.755768061 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755825996 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755853891 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755886078 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.755897045 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755917072 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.755925894 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755954981 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.755974054 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.755984068 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756002903 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756026030 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756048918 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756059885 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756128073 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756133080 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756165981 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756196976 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756217957 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756227016 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756251097 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756257057 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756283045 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756289959 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:00.756305933 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.756392956 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.773135900 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:00.879376888 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218358040 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218398094 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218415022 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218431950 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218449116 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218465090 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218461037 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218482018 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218498945 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218516111 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218518019 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218539000 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218550920 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218564034 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218575954 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218594074 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218605995 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218614101 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218631983 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218641996 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218647957 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218667030 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.218671083 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.218792915 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.284362078 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284404039 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284421921 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284442902 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284461975 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284483910 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284512997 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.284522057 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284540892 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284558058 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.284559011 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.284596920 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.284611940 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.309539080 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.375391006 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.379133940 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.379260063 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:01.720022917 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.720104933 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.760720015 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.760747910 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.760889053 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.760930061 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.774588108 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.774624109 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.815231085 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.815257072 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.817800045 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.817836046 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.817925930 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.819871902 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.819897890 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:01.819969893 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:01.822237968 CEST	80	49693	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:01.822601080 CEST	49693	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:02.360591888 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.361030102 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.361270905 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.401772022 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.401858091 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.401936054 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.401948929 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.402137041 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.402478933 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.402556896 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.426553965 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.426588058 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.426598072 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.426712990 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.426768064 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.427356005 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.427371979 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.427386045 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.427401066 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.427440882 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.427481890 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.433465958 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.433510065 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.433681011 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.462126017 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.504570007 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.611387014 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.611865044 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.652240038 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.652333021 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.652354956 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.652393103 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.652430058 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.652452946 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.652453899 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.652519941 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.653410912 CEST	49700	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:02.694091082 CEST	443	49700	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:02.950582981 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:03.017868996 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:03.018002033 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:03.282665968 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:03.325673103 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:03.361238003 CEST	443	49699	172.67.71.120	192.168.2.6
Apr 20, 2021 08:48:03.361341953 CEST	49699	443	192.168.2.6	172.67.71.120
Apr 20, 2021 08:48:13.022306919 CEST	80	49692	185.27.134.202	192.168.2.6
Apr 20, 2021 08:48:13.022459030 CEST	49692	80	192.168.2.6	185.27.134.202
Apr 20, 2021 08:48:26.723493099 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.724050999 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.777200937 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.777240992 CEST	443	49718	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.777409077 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.777419090 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.795262098 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.800353050 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.848160982 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.848223925 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.848294020 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.848366976 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.848445892 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.850671053 CEST	443	49718	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.850720882 CEST	443	49718	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.850764990 CEST	443	49718	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.850781918 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.850821972 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.850828886 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.868618965 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.871619940 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.872051001 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.920439959 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.920542955 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.922805071 CEST	443	49718	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.925355911 CEST	49718	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.938076019 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.938147068 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.938189983 CEST	443	49717	52.97.150.2	192.168.2.6
Apr 20, 2021 08:48:26.938208103 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.938236952 CEST	49717	443	192.168.2.6	52.97.150.2
Apr 20, 2021 08:48:26.938240051 CEST	49717	443	192.168.2.6	52.97.150.2

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Apr 20, 2021 08:47:50.443708897 CEST	61182	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:50.498104095 CEST	53	61182	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:51.368247986 CEST	55673	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:51.416958094 CEST	53	55673	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:52.120171070 CEST	57773	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:52.168874025 CEST	53	57773	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:53.078388929 CEST	59986	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:53.127057076 CEST	53	59986	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:53.578697920 CEST	52478	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:53.645463943 CEST	53	52478	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:54.069376945 CEST	58931	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:54.119632959 CEST	53	58931	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:54.836555958 CEST	57725	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:54.885102987 CEST	53	57725	8.8.8.8	192.168.2.6
Apr 20, 2021 08:47:59.149940968 CEST	49283	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:47:59.208779097 CEST	53	49283	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:00.363214970 CEST	58377	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:00.420486927 CEST	53	58377	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:00.430998087 CEST	55074	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:00.479643106 CEST	53	55074	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:01.316951036 CEST	54513	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:01.375726938 CEST	53	54513	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:01.543972015 CEST	62044	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:01.573914051 CEST	63791	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:01.592633009 CEST	53	62044	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:01.633994102 CEST	53	63791	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:04.123833895 CEST	64267	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:04.186122894 CEST	53	64267	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:05.050132990 CEST	49448	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:05.107021093 CEST	53	49448	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:05.871565104 CEST	60342	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:05.936193943 CEST	53	60342	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:06.675501108 CEST	61346	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:06.735151052 CEST	53	61346	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:08.974566936 CEST	51774	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:09.023154020 CEST	53	51774	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:09.916377068 CEST	56023	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:09.965167046 CEST	53	56023	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:10.839020014 CEST	58384	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:10.899349928 CEST	53	58384	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:11.802613974 CEST	60261	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:11.854285002 CEST	53	60261	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:17.033373117 CEST	56061	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:17.082123041 CEST	53	56061	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:17.357434034 CEST	58336	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:17.414567947 CEST	53	58336	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:19.353586912 CEST	53781	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:19.441696882 CEST	53	53781	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:19.939275980 CEST	54064	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:19.996546030 CEST	53	54064	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:20.726536989 CEST	52811	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:20.779936075 CEST	53	52811	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:26.668639898 CEST	55299	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:26.720536947 CEST	53	55299	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:26.826414108 CEST	63745	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:26.889110088 CEST	53	63745	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:26.966934919 CEST	50055	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:27.027462959 CEST	53	50055	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:29.125809908 CEST	61374	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:29.176094055 CEST	53	61374	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:29.888334036 CEST	50339	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:29.938807964 CEST	53	50339	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:30.134794950 CEST	61374	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:30.183763981 CEST	53	61374	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:30.900005102 CEST	50339	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:30.949870110 CEST	53	50339	8.8.8.8	192.168.2.6
Apr 20, 2021 08:48:31.150139093 CEST	61374	53	192.168.2.6	8.8.8.8
Apr 20, 2021 08:48:31.198836088 CEST	53	61374	8.8.8.8	192.168.2.6

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Apr 20, 2021 08:48:00.363214970 CEST	192.168.2.6	8.8.8.8	0x1785	Standard query (0)	sdfsdfsd.rf.gd	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.316951036 CEST	192.168.2.6	8.8.8.8	0x437c	Standard query (0)	secure.aadcdn.microsoftonline-p.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.543972015 CEST	192.168.2.6	8.8.8.8	0x809a	Standard query (0)	code.jquery.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.573914051 CEST	192.168.2.6	8.8.8.8	0x167a	Standard query (0)	infinityfree.net	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:17.357434034 CEST	192.168.2.6	8.8.8.8	0xae77	Standard query (0)	secure.aadcdn.microsoftonline-p.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:19.353586912 CEST	192.168.2.6	8.8.8.8	0xc663	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:19.939275980 CEST	192.168.2.6	8.8.8.8	0x704a	Standard query (0)	aadcdn.msauth.net	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:20.726536989 CEST	192.168.2.6	8.8.8.8	0x2ace	Standard query (0)	www.office.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.668639898 CEST	192.168.2.6	8.8.8.8	0x766	Standard query (0)	outlook.office365.com	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.966934919 CEST	192.168.2.6	8.8.8.8	0xcc45	Standard query (0)	r4.res.office365.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Apr 20, 2021 08:48:00.420486927 CEST	8.8.8.8	192.168.2.6	0x1785	No error (0)	sdfsdfsd.rf.gd		185.27.134.202	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.375726938 CEST	8.8.8.8	192.168.2.6	0x437c	No error (0)	secure.aadcdn.microsoftonline-p.com	secure.aadcdn.microsoftonline-p.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:01.592633009 CEST	8.8.8.8	192.168.2.6	0x809a	No error (0)	code.jquery.com	cds.s5x3j6q5.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:01.633994102 CEST	8.8.8.8	192.168.2.6	0x167a	No error (0)	infinityfree.net		172.67.71.120	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.633994102 CEST	8.8.8.8	192.168.2.6	0x167a	No error (0)	infinityfree.net		104.26.9.174	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:01.633994102 CEST	8.8.8.8	192.168.2.6	0x167a	No error (0)	infinityfree.net		104.26.8.174	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:17.414567947 CEST	8.8.8.8	192.168.2.6	0xae77	No error (0)	secure.aadcdn.microsoftonline-p.com	secure.aadcdn.microsoftonline-p.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:19.441696882 CEST	8.8.8.8	192.168.2.6	0xc663	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:19.441696882 CEST	8.8.8.8	192.168.2.6	0xc663	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:19.441696882 CEST	8.8.8.8	192.168.2.6	0xc663	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:19.996546030 CEST	8.8.8.8	192.168.2.6	0x704a	No error (0)	aadcdn.msauth.net	aadcdnoriginwus2.azureedge.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:20.779936075 CEST	8.8.8.8	192.168.2.6	0x2ace	No error (0)	www.office.com	home-portal.office.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:20.779936075 CEST	8.8.8.8	192.168.2.6	0x2ace	No error (0)	home-portal.office.com	home-office365-com.b-0004.b-msedge.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	outlook.office365.com	outlook.ha.office365.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	outlook.ha.office365.com	outlook.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	outlook.ms-acdc.office.com	HHN-efz.ms-acdc.office.com		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	HHN-efz.ms-acdc.office.com		52.97.150.2	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	HHN-efz.ms-acdc.office.com		52.98.152.194	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.2	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.720536947 CEST	8.8.8.8	192.168.2.6	0x766	No error (0)	HHN-efz.ms-acdc.office.com		52.97.233.82	A (IP address)	IN (0x0001)
Apr 20, 2021 08:48:26.889110088 CEST	8.8.8.8	192.168.2.6	0x47fa	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
Apr 20, 2021 08:48:27.027462959 CEST	8.8.8.8	192.168.2.6	0xcc45	No error (0)	r4.res.office365.com	r4.res.office365.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)

HTTP Request Dependency Graph

sdfsdfsd.rf.gd

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.6	49692	185.27.134.202	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Apr 20, 2021 08:48:00.498239994 CEST	230	OUT	GET /a.html HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sdfsdfsd.rf.gd Connection: Keep-Alive
Apr 20, 2021 08:48:00.564075947 CEST	231	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 20 Apr 2021 06:48:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Expires: Thu, 01 Jan 1970 00:00:01 GMT Cache-Control: no-cache Content-Encoding: gzip Data Raw: 32 32 61 0d 0a 1f 8b 08 00 00 00 00 00 00 03 4d 53 db 6e 9b 40 10 fd 95 d5 3e 44 20 13 6e 06 0c 86 75 14 b5 55 2f 6a fb 92 bc 45 51 b4 97 c1 90 10 96 ce 2e b1 ad 28 ff 5e c8 c5 b1 34 2f 73 e6 cc ec cc d1 d9 aa b1 8f dd a6 12 5a 1d 36 95 91 d8 0e 96 d8 c3 00 8c 5a d8 db e0 9e 3f f1 37 94 12 83 92 d1 80 83 f1 ef 0d 25 9b 2a 78 2b 7c b4 6d ea b1 97 b6 d5 3d b1 fa ef f8 28 00 8d a3 dc e7 27 8e 04 d8 cd 6d a9 7c 84 a1 e3 12 9c c0 f1 7d 37 d8 7a 1f 0d 33 0d fc 61 34 8d 33 70 34 f0 b3 b7 8e f2 a2 cc 75 5f dc 12 c1 8e d8 13 78 39 19 ff 03 f6 8e fb 5c 6b 74 e6 e9 6a 9a ee 29 16 31 c6 71 3b 3e 42 6f 8d df 41 bf b5 cd d9 d9 11 b9 09 6f 7d a9 7b 63 71 94 56 23 63 97 88 fc 70 71 5a 5f 1f 13 6f 3a 9f 7a 35 0b cb ba 52 ef b3 ca 7a b1 70 61 c1 9c 28 db a8 9b fa f6 82 86 74 4d a9 bb 98 13 df ea 2b 8b 6d bf 9d aa 9f 2b 4f e8 6f bd 03 fc c2 0d 38 ee cb bc 2b 67 9f e2 d0 3a 4b 53 c1 0b 15 16 3c 8a 62 95 14 59 2e b3 65 ba 2a 94 48 8b 50 24 d4 f5 c4 29 bf c8 97 49 22 63 00 c8 33 b9 2c 8a 24 2f c2 b4 88 d3 3c 15 49 51 e7 e1 c4 97 a7 fc 10 84 a8 57 51 9a 4b 58 c6 42 28 1e 47 59 52 24 42 88 22 5c 09 a5 a8 5b 2a 2d 5f 15 9b b4 d1 0f ed 74 f6 dd 9d 05 63 19 5d 58 3d ab 6c 3a bd bb fc 76 e5 2b 90 78 18 ac 23 bd d8 e3 9e 70 dd 05 2d 09 ec 87 16 c1 b0 eb 66 f4 c8 32 3a ff 0a f2 7c b9 22 f1 72 9d a6 53 90 ef 7f ae 4b 32 70 db b0 60 62 77 5a f2 d9 1e 7e 83 50 33 da 58 3b ac 83 c0 a8 fa 35 7c ac fd ad 0a b8 3f fb f1 a2 65 11 2d 3f 0d d6 eb 77 ab 5d 37 ad 21 a6 b5 40 10 fe 8d f3 e3 e4 d7 d1 a1 93 ef c8 4e e3 83 47 86 0e 26 c9 09 f4 5c 74 70 ca 68 7b 72 d0 23 12 81 7a 67 00 89 46 32 4e 44 7e 04 76 ad 6d 4e 1b cc 38 0c 1a 6d 15 1c 57 a8 82 b7 bf 12 bc 7e 9c ff 4f 2b 84 82 3f 03 00 00 0d 0a 30 0d 0a 0d 0a Data Ascii: 22aMSn@>D nuU/jEQ.(^4/sZ6Z?7%x+\|m=('m\|}7z3a43p4u_x9\ktj)1q;>BoAo}{cqV#cpqZ_o:z5Rzpa(tM+m+Oo8+g:KS<bY.eHP$)I"c3,$/<IQWQKXB(GYR$B"\[*-_tc]X=l:v+x#p-f2:\|"rSK2p`bwZ~P3X;5\|?e-?w]7!@NG&\tph{r#zgF2ND~vmN8mW~O+?0
Apr 20, 2021 08:48:00.622869968 CEST	232	OUT	GET /aes.js HTTP/1.1 Accept: application/javascript, /;q=0.8 Referer: http://sdfsdfsd.rf.gd/a.html Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sdfsdfsd.rf.gd Connection: Keep-Alive
Apr 20, 2021 08:48:00.689104080 CEST	234	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 20 Apr 2021 06:48:00 GMT Content-Type: application/javascript Content-Length: 31206 Last-Modified: Sat, 08 Aug 2015 08:12:26 GMT Connection: keep-alive ETag: "55c5b9ea-79e6" Accept-Ranges: bytes Data Raw: 2f 2a 0d 0a 20 2a 20 61 65 73 2e 6a 73 3a 20 69 6d 70 6c 65 6d 65 6e 74 73 20 41 45 53 20 2d 20 41 64 76 61 6e 63 65 64 20 45 6e 63 72 79 70 74 69 6f 6e 20 53 74 61 6e 64 61 72 64 0d 0a 20 2a 20 66 72 6f 6d 20 74 68 65 20 53 6c 6f 77 41 45 53 20 70 72 6f 6a 65 63 74 2c 20 68 74 74 70 3a 2f 2f 63 6f 64 65 2e 67 6f 6f 67 6c 65 2e 63 6f 6d 2f 70 2f 73 6c 6f 77 61 65 73 2f 0d 0a 20 2a 20 0d 0a 20 2a 20 43 6f 70 79 72 69 67 68 74 20 28 63 29 20 32 30 30 38 20 09 4a 6f 73 68 20 44 61 76 69 73 20 28 20 68 74 74 70 3a 2f 2f 77 77 77 2e 6a 6f 73 68 2d 64 61 76 69 73 2e 6f 72 67 20 29 2c 0d 0a 20 2a 09 09 09 09 09 09 4d 61 72 6b 20 50 65 72 63 69 76 61 6c 20 28 20 68 74 74 70 3a 2f 2f 6d 70 65 72 63 69 76 61 6c 2e 63 6f 6d 20 29 2c 0d 0a 20 2a 0d 0a 20 2a 20 50 6f 72 74 65 64 20 66 72 6f 6d 20 43 20 63 6f 64 65 20 77 72 69 74 74 65 6e 20 62 79 20 4c 61 75 72 65 6e 74 20 48 61 61 6e 20 28 20 68 74 74 70 3a 2f 2f 77 77 77 2e 70 72 6f 67 72 65 73 73 69 76 65 2d 63 6f 64 69 6e 67 2e 63 6f 6d 20 29 0d 0a 20 2a 20 0d 0a 20 2a 20 4c 69 63 65 6e 73 65 64 20 75 6e 64 65 72 20 74 68 65 20 41 70 61 63 68 65 20 4c 69 63 65 6e 73 65 2c 20 56 65 72 73 69 6f 6e 20 32 2e 30 0d 0a 20 2a 20 68 74 74 70 3a 2f 2f 77 77 77 2e 61 70 61 63 68 65 2e 6f 72 67 2f 6c 69 63 65 6e 73 65 73 2f 0d 0a 20 2a 2f 0d 0a 0d 0a 76 61 72 20 73 6c 6f 77 41 45 53 20 3d 20 7b 0d 0a 09 2f 2a 0d 0a 09 20 2a 20 53 54 41 52 54 20 41 45 53 20 53 45 43 54 49 4f 4e 0d 0a 09 20 2a 2f 0d 0a 09 61 65 73 3a 7b 0d 0a 09 09 2f 2f 20 73 74 72 75 63 74 75 72 65 20 6f 66 20 76 61 6c 69 64 20 6b 65 79 20 73 69 7a 65 73 0d 0a 09 09 6b 65 79 53 69 7a 65 3a 7b 0d 0a 09 09 09 53 49 5a 45 5f 31 32 38 3a 31 36 2c 0d 0a 09 09 09 53 49 5a 45 5f 31 39 32 3a 32 34 2c 0d 0a 09 09 09 53 49 5a 45 5f 32 35 36 3a 33 32 0d 0a 09 09 7d 2c 0d 0a 09 09 0d 0a 09 09 2f 2f 20 52 69 6a 6e 64 61 65 6c 20 53 2d 62 6f 78 0d 0a 09 09 73 62 6f 78 3a 5b 0d 0a 09 09 30 78 36 33 2c 20 30 78 37 63 2c 20 30 78 37 37 2c 20 30 78 37 62 2c 20 30 78 66 32 2c 20 30 78 36 62 2c 20 30 78 36 66 2c 20 30 78 63 35 2c 20 30 78 33 30 2c 20 30 78 30 31 2c 20 30 78 36 37 2c 20 30 78 32 62 2c 20 30 78 66 65 2c 20 30 78 64 37 2c 20 30 78 61 62 2c 20 30 78 37 36 2c 0d 0a 09 09 30 78 63 61 2c 20 30 78 38 32 2c 20 30 78 63 39 2c 20 30 78 37 64 2c 20 30 78 66 61 2c 20 30 78 35 39 2c 20 30 78 34 37 2c 20 30 78 66 30 2c 20 30 78 61 64 2c 20 30 78 64 34 2c 20 30 78 61 32 2c 20 30 78 61 66 2c 20 30 78 39 63 2c 20 30 78 61 34 2c 20 30 78 37 32 2c 20 30 78 63 30 2c 0d 0a 09 09 30 78 62 37 2c 20 30 78 66 64 2c 20 30 78 39 33 2c 20 30 78 32 36 2c 20 30 78 33 36 2c 20 30 78 33 66 2c 20 30 78 66 37 2c 20 30 78 63 63 2c 20 30 78 33 34 2c 20 30 78 61 35 2c 20 30 78 65 35 2c 20 30 78 66 31 2c 20 30 78 37 31 2c 20 30 78 64 38 2c 20 30 78 33 31 2c 20 30 78 31 35 2c 0d 0a 09 09 30 78 30 34 2c 20 30 78 63 37 2c 20 30 78 32 33 2c 20 30 78 63 33 2c 20 30 78 31 38 2c 20 30 78 39 36 2c 20 30 78 30 35 2c 20 30 78 39 61 2c 20 30 78 30 37 2c 20 30 78 31 32 2c 20 30 78 38 30 2c 20 30 78 65 32 2c 20 30 78 65 62 2c 20 30 78 32 37 2c 20 30 78 62 32 2c 20 30 78 37 35 2c 0d 0a 09 09 30 78 30 39 2c 20 30 78 38 33 2c 20 30 78 32 63 2c 20 30 78 31 61 2c 20 30 78 31 62 2c 20 30 78 36 65 2c 20 30 78 35 61 2c 20 30 78 61 30 2c 20 30 78 35 32 2c 20 30 78 33 62 2c 20 30 Data Ascii: /* * aes.js: implements AES - Advanced Encryption Standard * from the SlowAES project, http://code.google.com/p/slowaes/ * * Copyright (c) 2008 Josh Davis ( http://www.josh-davis.org ), Mark Percival ( http://mpercival.com ), * Ported from C code written by Laurent Haan ( http://www.progressive-coding.com ) * * Licensed under the Apache License, Version 2.0 * http://www.apache.org/licenses/ /var slowAES = {/ * START AES SECTION */aes:{// structure of valid key sizeskeySize:{SIZE_128:16,SIZE_192:24,SIZE_256:32},// Rijndael S-boxsbox:[0x63, 0x7c, 0x77, 0x7b, 0xf2, 0x6b, 0x6f, 0xc5, 0x30, 0x01, 0x67, 0x2b, 0xfe, 0xd7, 0xab, 0x76,0xca, 0x82, 0xc9, 0x7d, 0xfa, 0x59, 0x47, 0xf0, 0xad, 0xd4, 0xa2, 0xaf, 0x9c, 0xa4, 0x72, 0xc0,0xb7, 0xfd, 0x93, 0x26, 0x36, 0x3f, 0xf7, 0xcc, 0x34, 0xa5, 0xe5, 0xf1, 0x71, 0xd8, 0x31, 0x15,0x04, 0xc7, 0x23, 0xc3, 0x18, 0x96, 0x05, 0x9a, 0x07, 0x12, 0x80, 0xe2, 0xeb, 0x27, 0xb2, 0x75,0x09, 0x83, 0x2c, 0x1a, 0x1b, 0x6e, 0x5a, 0xa0, 0x52, 0x3b, 0
Apr 20, 2021 08:48:00.689169884 CEST	235	IN	Data Raw: 78 64 36 2c 20 30 78 62 33 2c 20 30 78 32 39 2c 20 30 78 65 33 2c 20 30 78 32 66 2c 20 30 78 38 34 2c 0d 0a 09 09 30 78 35 33 2c 20 30 78 64 31 2c 20 30 78 30 30 2c 20 30 78 65 64 2c 20 30 78 32 30 2c 20 30 78 66 63 2c 20 30 78 62 31 2c 20 30 78 Data Ascii: xd6, 0xb3, 0x29, 0xe3, 0x2f, 0x84,0x53, 0xd1, 0x00, 0xed, 0x20, 0xfc, 0xb1, 0x5b, 0x6a, 0xcb, 0xbe, 0x39, 0x4a, 0x4c, 0x58, 0xcf,0xd0, 0xef, 0xaa, 0xfb, 0x43, 0x4d, 0x33, 0x85, 0x45, 0xf9, 0x02, 0x7f, 0x50, 0x3c, 0x9f, 0xa8,0x51, 0
Apr 20, 2021 08:48:00.689193964 CEST	236	IN	Data Raw: 33 2c 20 30 78 34 34 2c 20 30 78 63 34 2c 20 30 78 64 65 2c 20 30 78 65 39 2c 20 30 78 63 62 0d 0a 09 09 2c 20 30 78 35 34 2c 20 30 78 37 62 2c 20 30 78 39 34 2c 20 30 78 33 32 2c 20 30 78 61 36 2c 20 30 78 63 32 2c 20 30 78 32 33 2c 20 30 78 33 Data Ascii: 3, 0x44, 0xc4, 0xde, 0xe9, 0xcb, 0x54, 0x7b, 0x94, 0x32, 0xa6, 0xc2, 0x23, 0x3d, 0xee, 0x4c, 0x95, 0x0b, 0x42, 0xfa, 0xc3, 0x4e, 0x08, 0x2e, 0xa1, 0x66, 0x28, 0xd9, 0x24, 0xb2, 0x76, 0x5b, 0xa2, 0x49, 0x6d, 0x8b, 0xd1, 0x25, 0x72,
Apr 20, 2021 08:48:00.689218998 CEST	238	IN	Data Raw: 78 31 37 2c 20 30 78 32 62 2c 20 30 78 30 34 2c 20 30 78 37 65 2c 20 30 78 62 61 2c 20 30 78 37 37 2c 20 30 78 64 36 2c 20 30 78 32 36 2c 20 30 78 65 31 2c 20 30 78 36 39 2c 20 30 78 31 34 2c 20 30 78 36 33 2c 20 30 78 35 35 2c 20 30 78 32 31 2c Data Ascii: x17, 0x2b, 0x04, 0x7e, 0xba, 0x77, 0xd6, 0x26, 0xe1, 0x69, 0x14, 0x63, 0x55, 0x21, 0x0c, 0x7d ],/* rotate the word eight bits to the left */rotate:function(word){var c = word[0];for (var i = 0; i < 3; i++)word[i
Apr 20, 2021 08:48:00.689238071 CEST	239	IN	Data Raw: 34 30 2c 20 30 78 38 30 2c 20 30 78 31 62 2c 20 30 78 33 36 2c 20 30 78 36 63 2c 20 30 78 64 38 2c 20 30 78 61 62 2c 20 30 78 34 64 2c 20 30 78 39 61 2c 0d 0a 09 09 30 78 32 66 2c 20 30 78 35 65 2c 20 30 78 62 63 2c 20 30 78 36 33 2c 20 30 78 63 Data Ascii: 40, 0x80, 0x1b, 0x36, 0x6c, 0xd8, 0xab, 0x4d, 0x9a,0x2f, 0x5e, 0xbc, 0x63, 0xc6, 0x97, 0x35, 0x6a, 0xd4, 0xb3, 0x7d, 0xfa, 0xef,0xc5, 0x91, 0x39, 0x72, 0xe4, 0xd3, 0xbd, 0x61, 0xc2, 0x9f, 0x25, 0x4a, 0x94,0x33, 0x66, 0xcc, 0x83, 0x
Apr 20, 2021 08:48:00.689255953 CEST	240	IN	Data Raw: 61 2c 20 30 78 65 63 2c 20 30 78 65 65 2c 0d 0a 09 09 30 78 66 30 2c 20 30 78 66 32 2c 20 30 78 66 34 2c 20 30 78 66 36 2c 20 30 78 66 38 2c 20 30 78 66 61 2c 20 30 78 66 63 2c 20 30 78 66 65 2c 20 30 78 31 62 2c 20 30 78 31 39 2c 20 30 78 31 66 Data Ascii: a, 0xec, 0xee,0xf0, 0xf2, 0xf4, 0xf6, 0xf8, 0xfa, 0xfc, 0xfe, 0x1b, 0x19, 0x1f, 0x1d,0x13, 0x11, 0x17, 0x15, 0x0b, 0x09, 0x0f, 0x0d, 0x03, 0x01, 0x07, 0x05,0x3b, 0x39, 0x3f, 0x3d, 0x33, 0x31, 0x37, 0x35, 0x2b, 0x29, 0x2f, 0x2d,
Apr 20, 2021 08:48:00.689277887 CEST	242	IN	Data Raw: 78 64 38 2c 20 30 78 64 62 2c 20 30 78 64 65 2c 20 30 78 64 64 2c 20 30 78 64 34 2c 20 30 78 64 37 2c 20 30 78 64 32 2c 20 30 78 64 31 2c 20 30 78 66 30 2c 20 30 78 66 33 2c 20 30 78 66 36 2c 20 30 78 66 35 2c 0d 0a 09 09 30 78 66 63 2c 20 30 78 Data Ascii: xd8, 0xdb, 0xde, 0xdd, 0xd4, 0xd7, 0xd2, 0xd1, 0xf0, 0xf3, 0xf6, 0xf5,0xfc, 0xff, 0xfa, 0xf9, 0xe8, 0xeb, 0xee, 0xed, 0xe4, 0xe7, 0xe2, 0xe1,0xa0, 0xa3, 0xa6, 0xa5, 0xac, 0xaf, 0xaa, 0xa9, 0xb8, 0xbb, 0xbe, 0xbd,0xb4, 0xb7, 0xb2, 0
Apr 20, 2021 08:48:00.689295053 CEST	243	IN	Data Raw: 63 33 2c 20 30 78 66 63 2c 20 30 78 66 35 2c 20 30 78 65 65 2c 20 30 78 65 37 2c 20 30 78 33 62 2c 20 30 78 33 32 2c 20 30 78 32 39 2c 20 30 78 32 30 2c 0d 0a 09 09 30 78 31 66 2c 20 30 78 31 36 2c 20 30 78 30 64 2c 20 30 78 30 34 2c 20 30 78 37 Data Ascii: c3, 0xfc, 0xf5, 0xee, 0xe7, 0x3b, 0x32, 0x29, 0x20,0x1f, 0x16, 0x0d, 0x04, 0x73, 0x7a, 0x61, 0x68, 0x57, 0x5e, 0x45, 0x4c,0xab, 0xa2, 0xb9, 0xb0, 0x8f, 0x86, 0x9d, 0x94, 0xe3, 0xea, 0xf1, 0xf8,0xc7, 0xce, 0xd5, 0xdc, 0x76, 0x7f, 0x
Apr 20, 2021 08:48:00.689311028 CEST	244	IN	Data Raw: 33 38 2c 20 30 78 32 33 2c 20 30 78 32 61 2c 20 30 78 31 35 2c 20 30 78 31 63 2c 20 30 78 30 37 2c 20 30 78 30 65 2c 20 30 78 37 39 2c 20 30 78 37 30 2c 20 30 78 36 62 2c 20 30 78 36 32 2c 0d 0a 09 09 30 78 35 64 2c 20 30 78 35 34 2c 20 30 78 34 Data Ascii: 38, 0x23, 0x2a, 0x15, 0x1c, 0x07, 0x0e, 0x79, 0x70, 0x6b, 0x62,0x5d, 0x54, 0x4f, 0x46],GBX: [0x00, 0x0b, 0x16, 0x1d, 0x2c, 0x27, 0x3a, 0x31, 0x58, 0x53, 0x4e, 0x45,0x74, 0x7f, 0x62, 0x69, 0xb0, 0xbb, 0xa6, 0xad, 0x9c, 0x9
Apr 20, 2021 08:48:00.689323902 CEST	246	IN	Data Raw: 64 2c 20 30 78 32 36 2c 20 30 78 33 62 2c 20 30 78 33 30 2c 20 30 78 35 39 2c 20 30 78 35 32 2c 20 30 78 34 66 2c 20 30 78 34 34 2c 0d 0a 09 09 30 78 37 35 2c 20 30 78 37 65 2c 20 30 78 36 33 2c 20 30 78 36 38 2c 20 30 78 62 31 2c 20 30 78 62 61 Data Ascii: d, 0x26, 0x3b, 0x30, 0x59, 0x52, 0x4f, 0x44,0x75, 0x7e, 0x63, 0x68, 0xb1, 0xba, 0xa7, 0xac, 0x9d, 0x96, 0x8b, 0x80,0xe9, 0xe2, 0xff, 0xf4, 0xc5, 0xce, 0xd3, 0xd8, 0x7a, 0x71, 0x6c, 0x67,0x56, 0x5d, 0x40, 0x4b, 0x22, 0x29, 0x34, 0x3
Apr 20, 2021 08:48:00.755768061 CEST	247	IN	Data Raw: 2c 20 30 78 36 32 2c 20 30 78 36 66 2c 20 30 78 37 38 2c 20 30 78 37 35 2c 0d 0a 09 09 30 78 35 36 2c 20 30 78 35 62 2c 20 30 78 34 63 2c 20 30 78 34 31 2c 20 30 78 36 31 2c 20 30 78 36 63 2c 20 30 78 37 62 2c 20 30 78 37 36 2c 20 30 78 35 35 2c Data Ascii: , 0x62, 0x6f, 0x78, 0x75,0x56, 0x5b, 0x4c, 0x41, 0x61, 0x6c, 0x7b, 0x76, 0x55, 0x58, 0x4f, 0x42,0x09, 0x04, 0x13, 0x1e, 0x3d, 0x30, 0x27, 0x2a, 0xb1, 0xbc, 0xab, 0xa6,0x85, 0x88, 0x9f, 0x92, 0xd9, 0xd4, 0xc3, 0xce, 0xed, 0xe0, 0xf7
Apr 20, 2021 08:48:00.773135900 CEST	265	OUT	GET /a.html?i=1 HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Referer: http://sdfsdfsd.rf.gd/a.html Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sdfsdfsd.rf.gd Connection: Keep-Alive Cookie: __test=0c169eb4baa09ef03237782f3958f19a
Apr 20, 2021 08:48:01.218358040 CEST	277	IN	HTTP/1.1 200 OK Server: nginx Date: Tue, 20 Apr 2021 06:48:00 GMT Content-Type: text/html Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding Last-Modified: Sun, 18 Apr 2021 20:18:50 GMT Cache-Control: max-age=2592000, public, proxy-revalidate, public, proxy-revalidate Expires: Thu, 20 May 2021 06:48:00 GMT Content-Encoding: gzip Data Raw: 37 30 30 30 0d 0a 1f 8b 08 00 00 00 00 00 00 03 ec bd 69 96 e3 46 b2 2e f8 ff 9e 73 f7 80 1b 7a f5 94 ba 25 52 41 32 e6 aa d4 ad 9c e7 41 19 39 48 a9 d6 c9 03 92 20 89 4c 92 a0 08 30 86 ac 77 cf e9 6d f4 5a fa 47 ef a5 37 d0 5b 68 33 1f 00 87 bb f9 c4 88 94 54 f5 4a 51 25 45 00 8e cf 27 9b dc dc dc fc ff fb bf ff 9f 7f ff b7 bf ce aa c5 3c 19 e7 eb 9b 3b f3 6a bd 93 8c e6 69 59 de dc 99 ae 3f 7c 98 17 d3 7c f9 61 91 8f d6 45 59 4c aa 62 39 cf 97 d9 87 51 b1 d8 49 e6 e9 72 7a 73 27 5b ee 7c ff ef ff 86 18 59 3a 86 df 12 f8 e7 af 8b ac 4a 93 59 55 ad 3a d9 af 9b fc ec e6 ce 9d 62 59 65 cb aa f3 fa 72 95 01 3e ff eb e6 4e 95 5d 54 df 61 e5 7f 49 46 b3 74 5d 66 d5 cd 37 af ef 77 8e 10 92 01 55 79 35 cf be 3f cd a7 cb 24 5f 26 55 91 5c 16 9b 75 92 8e 46 c5 66 59 fd f5 3b fe 1a ab a7 ab fd b1 f3 e6 56 e7 4e b1 58 a5 55 3e 9c ab 35 3f ba 77 33 1b 4f b3 ba 22 d6 e2 65 ba c8 6e ee 9c e5 d9 f9 aa 58 57 4a 3b cf f3 71 35 bb 39 ce ce f2 51 d6 61 7f 7c 0b ed c9 ab 3c 9d 77 ca 51 3a cf 6e f6 ba bb df 26 8b f4 22 5f 6c 16 e2 51 1f 1f 6d ca 6c cd fe 4e a1 fe 9b 97 59 d9 ae 51 1d a3 97 eb 74 ba 48 95 5a 97 45 67 94 8e 66 5a 23 d5 4f ee 5d ac f2 35 60 36 23 da e9 51 5d 7a 99 4e b3 47 77 95 62 30 1f 67 d9 7a 9a 8d 71 68 1f b1 29 6c 46 90 0f c3 69 5e b5 bf a1 0a bd ca 7e 7d 7a 47 c1 ed ed 0e 06 54 b9 a7 c5 a8 55 2e 5b 76 de 9c 72 c2 61 f5 2e 8b 72 b4 ce 57 95 68 07 3d 9b af b2 09 74 76 a6 54 b7 fb 97 e4 cd ab a7 37 71 48 ca 93 ef be 63 c4 da d5 88 b5 0b c4 fa dd c7 72 9c 97 38 05 e3 9d e4 3b d9 d9 ef 94 5a 45 ff cb ea 72 9e 25 15 50 a9 20 ce 51 59 cf 18 36 8a 31 ca df 79 61 fc 1b ff 99 00 35 77 26 e9 22 9f 5f 9e 24 65 ba 2c 3b 30 e7 f9 e4 2f ed 52 9d 45 d9 41 72 ef 94 f9 e7 ac 93 8e 3f 6e ca ea 24 e9 ed ee fe 49 2f 78 9e 0d 3f e5 95 a5 70 03 fa df cd af cd 6f c3 62 7c a9 b7 6f 91 ae 61 58 4e 92 5d cf b7 e9 ba ca 47 f3 ec db a6 58 5a e6 63 f5 ef 31 30 49 3e 2f 95 12 93 7c 3a 4a 57 55 5e 2c db 0f 37 6b f5 bb 49 51 54 d9 5a 29 81 b2 a2 fd 60 ba 2e 36 2b a5 c4 22 cd 55 c8 45 b6 dc 28 6f 97 e9 99 f2 57 99 8d b4 16 94 9b 05 f4 da 18 09 a0 81 d5 3c 85 59 1a ce 8b d1 27 df 70 6c c6 79 a1 d4 32 4a 97 67 a9 da f7 d5 ba 98 02 3d aa 8f ce 60 bc 0a 7d fc eb 5a 73 26 3c 3b ac 72 6d d2 81 19 61 f0 41 9a a4 73 60 48 68 60 5a 66 58 38 a4 8d 27 cb a2 ba f1 33 ca d4 75 31 2f 7f f9 c6 5a ff b2 58 66 5a bd b3 2c 9f ce 80 0e 7d b4 f1 f3 2c 1f 8f b3 e5 2f ca 78 54 d9 02 06 b3 ca 9c d5 f9 da af 7f 3c 4c 47 9f 90 14 96 e3 ce a8 98 17 eb 93 a4 5a 03 47 ad d2 35 68 0f 1f d8 49 0a 74 70 d6 22 e0 93 59 01 43 ab d7 52 6c 2a 1c 5c 7f b7 d3 e1 70 fd 33 53 32 bf e8 18 c3 62 0d 24 dc 19 16 55 55 2c 80 91 57 17 c9 18 7e cf c6 9e 56 0e 55 c2 85 19 5b 4e 75 64 26 4f ce c5 c4 0c 8b b9 0f 71 3c 59 92 10 4c 96 9d 24 79 05 34 35 f2 b4 6a d6 a3 21 40 56 9d 24 fd 6c a1 91 8d 14 29 dd 83 c3 6c e1 25 1e 28 fd 49 87 6f 26 fa 24 f9 6a 32 d9 d5 2a 10 93 ff d5 ee ae 8f 32 cb 45 3a a7 45 32 0a da 93 e4 68 f7 4f 9e be 97 9b d6 9c 6c 56 Data Ascii: 7000iF.sz%RA2A9H L0wmZG7[h3TJQ%E'<;jiY?\|\|aEYLb9QIrzs'[\|Y:JYU:bYer>N]TaIFt]f7wUy5?$_&U\uFfY;VNXU>5?w3O"enXWJ;q59Qa\|<wQ:n&"_lQmlNYQtHZEgfZ#O]5`6#Q]zNGwb0gzqh)lFi^~}zGTU.[vra.rWh=tvT7qHcr8;ZEr%P QY61ya5w&"_$e,;0/REAr?n$I/x?pob\|oaXN]GXZc10I>/\|:JWU^,7kIQTZ)`.6+"UE(oW<Y'ply2Jg=`}Zs&<;rmaAs`Hh`ZfX8'3u1/ZXfZ,},/xT<LGZG5hItp"YCRl\p3S2b$UU,W~VU[Nud&Oq<YL$y45j!@V$l)l%(Io&$j22E:E2hOlV
Apr 20, 2021 08:48:01.309539080 CEST	311	OUT	GET /Sign%20in%20to%20your%20account_files/ellipsis_grey.svg HTTP/1.1 Accept: image/png, image/svg+xml, image/jxr, image/;q=0.8, /*;q=0.5 Referer: http://sdfsdfsd.rf.gd/a.html?i=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sdfsdfsd.rf.gd Connection: Keep-Alive Cookie: __test=0c169eb4baa09ef03237782f3958f19a
Apr 20, 2021 08:48:01.379133940 CEST	312	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 20 Apr 2021 06:48:00 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 220 Connection: keep-alive Location: https://infinityfree.net/errors/404/ Cache-Control: max-age=0 Expires: Tue, 20 Apr 2021 06:48:00 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 66 69 6e 69 74 79 66 72 65 65 2e 6e 65 74 2f 65 72 72 6f 72 73 2f 34 30 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://infinityfree.net/errors/404/">here</a>.</p></body></html>
Apr 20, 2021 08:48:02.950582981 CEST	359	OUT	GET /Sign%20in%20to%20your%20account_files/prefetch(1).html HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Referer: http://sdfsdfsd.rf.gd/a.html?i=1 Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: sdfsdfsd.rf.gd Connection: Keep-Alive Cookie: __test=0c169eb4baa09ef03237782f3958f19a
Apr 20, 2021 08:48:03.017868996 CEST	361	IN	HTTP/1.1 302 Found Server: nginx Date: Tue, 20 Apr 2021 06:48:02 GMT Content-Type: text/html; charset=iso-8859-1 Content-Length: 220 Connection: keep-alive Location: https://infinityfree.net/errors/404/ Cache-Control: max-age=0 Expires: Tue, 20 Apr 2021 06:48:02 GMT Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 33 30 32 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 64 6f 63 75 6d 65 6e 74 20 68 61 73 20 6d 6f 76 65 64 20 3c 61 20 68 72 65 66 3d 22 68 74 74 70 73 3a 2f 2f 69 6e 66 69 6e 69 74 79 66 72 65 65 2e 6e 65 74 2f 65 72 72 6f 72 73 2f 34 30 34 2f 22 3e 68 65 72 65 3c 2f 61 3e 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>302 Found</title></head><body><h1>Found</h1><p>The document has moved <a href="https://infinityfree.net/errors/404/">here</a>.</p></body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Apr 20, 2021 08:48:01.817836046 CEST	172.67.71.120	443	192.168.2.6	49699	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Jul 17 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Jul 17 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 20, 2021 08:48:01.817836046 CEST	172.67.71.120	443	192.168.2.6	49699	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Apr 20, 2021 08:48:01.819897890 CEST	172.67.71.120	443	192.168.2.6	49700	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Fri Jul 17 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sat Jul 17 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Apr 20, 2021 08:48:01.819897890 CEST	172.67.71.120	443	192.168.2.6	49700	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

CPU Usage

Click to jump to process

Memory Usage

Click to jump to process

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 5084 Parent PID: 792

General

Start time:	08:47:58
Start date:	20/04/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff721e20000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: iexplore.exe PID: 4004 Parent PID: 5084

General

Start time:	08:47:59
Start date:	20/04/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:5084 CREDAT:17410 /prefetch:2
Imagebase:	0xc40000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Analysis Process: TokenBrokerCookies.exe PID: 724 Parent PID: 5084

General

Start time:	08:48:26
Start date:	20/04/2021
Path:	C:\Windows\System32\TokenBrokerCookies.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9_5ANWf-fGJYB0lKPxUxeOHCAL7I4A-ba_FNDqQv_JO3Mw9pepFbhN1iNWymZR3aI9wlheSDHZMfF4vtqGzrUsgAA&rid=df2d3395-2703-456c-8312-45fefda06900 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -341400335 30884092 1
Imagebase:	0x7ff65ad50000
File size:	35840 bytes
MD5 hash:	17F27A76AC8E9869C8F1BE286D88570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Chronological Activities

Disassembly

Code Analysis

Reset < >

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, Email gateway, Environment variable, File monitoring, Malware reverse engineering, Network intrusion detection system, Network protocol analysis, Process command-line parameters, Process monitoring, Process use of network, SSL/TLS inspection, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report http://sdfsdfsd.rf.gd/a.html

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Dropped Files

Sigma Overview

Signature Overview

AV Detection:

Phishing:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Snort IDS Alerts

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

CPU Usage

Memory Usage

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 5084 Parent PID: 792

General

Chronological Activities

Analysis Process: iexplore.exe PID: 4004 Parent PID: 5084

General

Chronological Activities

Analysis Process: TokenBrokerCookies.exe PID: 724 Parent PID: 5084

General

Chronological Activities