Create Interactive Tour

Analysis Report https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9

Overview

General Information

Sample URL:	https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9
Analysis ID:	416137
Infos:
Most interesting Screenshot:

Detection

Score:	48
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

HTML body contains low number of good links

HTML title does not match URL

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

Potential browser exploit detected (process start blacklist hit)

Very long cmdline option found, this is very uncommon (may be encrypted or packed)

Classification

Startup

System is w10x64

iexplore.exe (PID: 256 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 3488 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

TokenBrokerCookies.exe (PID: 1932 cmdline: C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1 MD5: 17F27A76AC8E9869C8F1BE286D88570A)

iexplore.exe (PID: 6148 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:82962 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

dllhost.exe (PID: 4092 cmdline: C:\Windows\system32\DllHost.exe /Processid:{49F171DD-B51A-40D3-9A6C-52D674CC729D} MD5: 2528137C6745C4EADD87817A1909677E)

explorer.exe (PID: 3388 cmdline: MD5: AD5296B280E8F522A8A897C96BAB0E1D)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• AV Detection
• Phishing
• Compliance
• Software Vulnerabilities
• Networking
• System Summary
• Hooking and other Techniques for Hiding and Protection
• Malware Analysis System Evasion
• HIPS / PFW / Operating System Protection Evasion

Click to jump to signature section

Show All Signature Results

AV Detection:

Antivirus / Scanner detection for submitted sample

Show sources

Source: https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9

Avira URL Cloud: detection malicious, Label: phishing

Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: Number of links: 0
Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: Number of links: 0

Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: Title: Sign in to your account does not match URL
Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: Title: Sign in to your account does not match URL

Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: No <meta name="author".. found
Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: No <meta name="author".. found

Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: No <meta name="copyright".. found
Source: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00000003-0000-0ff1-ce00-000000000000&response_mode=form_post&protectedtoken=true&response_type=code%20id_token&resource=00000003-0000-0ff1-ce00-000000000000&scope=openid&nonce=FD9D7FC71CAB075CDEBEBFE1FE928E000A0C5D884EC57EC6-EAF5139421F37C777689693B296B42AAB6098F76B97BC00D9604CDD590956084&redirect_uri=https%3A%2F%2Frafihautogroup-my.sharepoint.com%2F_forms%2Fdefault.aspx&claims=%7B%22id_token%22%3A%7B%22xms_cc%22%3A%7B%22values%22%3A%5B%22CP1%22%5D%7D%7D%7D&wsucxt=1&cobrandid=11bd8083-87e0-41b5-bb78-0bc43c8a8e8a&client-request-id=58e1c89f-e041-c000-0799-4e2defb8f389	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.3:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.209.78:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.209.78:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.3:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.31.176.223:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.31.176.223:443 -> 192.168.2.3:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.203.205.32:443 -> 192.168.2.3:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.29.132.144:443 -> 192.168.2.3:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.29.132.144:443 -> 192.168.2.3:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.33.220.242:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.33.220.242:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.3:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.195:443 -> 192.168.2.3:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.195:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.111.131:443 -> 192.168.2.3:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.111.131:443 -> 192.168.2.3:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.82.100.182:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.82.100.182:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.13.5:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.13.5:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.213.168.74:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.99:443 -> 192.168.2.3:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.99:443 -> 192.168.2.3:49873 version: TLS 1.2

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000000C.00000002.488223499.0000000006560000.00000002.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 0000000C.00000002.488223499.0000000006560000.00000002.00000001.sdmp

Source: C:\Program Files\internet explorer\iexplore.exe

Process created: C:\Windows\System32\TokenBrokerCookies.exe

Source: de-ch[1].htm.18.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/85288795/coreui.statics/images/social/facebook.png" alt="Facebook"> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/93690392/coreui.statics/images/social/twitter.png" alt="Twitter"> equals www.twitter.com (Twitter)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/b23f9ba2/coreui.statics/images/social/linkedin.png" alt="LinkedIn"> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <img src="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/c79952ca/coreui.statics/images/social/youtube.png" alt="Youtube"> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/2532198d/coreui.statics/images/social/facebook.svg"> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/2d505657/coreui.statics/images/social/youtube.svg"> equals www.youtube.com (Youtube)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/413bd4a8/coreui.statics/images/social/linkedin.svg"> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <source type="image/svg+xml" srcset="//www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/6f40299c/coreui.statics/images/social/twitter.svg"> equals www.twitter.com (Twitter)
Source: surface[1].htm.18.dr	String found in binary or memory: </li>--><li><a href="" class="c-hyperlink f-image " target="_self" aria-label=""><picture></picture><span></span></a></li><li><a href="https://www.microsoft.com/en-us/surface/newsletter-subscription" class="c-hyperlink f-image surfacenewsletter" target="_self" aria-label="Select this link to Sign up for Surface Newsletter"><picture><img src="https://c.s-microsoft.com/en-us/CMSImages/newsletter-icon.svg?version=26094b8a-2cfc-fa19-5dfa-4a6913af6eb5" class="mscom-image" alt="" /></picture><span>Get the Surface newsletter</span></a></li><li><a href="https://support.microsoft.com/help/4040585" class="c-hyperlink f-image " target="_self" aria-label="Select this link to learn about the Surface Power Cord Recall"><picture><img src="https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon_PowerCord.svg?version=3d41ef0f-fcff-4126-0dfc-499e388476b3" class="mscom-image" alt="" /></picture><span>Power cord recall</span></a></li><li><a href="" class="c-hyperlink f-image " aria-label=""><picture></picture><span></span></a></li></ul></nav><hr class="c-divider" /></div></div></section><section role="region" aria-label="Footnotes: Disclaimers" data-vg="Surface_Home_Lg_Footnotes_VG" class="surface-section-footnotes"><div data-grid="container"><div data-grid="col-12"><p class="c-caption-2"><a aria-label="Return to footnote * referrer" href="javascript:void(0)" class="c-hyperlink supLink"><strong class="supFn">*</strong></a> Some accessories and software sold separately. See individual product pages for details.</p></div><span style="display:none;" id="ss-footnote-text">Footnote</span></div></section></div><section class="surface-lightbox-VideoPopup" data-pf="Surface_LightBox_Popup_Video_PageFragment"><div class="c-dialog f-lightbox" id="surface-lightbox-preview" aria-hidden="true"><div role="presentation" data-js-dialog-hide="data-js-dialog-hide" tabindex="-1"></div><div class="c-glyph glyph-cancel" data-js-dialog-hide="data-js-dialog-hide" aria-label="Close dialog" tabindex="0"></div><div role="dialog" aria-label="Lightbox" tabindex="-1"><div role="document" tabindex="1"><a target="_blank"><div itemscope="" id="videoPlayer" class="c-video" itemtype="http://schema.org/VideoObject" data-title="video player"><span aria-hidden="true" itemprop="name"></span><span aria-hidden="true" itemprop="description"></span><img src="" alt="" aria-hidden="true" itemprop="thumbnailUrl" /><meta content="" itemprop="uploadDate" /><div video-id="" id="popup-playercontainer" class="PopUpPlayerAPI"></div></div></a></div></div></div></section></main><section data-grid="container" role="region" aria-label="Social Media Channels" class="surface-social-share"><div data-grid="col-12"><div data-grid="col-6"><div itemscope="" class="m-social f-horizontal f-follow" itemtype="http://schema.org/Organization"><h2 class="sfc-socialshare">Follow this page</h2><ul><li><a itemprop="sameAs" href="http://www.facebook.com/Surface" aria-label="Follow this page on Facebook" title="Follow thi
Source: surface[1].htm.18.dr	String found in binary or memory: </li>--><li><a href="" class="c-hyperlink f-image " target="_self" aria-label=""><picture></picture><span></span></a></li><li><a href="https://www.microsoft.com/en-us/surface/newsletter-subscription" class="c-hyperlink f-image surfacenewsletter" target="_self" aria-label="Select this link to Sign up for Surface Newsletter"><picture><img src="https://c.s-microsoft.com/en-us/CMSImages/newsletter-icon.svg?version=26094b8a-2cfc-fa19-5dfa-4a6913af6eb5" class="mscom-image" alt="" /></picture><span>Get the Surface newsletter</span></a></li><li><a href="https://support.microsoft.com/help/4040585" class="c-hyperlink f-image " target="_self" aria-label="Select this link to learn about the Surface Power Cord Recall"><picture><img src="https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon_PowerCord.svg?version=3d41ef0f-fcff-4126-0dfc-499e388476b3" class="mscom-image" alt="" /></picture><span>Power cord recall</span></a></li><li><a href="" class="c-hyperlink f-image " aria-label=""><picture></picture><span></span></a></li></ul></nav><hr class="c-divider" /></div></div></section><section role="region" aria-label="Footnotes: Disclaimers" data-vg="Surface_Home_Lg_Footnotes_VG" class="surface-section-footnotes"><div data-grid="container"><div data-grid="col-12"><p class="c-caption-2"><a aria-label="Return to footnote * referrer" href="javascript:void(0)" class="c-hyperlink supLink"><strong class="supFn">*</strong></a> Some accessories and software sold separately. See individual product pages for details.</p></div><span style="display:none;" id="ss-footnote-text">Footnote</span></div></section></div><section class="surface-lightbox-VideoPopup" data-pf="Surface_LightBox_Popup_Video_PageFragment"><div class="c-dialog f-lightbox" id="surface-lightbox-preview" aria-hidden="true"><div role="presentation" data-js-dialog-hide="data-js-dialog-hide" tabindex="-1"></div><div class="c-glyph glyph-cancel" data-js-dialog-hide="data-js-dialog-hide" aria-label="Close dialog" tabindex="0"></div><div role="dialog" aria-label="Lightbox" tabindex="-1"><div role="document" tabindex="1"><a target="_blank"><div itemscope="" id="videoPlayer" class="c-video" itemtype="http://schema.org/VideoObject" data-title="video player"><span aria-hidden="true" itemprop="name"></span><span aria-hidden="true" itemprop="description"></span><img src="" alt="" aria-hidden="true" itemprop="thumbnailUrl" /><meta content="" itemprop="uploadDate" /><div video-id="" id="popup-playercontainer" class="PopUpPlayerAPI"></div></div></a></div></div></div></section></main><section data-grid="container" role="region" aria-label="Social Media Channels" class="surface-social-share"><div data-grid="col-12"><div data-grid="col-6"><div itemscope="" class="m-social f-horizontal f-follow" itemtype="http://schema.org/Organization"><h2 class="sfc-socialshare">Follow this page</h2><ul><li><a itemprop="sameAs" href="http://www.facebook.com/Surface" aria-label="Follow this page on Facebook" title="Follow thi
Source: de-ch[1].htm.18.dr	String found in binary or memory: <a data-m='{"id":"n1m1r6a2","sN":1,"aN":"m1r6a2"}' itemprop="sameAs" href="https://www.facebook.com/microsoftschweiz" title="Microsoft auf Facebook folgen (öffnet in einem neuen Tab)." target="_blank"> equals www.facebook.com (Facebook)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <a data-m='{"id":"n3m1r6a2","sN":3,"aN":"m1r6a2"}' itemprop="sameAs" href="https://www.linkedin.com/company/1035" title="Microsoft auf LinkedIn folgen (öffnet in einem neuen Tab)." target="_blank"> equals www.linkedin.com (Linkedin)
Source: de-ch[1].htm.18.dr	String found in binary or memory: <a data-m='{"id":"n4m1r6a2","sN":4,"aN":"m1r6a2"}' itemprop="sameAs" href="https://www.youtube.com/user/MicrosoftCH" title="Microsoft auf YouTube folgen (öffnet in einem neuen Tab)." target="_blank"> equals www.youtube.com (Youtube)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.facebook.com/favicon.ico</FavoriteIcon> equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.myspace.com/favicon.ico</FavoriteIcon> equals www.myspace.com (Myspace)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: <FavoriteIcon>http://www.rambler.ru/favicon.ico</FavoriteIcon> equals www.rambler.ru (Rambler)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.facebook.com/</URL> equals www.facebook.com (Facebook)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: <URL>http://www.rambler.ru/</URL> equals www.rambler.ru (Rambler)

Source: unknown

DNS traffic detected: queries for: rafihautogroup-my.sharepoint.com

Source: iexplore.exe, 00000001.00000002.472786376.000001E166D00000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263399820.000000000E1C0000.00000002.00000001.sdmp	String found in binary or memory: http://%s.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://amazon.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ariadna.elmundo.es/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://arianna.libero.it/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://asp.usatoday.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://auone.jp/favicon.ico
Source: iexplore.exe, 00000001.00000002.472786376.000001E166D00000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263399820.000000000E1C0000.00000002.00000001.sdmp	String found in binary or memory: http://auto.search.msn.com/response.asp?MT=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://br.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://browse.guardian.co.uk/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.buscape.com.br/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.estadao.com.br/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.igbusca.com.br//app/static/images/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.orange.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busca.uol.com.br/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.lycos.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscador.terra.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ozu.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://buscar.ya.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://busqueda.aol.com.mx/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://cerca.lycos.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://cgi.search.biglobe.ne.jp/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://clients5.google.com/complete/search?hl=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://cnet.search.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://cnweb.search.live.com/results.aspx?q=
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://code.jquery.com/jquery-3.1.1.js)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://corp.naukri.com/favicon.ico
Source: explorer.exe, 0000000C.00000000.263910722.000000000F5C0000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: en[1].htm0.18.dr	String found in binary or memory: http://data.surrey.ca/pages/open-government-licence-surrey
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://de.search.yahoo.com/
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://demo.nimius.net/debounce_throttle/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://es.ask.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://es.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://esearch.rakuten.co.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://espanol.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://espn.go.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://find.joins.com/
Source: icons[1].eot.18.dr	String found in binary or memory: http://fontello.com
Source: icons[1].eot.18.dr	String found in binary or memory: http://fontello.comiconsRegulariconsiconsVersion
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://fr.search.yahoo.com/
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/118023??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148322??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148324??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148325??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148326??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148327??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148328??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148329??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148331??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148334??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148336??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148338??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148340??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148341??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148343??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148346??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148348??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148439??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148440??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148441??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148442??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148590??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148633??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148725??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148750??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148869??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148870??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148871??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148884??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148886??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: en[1].htm0.18.dr	String found in binary or memory: http://g.live.com/0HE_TRACKSTAR_ENUS9/148898??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003
Source: de-ch[1].htm.18.dr	String found in binary or memory: http://github.com/aFarkas/lazysizes
Source: f5-7e27a5[1].js.18.dr	String found in binary or memory: http://github.com/requirejs/almond/LICENSE
Source: de-ch[1].htm.18.dr	String found in binary or memory: http://github.com/requirejs/domReady
Source: de-ch[1].htm.18.dr	String found in binary or memory: http://github.com/requirejs/requirejs/LICENSE
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://google.pchome.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://home.altervista.org/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ie.search.yahoo.com/os?command=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ie8.ebay.com/open-search/output-xml.php?q=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://image.excite.co.jp/jp/favicon/lep.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://images.joins.com/ui_c/fvc_joins.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://images.monster.com/favicon.ico
Source: 52-7ec320[1].css0.18.dr, 65-478888[1].css.18.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1LLAb
Source: RE4tZqs[1].htm.18.dr	String found in binary or memory: http://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4tWN0?ver=466b
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://img.atlas.cz/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://img.shopzilla.com/shopzilla/shopzilla.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://in.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.dada.net/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://it.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://jobsearch.monster.com/
Source: ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.2.dr	String found in binary or memory: http://knockoutjs.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://kr.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://list.taobao.com/browse/search_visual.htm?n=15&q=
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: http://login.microsoftonline.com
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: http://login.microsoftonline.com/d
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://mail.live.com/?rru=compose%3Fsubject%3D
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://msk.afisha.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ocnsearch.goo.ne.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://openimage.interpark.com/interpark.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://p.zhongsou.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://price.ru/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.linternaute.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://recherche.tf1.fr/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://rover.ebay.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://ru.search.yahoo.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://sads.myspace.com/
Source: de-ch[1].htm.18.dr	String found in binary or memory: http://schema.org/Organization
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search-dyn.tiscali.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.about.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.alice.it/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.aol.in/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.atlas.cz/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.auction.co.kr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.auone.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.books.com.tw/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.centrum.cz/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.chol.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.cn.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.daum.net/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.dreamwiz.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.in/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ebay.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.empas.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.espn.go.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gamer.com.tw/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.gismeteo.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.goo.ne.jp/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.hanafos.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.interpark.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.ipop.co.kr/favicon.ico
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=IEFM1&q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SO2TDF&q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?FORM=SOLTDF&q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.live.com/results.aspx?q=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.livedoor.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.lycos.com/favicon.ico
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.jp/results.aspx?q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.co.uk/results.aspx?q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com.cn/results.aspx?q=
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.msn.com/results.aspx?q=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.nate.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.naver.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.nifty.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.orange.co.uk/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.rediff.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.seznam.cz/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.sify.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.co.jp/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahoo.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yahooapis.jp/AssistSearchService/V2/webassistSearch?output=iejson&p=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search.yam.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search1.taobao.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://search2.estadao.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://searchresults.news.com.au/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://service2.bfast.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://sitesearch.timesonline.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://so-net.search.goo.ne.jp/
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://stackoverflow.com/questions/1977871/check-if-an-image-is-loaded-no-errors-in-javascript
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://stackoverflow.com/questions/5650924/javascript-color-contraster
Source: iexplore.exe, 00000001.00000002.484929054.000001E168A00000.00000004.00000001.sdmp	String found in binary or memory: http://static-global-s-msn-com.akamaized.net/hp-neu/sc/2b/a5ea21.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.aol.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.freenet.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.lycos.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.t-online.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://suche.web.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.472786376.000001E166D00000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263399820.000000000E1C0000.00000002.00000001.sdmp	String found in binary or memory: http://treyresearch.net
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://tw.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://udn.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.ask.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://uk.search.yahoo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://vachercher.lycos.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://video.globo.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://web.ask.com/
Source: iexplore.exe, 00000001.00000002.472786376.000001E166D00000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263399820.000000000E1C0000.00000002.00000001.sdmp	String found in binary or memory: http://www.%s.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.abril.com.br/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.aerials-express.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.afisha.ru/App_Themes/Default/images/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.alarabiya.net/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/exec/obidos/external-search/104-2981279-3455918?index=blended&keyword=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.com/gp/search?ie=UTF8&tag=ie8search-20&index=blended&linkCode=qs&c
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.amazon.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.aol.com/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.appliedgeographic.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.arrakis.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.asharqalawsat.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ask.com/
Source: windows[1].htm.18.dr	String found in binary or memory: http://www.asp.net/ajaxlibrary/CDN.ashx.
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.auction.co.kr/auction.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.baidu.com/favicon.ico
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://www.barelyfitz.com/screencast/html-training/css/positioning/)
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cdiscount.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ceneo.pl/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.chennaionline.com/ncommon/images/collogo.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cjmall.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.clarin.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.cnet.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.dailymail.co.uk/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.digitalglobe.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.docUrl.com/bar.htm
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.etmall.com.tw/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.excite.co.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.expedia.com/favicon.ico
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gismeteo.ru/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.gmarket.co.kr/favicon.ico
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.in/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.co.uk/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.sa/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.cz/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.it/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.pl/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.google.si/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.iask.com/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.indiacom.com
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.indiacom.com/
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.inegi.org.mx/
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.infogroup.com/
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.kkbox.com.tw/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.linternaute.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.maktoob.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolibre.com.mx/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mercadolivre.com.br/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.merlin.com.pl/favicon.ico
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://www.michaelbromley.co.uk/blog/193/a-note-on-touch-pointer-events-in-ie11
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/?ref=IE8Activity
Source: explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BV.aspx?ref=IE8Activity&a=
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/Default.aspx?ref=IE8Activity
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.microsofttranslator.com/DefaultPrev.aspx?ref=IE8Activity
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: http://www.movable-type.co.uk/dev/keyboardevent-key-values.html
Source: default[1].htm.18.dr	String found in binary or memory: http://www.mpegla.com
Source: default[1].htm.18.dr	String found in binary or memory: http://www.mpegla.com).
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.mtv.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.myspace.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.najdi.si/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.nate.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.neckermann.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.news.com.au/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.nifty.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ocn.ne.jp/favicon.ico
Source: ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.2.dr	String found in binary or memory: http://www.opensource.org/licenses/mit-license.php)
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.orange.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.otto.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozon.ru/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ozu.es/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.paginasamarillas.es/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.pchome.com.tw/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.priceminister.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rakuten.co.jp/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rambler.ru/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.recherche.aol.fr/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.rtl.de/favicon.ico
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.servicios.clarin.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.shopzilla.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sify.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.so-net.ne.jp/share/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.sogou.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.soso.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.t-online.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.taobao.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.target.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tchibo.de/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tesco.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.timesonline.co.uk/img/favicon.ico
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiscali.it/favicon.ico
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.univision.com/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.urbanmapping.com/
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.walmart.com/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.wolframalpha.com
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.ya.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www.yam.com/favicon.ico
Source: en[1].htm0.18.dr	String found in binary or memory: http://www.zenrin.co.jp/
Source: explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://www3.fnac.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://xml-us.amznxslt.com/onca/xml?Service=AWSECommerceService&Version=2008-06-26&Operation
Source: iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	String found in binary or memory: http://z.about.com/m/a08.ico
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/converged.v2.login.min_ty_bk5wxx82kilmq7o6ql
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/ests/2.1/content/cdnbundles/ux.converged.login.strings-en.min_lx3ffqwkjn
Source: imagestore.dat.2.dr, authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Source: iexplore.exe, 00000001.00000002.485092749.000001E168A91000.00000004.00000001.sdmp	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico(
Source: iexplore.exe, 00000001.00000002.485092749.000001E168A91000.00000004.00000001.sdmp	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.icod
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~
Source: imagestore.dat.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico~(
Source: authorize[1].htm.2.dr	String found in binary or memory: https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2.js
Source: ~DF64A01DAEA3659355.TMP.1.dr	String found in binary or memory: https://account.live.com/
Source: reset[1].htm.2.dr	String found in binary or memory: https://account.live.com/error.aspx?errcode=1045&mkt=en-US
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: https://account.live.com/favicon.ico
Source: ~DF64A01DAEA3659355.TMP.1.dr	String found in binary or memory: https://account.live.com/password/reset?wreply=https%3a%2f%2flogin.microsoftonline.com%2f9bda9f74-6e
Source: reset[1].htm.2.dr	String found in binary or memory: https://account.live.com/query.aspx
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/accountcorepackage_YD-Y5A3nlj0ms1Ks9fXU6A2.js?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/bootstrap_3.3.0_B68S-_daR6nLiLVZsh4XiA2.js?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/converged_ux_v2_6YpynTcUlrcv1RHYgHSSXg2.css?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg)
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/AppCentipede/AppCentipede_Microsoft_HFeToeM4u6fzMQF_f_rQ5Q2.svg
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/AppCentipede/AppCentipede_Microsoft_white_ufRYlllWOw4YyDRiKcBvxQ2.
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/Microsoft_Logotype_Gray_X-qkgtg8KmnQEvm_9mDTcw2.svg
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/Microsoft_Logotype_White_4MYDQRab31HKDWWN-1HafA2.svg
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2
Source: iexplore.exe, 00000001.00000002.487767407.000001E169DC7000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2.archBox&FORM=IENTTR
Source: iexplore.exe, 00000001.00000002.488025292.000001E169E4A000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=245/
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2o
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~
Source: imagestore.dat.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/favicon.ico?v=2~(
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/knockout_old_GJ62c6D9R5HuKFdkoO8XYw2.js?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/resetpasswordpackage_4V0fdYfCP0Q6UAi6MW5E0A2.js?v=1
Source: reset[1].htm.2.dr	String found in binary or memory: https://acctcdn.msauth.net/wlivepackagefull_BWVcpM3ZvobDGQWPo5hgew2.js?v=1
Source: default[1].htm.18.dr	String found in binary or memory: https://aka.ms/redeemrewards
Source: default[1].htm.18.dr	String found in binary or memory: https://aka.ms/redeemrewards).
Source: default[1].htm.18.dr	String found in binary or memory: https://aka.ms/taxservice
Source: default[1].htm.18.dr	String found in binary or memory: https://aka.ms/useterms
Source: script[1].js1.18.dr	String found in binary or memory: https://api.company-target.com/api/v2/ip.json?key=70aff8023e038d56ea636f68e5c5922b&referrer=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://assets.onestore.ms
Source: reset[1].htm.2.dr	String found in binary or memory: https://az416426.vo.msecnd.net/scripts/c/ms.analytics-web-2.min.js
Source: iframe[1].htm.18.dr	String found in binary or memory: https://az725175.vo.msecnd.net/scripts/jsll-4.js
Source: iexplore.exe, 00000001.00000002.487759232.000001E169DC1000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://bingexplore.azurewebsites.net/
Source: ~DF59A3B28A9AF0D6BC.TMP.1.dr, en[1].htm.18.dr	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/
Source: iexplore.exe, 00000001.00000002.487759232.000001E169DC1000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/--About
Source: iexplore.exe, 00000001.00000002.487767407.000001E169DC7000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/9
Source: iexplore.exe, 00000001.00000002.487767407.000001E169DC7000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/=
Source: ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/Accept-Encodinggzip
Source: ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/SPS
Source: ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/XAbout
Source: iexplore.exe, 00000001.00000002.487873674.000001E169E1C000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/bing-data-suppliers/en/uS
Source: iexplore.exe, 00000001.00000002.488183670.000001E169E91000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/favicon.ico
Source: iexplore.exe, 00000001.00000002.488183670.000001E169E91000.00000004.00000001.sdmp	String found in binary or memory: https://bingexplore.azurewebsites.net/favicon.icol
Source: iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp	String found in binary or memory: https://c.s
Source: iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp	String found in binary or memory: https://c.s-microso
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://channel9.msdn.com/
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://code.jquery.com/jquery-3.1.1.js
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://codepen.io/tigt/post/optimizing-svgs-in-data-uris
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://css-tricks.com/absolute-positioning-inside-relative-positioning/)
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://css-tricks.com/probably-dont-base64-svg/
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/MutationObserver
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/API/Node/nodeType
Source: mwf-main.var[1].js.18.dr	String found in binary or memory: https://developer.mozilla.org/en-US/docs/Web/CSS/touch-action
Source: en[1].htm0.18.dr	String found in binary or memory: https://doi.org/10.5067/ASTER/AST14DEM.003.
Source: en[1].htm0.18.dr	String found in binary or memory: https://doi.org/10.5067/KXOVQ9L172S2.
Source: RE4tZqs[1].htm.18.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/5c809452-9c36-43dd-b59d-129bed4acdb9/7564
Source: RE4tZqs[1].htm.18.dr	String found in binary or memory: https://eus-streaming-video-rt-microsoft-com.akamaized.net/f7016bd3-4e36-4db1-906d-d5604ab6e238/7564
Source: en[1].htm0.18.dr	String found in binary or memory: https://geoservices.ign.fr/documentation/diffusion/telechargement-donnees-libres.html#rge-alti-1-m
Source: en[1].htm0.18.dr	String found in binary or memory: https://geoservices.ign.fr/documentation/diffusion/telechargement-donnees-libres.html#rge-alti-5-m
Source: convergedlogin_presetpasswordsplitter_9df00b568d583d28a916[1].js.2.dr, reset[1].htm.2.dr	String found in binary or memory: https://github.com/douglascrockford/JSON-js
Source: app[1].css.18.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: mwf-auto-init-main.var.min[1].js.18.dr	String found in binary or memory: https://github.com/scottjehl/picturefill/blob/master/Authors.txt;
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1CmIw?ver=e555&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE1Mu3b?ver=5c31
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE3NYMe?ver=7b0e&q=
Source: surface[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE3u0jz
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4E4rR?ver=1daf&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4E4rT?ver=2072&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4GMgj?ver=bbbd&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4LgDB?ver=ddca&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4Lzrr?ver=3eb5&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pkvE?ver=d8fc&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pndL?ver=5217&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pxBu?ver=eae5&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4rriw?ver=b2d5&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4sQDc?ver=30c2&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wocw?ver=b219&q=
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWBLKL?ver=ba81&q=9
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWBmSK?ver=c9e8&q=9
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWDmbY?ver=b7fc&q=0
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWzV6z?ver=92fe&q=0
Source: iexplore.exe, 00000001.00000002.485116302.000001E168AA9000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com
Source: iexplore.exe, 00000001.00000002.485116302.000001E168AA9000.00000004.00000001.sdmp	String found in binary or memory: https://login.live.com/8
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/Me.htm?v=3
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/forgetme.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/logout.srf?iframed_by=https%3a%2f%2flogin.microsoftonline.com
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.live.com/oauth20_authorize.srf?response_type=code
Source: iexplore.exe, 00000001.00000002.469157213.000001E164F2A000.00000004.00000020.sdmp	String found in binary or memory: https://login.live.comL
Source: iexplore.exe, 00000001.00000002.469308264.000001E164F60000.00000004.00000020.sdmp	String found in binary or memory: https://login.live.comy
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com
Source: TokenBrokerCookies.exe, 00000005.00000002.214791891.000002DCE6F6C000.00000004.00000020.sdmp, ~DF64A01DAEA3659355.TMP.1.dr	String found in binary or memory: https://login.microsoftonline.com/
Source: TokenBrokerCookies.exe, 00000005.00000002.214781055.000002DCE6F60000.00000004.00000020.sdmp	String found in binary or memory: https://login.microsoftonline.com/0tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoft
Source: ~DF64A01DAEA3659355.TMP.1.dr	String found in binary or memory: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client_id=00
Source: reset[1].htm.2.dr, ~DF64A01DAEA3659355.TMP.1.dr	String found in binary or memory: https://login.microsoftonline.com/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/reprocess?ctx=rQIIAaWRP2zTQBj
Source: ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://login.microsoftonline.com/common/oauth2/authorize?client_id=28b567f6-162c-4f54-99a0-6887f387
Source: iexplore.exe, 00000001.00000002.484929054.000001E168A00000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/favicon.ico
Source: iexplore.exe, 00000001.00000002.485132699.000001E168ABA000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/favicon.icoU
Source: iexplore.exe, 00000001.00000002.485132699.000001E168ABA000.00000004.00000001.sdmp	String found in binary or memory: https://login.microsoftonline.com/favicon.ico~
Source: authorize[1].htm.2.dr	String found in binary or memory: https://login.microsoftonline.com/jsdisabled
Source: Me[1].htm.2.dr	String found in binary or memory: https://login.windows-ppe.net
Source: iexplore.exe, 00000001.00000002.485075277.000001E168A7B000.00000004.00000001.sdmp	String found in binary or memory: https://login.windows.net
Source: iexplore.exe, 00000001.00000002.485075277.000001E168A7B000.00000004.00000001.sdmp	String found in binary or memory: https://login.windows.net/
Source: iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://login.windows.net/9bda9f74-6eb0-44a6-8185-adbcf75a63e6/oauth2/authorize?client%5Fid=00000003
Source: iframe[1].htm.18.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net
Source: iexplore.exe, 00000001.00000002.487767407.000001E169DC7000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487939947.000001E169E33000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net/le_secure_storage/3.13.0.0-release_5039/storage.secure.min.html?loc=http
Source: iframe[1].htm.18.dr	String found in binary or memory: https://lpcdn.lpsnmedia.net/le_unified_window/9.12.0.19-release_4769/resources/loader_on_warmGray5_7
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://mem.gfx.ms
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://mem.gfx.ms/meversion?partner=MSHomePage&market=de-ch&uhf=1
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://microsoftwindows.112.2o7.net
Source: default[1].htm.18.dr	String found in binary or memory: https://mixer.com/about/tos
Source: default[1].htm.18.dr	String found in binary or memory: https://mixer.com/contact
Source: mwf-auto-init-main.var.min[1].js.18.dr	String found in binary or memory: https://modernizr.com/download/?-eventlistener-picture-printshiv-setclasses
Source: iexplore.exe, 00000001.00000002.485161464.000001E168AD5000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487939947.000001E169E33000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://mscom.demdex.net/dest5.html?d_nsid=0
Source: iexplore.exe, 00000001.00000002.487939947.000001E169E33000.00000004.00000001.sdmp	String found in binary or memory: https://mscom.demdex.net/dest5.html?d_nsid=0iC-
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://onedrive.live.com/about/de-ch/
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://outlook.live.com/owa/
Source: RE4tZqs[1].htm.18.dr	String found in binary or memory: https://prod-video-cms-rt-microsoft-com.akamaized.net/cms/api/am/videofiledata/RE4tZqs-tscriptenus?v
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://products.office.com/de-ch/academic/compare-office-365-education-plans
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://publisher.liveperson.net
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://publisher.liveperson.net/iframe-le-tag/iframe.html?lpsite=60270350&lpsection=store-sales
Source: iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	String found in binary or memory: https://publisher.liveperson.net/iframe-le-tag/iframe.html?lpsite=60270350&lpsection=store-sales-de-
Source: iexplore.exe, 00000001.00000002.485161464.000001E168AD5000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487873674.000001E169E1C000.00000004.00000001.sdmp	String found in binary or memory: https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQ
Source: iexplore.exe, 00000001.00000002.485161464.000001E168AD5000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.485116302.000001E168AA9000.00000004.00000001.sdmp	String found in binary or memory: https://rafihautogroup-my.sharepoint.com/_forms/default.aspx?ReturnUrl=%2fpersonal%2fjames_lexusofwi
Source: iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487519722.000001E169D4F000.00000004.00000001.sdmp	String found in binary or memory: https://rafihautogroup-my.sharepoint.com/personal/james_lexusofwindsor_com/_layouts/15/Authenticate.
Source: iframe[1].htm.18.dr	String found in binary or memory: https://release.moscnuat.com
Source: surface[1].htm.18.dr, de-ch[1].htm.18.dr	String found in binary or memory: https://schema.org/ItemList
Source: surface[1].htm.18.dr	String found in binary or memory: https://schema.org/Product
Source: mwf-auto-init-main.var.min[1].js.18.dr	String found in binary or memory: https://scottjehl.github.io/picturefill/
Source: default[1].htm.18.dr	String found in binary or memory: https://skype.com/go/myaccount
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://twitter.com/microsoft_ch
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://ussearchprod.trafficmanager.net/services/api/v1.0/store/categories
Source: iframe[1].htm.18.dr	String found in binary or memory: https://va.idp.liveperson.net
Source: iframe[1].htm.18.dr	String found in binary or memory: https://va.msg.liveperson.net
Source: default[1].htm.18.dr	String found in binary or memory: https://www.adr.org
Source: iexplore.exe, 00000001.00000002.484929054.000001E168A00000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.png
Source: iexplore.exe, 00000001.00000002.485075277.000001E168A7B000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/chrome/static/images/favicons/favicon-16x16.pngN
Source: iexplore.exe, 00000001.00000002.485132699.000001E168ABA000.00000004.00000001.sdmp	String found in binary or memory: https://www.google.com/favicon.ico
Source: default[1].htm.18.dr	String found in binary or memory: https://www.google.com/intl/en_ALL/help/terms_maps.html
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.instagram.com/microsoftch/
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.linkedin.com/company/1035
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/cart
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/checkout
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/accessories/surface
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/accessories/xbox
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/surface
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/hardware/xbox
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/microsoft-365/microsoft-365
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/software/microsoft-365
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/surface
Source: iframe[1].htm.18.dr	String found in binary or memory: https://www.microsoftstore.com.cn/xbox
Source: iexplore.exe, 00000001.00000002.487501010.000001E169D4A000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-US&mar
Source: iexplore.exe, 00000001.00000002.488136784.000001E169E7A000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.488261132.000001E169EAA000.00000004.00000001.sdmp	String found in binary or memory: https://www.msn.com/spartan/ientp?locale=en-US&market=US&enableregulatorypsm=0&enablecpsm=0&NTLogo=1
Source: en[1].htm0.18.dr	String found in binary or memory: https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.onenote.com/?omkt=de-CH
Source: en[1].htm0.18.dr	String found in binary or memory: https://www.openstreetmap.org/copyright
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com).
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.skype.com/de/
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com/go/allrates
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com/go/legal
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com/go/legal.broadcast
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com/go/store.reactivate.credit
Source: default[1].htm.18.dr	String found in binary or memory: https://www.skype.com/go/ustax
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.xbox.com/
Source: default[1].htm.18.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct
Source: default[1].htm.18.dr	String found in binary or memory: https://www.xbox.com/en-US/Legal/CodeOfConduct)
Source: default[1].htm.18.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios
Source: default[1].htm.18.dr	String found in binary or memory: https://www.xbox.com/xbox-game-studios)
Source: de-ch[1].htm.18.dr	String found in binary or memory: https://www.youtube.com/user/MicrosoftCH
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com
Source: iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	String found in binary or memory: https://xsts.auth.xboxlive.com/

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49821
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49842 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49860
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49836 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49819
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49817
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49739
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49859
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49858
Source: unknown	Network traffic detected: HTTP traffic on port 49868 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49857
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49856
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49855
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49852
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49851
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49711 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49858 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49855 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49851 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49739 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49842
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49819 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49834 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49824 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49831 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49836
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49835
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49834
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49833
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49711
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49832
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49831
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49872
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49856 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49832 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49824
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49868
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49867

Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49711 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.23.37:443 -> 192.168.2.3:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.3:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.3:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.192:443 -> 192.168.2.3:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.209.78:443 -> 192.168.2.3:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.209.78:443 -> 192.168.2.3:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.3:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 192.229.221.185:443 -> 192.168.2.3:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.31.176.223:443 -> 192.168.2.3:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.31.176.223:443 -> 192.168.2.3:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 54.171.219.200:443 -> 192.168.2.3:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.203.205.32:443 -> 192.168.2.3:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.29.132.144:443 -> 192.168.2.3:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.29.132.144:443 -> 192.168.2.3:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.33.220.242:443 -> 192.168.2.3:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.33.220.242:443 -> 192.168.2.3:49831 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.3:49834 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.244.174.68:443 -> 192.168.2.3:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.195:443 -> 192.168.2.3:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.195:443 -> 192.168.2.3:49841 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.111.131:443 -> 192.168.2.3:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 76.223.111.131:443 -> 192.168.2.3:49849 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 91.228.74.189:443 -> 192.168.2.3:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.3:49855 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.12.5:443 -> 192.168.2.3:49856 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.82.100.182:443 -> 192.168.2.3:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 212.82.100.182:443 -> 192.168.2.3:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.13.5:443 -> 192.168.2.3:49860 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.18.13.5:443 -> 192.168.2.3:49859 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.213.168.74:443 -> 192.168.2.3:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.99:443 -> 192.168.2.3:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.16.99:443 -> 192.168.2.3:49873 version: TLS 1.2

Source: classification engine

Classification label: mal48.win@8/354@44/22

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFCB59B0E1B22C4E26.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: C:\Windows\System32\TokenBrokerCookies.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1
Source: unknown	Process created: C:\Windows\System32\dllhost.exe C:\Windows\system32\DllHost.exe /Processid:{49F171DD-B51A-40D3-9A6C-52D674CC729D}
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:82962 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:82962 /prefetch:2

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f0ae1542-f497-484b-a175-a20db09144ba}\InProcServer32

Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Next
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept
Source: C:\Program Files\internet explorer\iexplore.exe	Automated click: Accept

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 0000000C.00000002.488223499.0000000006560000.00000002.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 0000000C.00000002.488223499.0000000006560000.00000002.00000001.sdmp

Source: C:\Windows\System32\dllhost.exe

Registry key monitored for changes: HKEY_CURRENT_USER_Classes

Source: TokenBrokerCookies.exe, 00000005.00000002.214791891.000002DCE6F6C000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll6
Source: explorer.exe, 0000000C.00000000.258844965.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000C.00000000.258844965.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 0000000C.00000000.258526342.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000C.00000000.258004805.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000C.00000000.251323606.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 0000000C.00000000.258844965.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 0000000C.00000000.258844965.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 0000000C.00000000.259123901.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 0000000C.00000000.251348386.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 0000000C.00000000.258004805.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000C.00000000.258004805.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: iexplore.exe, 00000001.00000002.468881263.000001E164EE1000.00000004.00000020.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
Source: explorer.exe, 0000000C.00000000.258004805.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Windows\System32\TokenBrokerCookies.exe C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1

Source: explorer.exe, 0000000C.00000002.468314517.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: iexplore.exe, 00000001.00000002.469658287.000001E165340000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.241517635.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: iexplore.exe, 00000001.00000002.469658287.000001E165340000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.254890085.0000000006860000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: iexplore.exe, 00000001.00000002.469658287.000001E165340000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.241517635.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: iexplore.exe, 00000001.00000002.469658287.000001E165340000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.241517635.0000000001980000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Valid Accounts	Command and Scripting Interpreter1	Path Interception	Process Injection2	Masquerading1	OS Credential Dumping	Query Registry1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Exploitation for Client Execution1	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection2	LSASS Memory	Security Software Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol1	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Process Discovery1	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol2	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	File and Directory Discovery1	Distributed Component Object Model	Input Capture	Scheduled Transfer	Protocol Impersonation	SIM Card Swap		Carrier Billing Fraud
Cloud Accounts	Cron	Network Logon Script	Network Logon Script	Software Packing	LSA Secrets	System Information Discovery1	SSH	Keylogging	Data Transfer Size Limits	Fallback Channels	Manipulate Device Communication		Manipulate App Store Rankings or Ratings

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9	100%	Avira URL Cloud	phishing

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

No Antivirus matches

URLs

Source	Detection	Scanner	Label
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.mercadolivre.com.br/	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.merlin.com.pl/favicon.ico	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
http://www.dailymail.co.uk/	0%	URL Reputation	safe
https://assets.onestore.ms	0%	URL Reputation	safe
https://assets.onestore.ms	0%	URL Reputation	safe
https://assets.onestore.ms	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
http://www.galapagosdesign.com/DPlease	0%	URL Reputation	safe
https://acctcdn.msauth.net/resetpasswordpackage_4V0fdYfCP0Q6UAi6MW5E0A2.js?v=1	0%	Avira URL Cloud	safe
https://acctcdn.msauth.net/images/favicon.ico?v=245/	0%	Avira URL Cloud	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://busca.igbusca.com.br//app/static/images/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.etmall.com.tw/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://it.search.dada.net/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
http://search.hanafos.com/favicon.ico	0%	URL Reputation	safe
https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	0%	URL Reputation	safe
https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	0%	URL Reputation	safe
https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	0%	URL Reputation	safe
https://www.microsoftstore.com.cn/cart	0%	URL Reputation	safe
https://www.microsoftstore.com.cn/cart	0%	URL Reputation	safe
https://www.microsoftstore.com.cn/cart	0%	URL Reputation	safe
http://cgi.search.biglobe.ne.jp/favicon.ico	0%	Avira URL Cloud	safe
http://www.mpegla.com).	0%	Avira URL Cloud	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
http://search.msn.co.jp/results.aspx?q=	0%	URL Reputation	safe
https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1	0%	URL Reputation	safe
https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1	0%	URL Reputation	safe
https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1	0%	URL Reputation	safe
http://buscar.ozu.es/	0%	Avira URL Cloud	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://search.auction.co.kr/	0%	URL Reputation	safe
http://fontello.comiconsRegulariconsiconsVersion	0%	URL Reputation	safe
http://fontello.comiconsRegulariconsiconsVersion	0%	URL Reputation	safe
http://fontello.comiconsRegulariconsiconsVersion	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://www.pchome.com.tw/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://browse.guardian.co.uk/favicon.ico	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
http://google.pchome.com.tw/	0%	URL Reputation	safe
https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).	0%	Avira URL Cloud	safe
https://www.microsoftstore.com.cn/microsoft-365/microsoft-365	0%	URL Reputation	safe
https://www.microsoftstore.com.cn/microsoft-365/microsoft-365	0%	URL Reputation	safe
https://www.microsoftstore.com.cn/microsoft-365/microsoft-365	0%	URL Reputation	safe
http://www.ozu.es/favicon.ico	0%	Avira URL Cloud	safe
http://www.michaelbromley.co.uk/blog/193/a-note-on-touch-pointer-events-in-ie11	0%	URL Reputation	safe
http://www.michaelbromley.co.uk/blog/193/a-note-on-touch-pointer-events-in-ie11	0%	URL Reputation	safe
http://www.michaelbromley.co.uk/blog/193/a-note-on-touch-pointer-events-in-ie11	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://search.yahoo.co.jp/favicon.ico	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.gmarket.co.kr/	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
http://www.founder.com.cn/cn/bThe	0%	URL Reputation	safe
https://acctcdn.msauth.net	0%	URL Reputation	safe
https://acctcdn.msauth.net	0%	URL Reputation	safe
https://acctcdn.msauth.net	0%	URL Reputation	safe
http://www.appliedgeographic.com	0%	Avira URL Cloud	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://search.orange.co.uk/favicon.ico	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
http://www.iask.com/	0%	URL Reputation	safe
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2.js	0%	Avira URL Cloud	safe
https://c.s	0%	Avira URL Cloud	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://service2.bfast.com/	0%	URL Reputation	safe
http://www.news.com.au/favicon.ico	0%	URL Reputation	safe
http://www.news.com.au/favicon.ico	0%	URL Reputation	safe
http://www.news.com.au/favicon.ico	0%	URL Reputation	safe
http://www.kkbox.com.tw/	0%	URL Reputation	safe
http://www.kkbox.com.tw/	0%	URL Reputation	safe
http://www.kkbox.com.tw/	0%	URL Reputation	safe
http://search.goo.ne.jp/favicon.ico	0%	URL Reputation	safe
http://search.goo.ne.jp/favicon.ico	0%	URL Reputation	safe
http://search.goo.ne.jp/favicon.ico	0%	URL Reputation	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
www.google.de	172.217.16.99	true	false	high
pixel-origin.mathtag.com	185.29.132.144	true	false	high
s.tribalfusion.com	104.18.13.5	true	false	high
cs1100.wpc.omegacdn.net	152.199.23.37	true	false	unknown
spcms-global.pbp.gysm.yahoodns.net	212.82.100.182	true	false	unknown
s.twitter.com	104.244.42.195	true	false	high
global.px.quantserve.com	91.228.74.189	true	false	high
microsoftwindows.112.2o7.net	15.237.76.117	true	false	high
sni1gl.wpc.alphacdn.net	152.199.21.175	true	false	unknown
microsoftmscompoc.tt.omtrdc.net	18.203.205.32	true	false	unknown
a97adde81b00f2ca4.awsglobalaccelerator.com	76.223.111.131	true	false	unknown
mboxedge37.tt.omtrdc.net	52.213.168.74	true	false	unknown
dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com	52.31.176.223	true	false	high
idsync.rlcdn.com	35.244.174.68	true	false	high
googleads.g.doubleclick.net	172.217.19.98	true	false	high
a.tribalfusion.com	104.18.12.5	true	false	high
dh1y47vf5ttia.cloudfront.net	143.204.209.78	true	false	high
cm.g.doubleclick.net	172.217.20.2	true	false	high
cs1227.wpc.alphacdn.net	192.229.221.185	true	false	unknown
liveperson.map.fastly.net	151.101.1.192	true	false	unknown
ib.anycast.adnxs.com	185.33.220.242	true	false	high
logincdn.msauth.net	unknown	unknown	false	unknown
lpcdn.lpsnmedia.net	unknown	unknown	false	high
idpix.media6degrees.com	unknown	unknown	false	high
assets.onestore.ms	unknown	unknown	false	unknown
account.live.com	unknown	unknown	false	high
acctcdn.msauth.net	unknown	unknown	false	unknown
ajax.aspnetcdn.com	unknown	unknown	false	high
static-assets.fs.liveperson.com	unknown	unknown	false	high
cm.everesttech.net	unknown	unknown	false	high
bingexplore.azurewebsites.net	unknown	unknown	false	unknown
login.windows.net	unknown	unknown	false	high
publisher.liveperson.net	unknown	unknown	false	high
dpm.demdex.net	unknown	unknown	false	high
rtd-tm.everesttech.net	unknown	unknown	false	high
match.adsrvr.org	unknown	unknown	false	high
servedby.flashtalking.com	unknown	unknown	false	high
consentreceiverfd-prod.azurefd.net	unknown	unknown	false	unknown
accdn.lpsnmedia.net	unknown	unknown	false	high
rtd.tubemogul.com	unknown	unknown	false	high
aadcdn.msftauth.net	unknown	unknown	false	unknown
pixel.quantserve.com	unknown	unknown	false	high
mscom.demdex.net	unknown	unknown	false	high
mem.gfx.ms	unknown	unknown	false	unknown
analytics.twitter.com	unknown	unknown	false	high
rafihautogroup-my.sharepoint.com	unknown	unknown	false	unknown
cms.analytics.yahoo.com	unknown	unknown	false	high
clientconfig.passport.net	unknown	unknown	false	unknown
sync.mathtag.com	unknown	unknown	false	high
ib.adnxs.com	unknown	unknown	false	high
login.microsoftonline.com	unknown	unknown	false	high
amp.azure.net	unknown	unknown	false	high
lptag.liveperson.net	unknown	unknown	false	high
p.rfihub.com	unknown	unknown	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://search.chol.com/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.mercadolivre.com.br/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.merlin.com.pl/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://account.live.com/favicon.ico	iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	false		high
http://www.dailymail.co.uk/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://login.microsoftonline.com/d	iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	false		high
https://assets.onestore.ms	de-ch[1].htm.18.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://codepen.io/tigt/post/optimizing-svgs-in-data-uris	mwf-main.var[1].js.18.dr	false		high
http://g.live.com/0HE_TRACKSTAR_ENUS9/148871??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
http://www.asp.net/ajaxlibrary/CDN.ashx.	windows[1].htm.18.dr	false		high
http://www.fontbureau.com/designers	explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	false		high
https://www.xbox.com/en-US/Legal/CodeOfConduct	default[1].htm.18.dr	false		high
http://fr.search.yahoo.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://g.live.com/0HE_TRACKSTAR_ENUS9/148343??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
http://in.search.yahoo.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://img.shopzilla.com/shopzilla/shopzilla.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
https://www.skype.com	default[1].htm.18.dr	false		high
https://publisher.liveperson.net/iframe-le-tag/iframe.html?lpsite=60270350&lpsection=store-sales-de-	iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	false		high
http://www.galapagosdesign.com/DPlease	explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://msk.afisha.ru/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
https://acctcdn.msauth.net/resetpasswordpackage_4V0fdYfCP0Q6UAi6MW5E0A2.js?v=1	reset[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
https://acctcdn.msauth.net/images/favicon.ico?v=245/	iexplore.exe, 00000001.00000002.488025292.000001E169E4A000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://busca.igbusca.com.br//app/static/images/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ya.com/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.etmall.com.tw/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://it.search.dada.net/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.hanafos.com/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://acctcdn.msauth.net/images/microsoft_logo_7lyNn7YkjJOP0NwZNw6QvQ2.svg	reset[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.microsoftstore.com.cn/cart	iframe[1].htm.18.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://g.live.com/0HE_TRACKSTAR_ENUS9/148322??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=001	en[1].htm0.18.dr	false		high
https://mscom.demdex.net/dest5.html?d_nsid=0	iexplore.exe, 00000001.00000002.485161464.000001E168AD5000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487939947.000001E169E33000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	false		high
http://cgi.search.biglobe.ne.jp/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
https://lpcdn.lpsnmedia.net/le_secure_storage/3.13.0.0-release_5039/storage.secure.min.html?loc=http	iexplore.exe, 00000001.00000002.487767407.000001E169DC7000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487939947.000001E169E33000.00000004.00000001.sdmp, iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp, ~DF59A3B28A9AF0D6BC.TMP.1.dr	false		high
https://css-tricks.com/probably-dont-base64-svg/	mwf-main.var[1].js.18.dr	false		high
http://www.mpegla.com).	default[1].htm.18.dr	false	Avira URL Cloud: safe	low
http://search.msn.co.jp/results.aspx?q=	explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://acctcdn.msauth.net/jquerypackage_1.10_5V7LAuc3bNAQx2QQfr1RPw2.js?v=1	reset[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://buscar.ozu.es/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://www.microsofttranslator.com/BVPrev.aspx?ref=IE8Activity	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.ask.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.google.it/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://search.auction.co.kr/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.amazon.de/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.opensource.org/licenses/mit-license.php)	ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2[1].js.2.dr	false		high
https://lpcdn.lpsnmedia.net/le_unified_window/9.12.0.19-release_4769/resources/loader_on_warmGray5_7	iframe[1].htm.18.dr	false		high
http://fontello.comiconsRegulariconsiconsVersion	icons[1].eot.18.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://sads.myspace.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.pchome.com.tw/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://browse.guardian.co.uk/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://g.live.com/0HE_TRACKSTAR_ENUS9/148750??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
http://google.pchome.com.tw/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://list.taobao.com/browse/search_visual.htm?n=15&q=	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.rambler.ru/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://uk.search.yahoo.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
https://www.nationalarchives.gov.uk/doc/open-government-licence/version/3/).	en[1].htm0.18.dr	false	Avira URL Cloud: safe	unknown
https://www.microsoftstore.com.cn/microsoft-365/microsoft-365	iframe[1].htm.18.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.ozu.es/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://search.sify.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.michaelbromley.co.uk/blog/193/a-note-on-touch-pointer-events-in-ie11	mwf-main.var[1].js.18.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://openimage.interpark.com/interpark.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://search.yahoo.co.jp/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.gmarket.co.kr/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.founder.com.cn/cn/bThe	explorer.exe, 0000000C.00000000.259983350.0000000008B40000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.wolframalpha.com	en[1].htm0.18.dr	false		high
http://g.live.com/0HE_TRACKSTAR_ENUS9/148884??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
http://search.nifty.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.google.si/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
https://acctcdn.msauth.net	reset[1].htm.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://xsts.auth.xboxlive.com	iexplore.exe, 00000001.00000002.487426323.000001E169D17000.00000004.00000001.sdmp	false		high
http://www.soso.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.appliedgeographic.com	en[1].htm0.18.dr	false	Avira URL Cloud: safe	unknown
https://www.skype.com/de/	de-ch[1].htm.18.dr	false		high
https://login.windows-ppe.net	Me[1].htm.2.dr	false		high
http://busca.orange.es/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://cnweb.search.live.com/results.aspx?q=	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://auto.search.msn.com/response.asp?MT=	iexplore.exe, 00000001.00000002.472786376.000001E166D00000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263399820.000000000E1C0000.00000002.00000001.sdmp	false		high
http://www.target.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://g.live.com/0HE_TRACKSTAR_ENUS9/148886??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
https://login.microsoftonline.com	Me[1].htm.2.dr	false		high
http://search.orange.co.uk/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.iask.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://aadcdn.msftauth.net/shared/1.0/content/js/ConvergedLogin_PCore_x0nO6m8fG7ZeYuac8AM0sw2.js	authorize[1].htm.2.dr	false	Avira URL Cloud: safe	unknown
http://search.centrum.cz/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
https://c.s	iexplore.exe, 00000001.00000002.488339093.000001E169ECA000.00000004.00000001.sdmp	false	Avira URL Cloud: safe	unknown
http://service2.bfast.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://ariadna.elmundo.es/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.news.com.au/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://www.cdiscount.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.tiscali.it/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://it.search.yahoo.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.ceneo.pl/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.servicios.clarin.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://search.daum.net/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.kkbox.com.tw/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.skype.com/go/store.reactivate.credit	default[1].htm.18.dr	false		high
http://search.goo.ne.jp/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
http://search.msn.com/results.aspx?q=	explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://g.live.com/0HE_TRACKSTAR_ENUS9/148329??WLXID=e450ae44-808a-49e7-9bf8-eb17f049095d&RID=003	en[1].htm0.18.dr	false		high
http://list.taobao.com/	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high
http://www.taobao.com/favicon.ico	iexplore.exe, 00000001.00000002.473900105.000001E166DF3000.00000002.00000001.sdmp, explorer.exe, 0000000C.00000000.263590649.000000000E2B3000.00000002.00000001.sdmp	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
52.213.168.74	mboxedge37.tt.omtrdc.net	United States	16509	AMAZON-02US	false
172.217.16.99	www.google.de	United States	15169	GOOGLEUS	false
18.203.205.32	microsoftmscompoc.tt.omtrdc.net	United States	16509	AMAZON-02US	false
143.204.209.78	dh1y47vf5ttia.cloudfront.net	United States	16509	AMAZON-02US	false
185.33.220.242	ib.anycast.adnxs.com	Netherlands	29990	ASN-APPNEXUS	false
52.31.176.223	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com	United States	16509	AMAZON-02US	false
76.223.111.131	a97adde81b00f2ca4.awsglobalaccelerator.com	United States	16509	AMAZON-02US	false
192.229.221.185	cs1227.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
152.199.21.175	sni1gl.wpc.alphacdn.net	United States	15133	EDGECASTUS	false
35.244.174.68	idsync.rlcdn.com	United States	15169	GOOGLEUS	false
152.199.23.37	cs1100.wpc.omegacdn.net	United States	15133	EDGECASTUS	false
172.217.19.98	googleads.g.doubleclick.net	United States	15169	GOOGLEUS	false
212.82.100.182	spcms-global.pbp.gysm.yahoodns.net	United Kingdom	34010	YAHOO-IRDGB	false
104.18.12.5	a.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false
91.228.74.189	global.px.quantserve.com	United Kingdom	27281	QUANTCASTUS	false
151.101.1.192	liveperson.map.fastly.net	United States	54113	FASTLYUS	false
185.29.132.144	pixel-origin.mathtag.com	United Kingdom	30419	MEDIAMATH-INCUS	false
104.244.42.195	s.twitter.com	United States	13414	TWITTERUS	false
54.171.219.200	unknown	United States	16509	AMAZON-02US	false
172.217.20.2	cm.g.doubleclick.net	United States	15169	GOOGLEUS	false
104.18.13.5	s.tribalfusion.com	United States	13335	CLOUDFLARENETUS	false

Private

IP
192.168.2.1

General Information

Joe Sandbox Version:	32.0.0 Black Diamond
Analysis ID:	416137
Start date:	17.05.2021
Start time:	21:57:47
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 8m 4s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	32
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	1
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	MAL
Classification:	mal48.win@8/354@44/22
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://www.microsoft.com/en-us/servicesagreement/default.aspx Browsing link: https://www.microsoft.com/en-us/servicesagreement/ Browsing link: https://go.microsoft.com/fwlink/?LinkId=521839 Browsing link: https://www.microsoft.com/ Browsing link: https://www.microsoft.com/en-us/servicesagreement Browsing link: https://www.microsoft.com/en-us/servicesagreement/faq.aspx Browsing link: https://www.microsoft.com/en-us/servicesagreement/default.aspx Browsing link: https://go.microsoft.com/fwlink/?LinkId=716894 Browsing link: https://www.microsoft.com/microsoft-365 Browsing link: https://www.microsoft.com/en-us/microsoft-365/microsoft-office Browsing link: https://www.microsoft.com/en-us/windows/ Browsing link: https://www.microsoft.com/en-us/surface
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, MpCmdRun.exe, dllhost.exe, RuntimeBroker.exe, wermgr.exe, backgroundTaskHost.exe, UsoClient.exe, audiodg.exe, BackgroundTransferHost.exe, ielowutil.exe, HxTsr.exe, SgrmBroker.exe, conhost.exe, svchost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 104.42.151.234, 40.88.32.150, 88.221.62.148, 13.107.136.9, 40.126.31.5, 20.190.159.137, 40.126.31.2, 40.126.31.138, 20.190.159.135, 40.126.31.140, 20.190.159.133, 40.126.31.7, 20.190.160.136, 20.190.160.6, 20.190.160.134, 20.190.160.132, 20.190.160.129, 20.190.160.4, 20.190.160.8, 20.190.160.2, 40.126.31.6, 20.190.159.134, 40.126.31.139, 40.126.31.135, 40.126.31.8, 20.190.159.136, 40.126.31.137, 20.190.159.132, 84.53.167.113, 2.17.179.193, 93.184.220.29, 20.190.160.75, 20.190.160.73, 20.190.160.67, 92.123.150.225, 204.79.197.200, 13.107.21.200, 20.82.210.154, 104.43.139.144, 13.107.42.22, 104.70.82.242, 152.199.19.161, 2.17.180.113, 184.30.21.171, 92.122.213.240, 92.122.213.194, 92.123.151.102, 152.199.19.160, 92.122.213.247, 13.107.246.60, 13.107.213.60, 23.32.238.161, 23.32.238.153, 84.53.167.109, 2.17.183.50, 65.55.44.109, 178.249.97.23, 40.126.31.4, 20.190.159.138, 178.249.97.99, 178.249.97.98, 23.37.41.231, 2.17.189.254, 23.96.187.5, 54.194.191.134, 34.250.153.194, 99.81.11.244, 54.171.42.33, 34.255.166.243, 34.253.145.149, 52.142.114.2, 92.122.213.163, 92.122.213.195, 151.101.2.49, 151.101.66.49, 151.101.130.49, 151.101.194.49, 104.18.10.79, 104.18.11.79, 193.0.160.128, 209.197.3.19, 23.79.155.47, 172.217.19.100, 184.30.21.144, 52.114.158.50 Excluded domains from analysis (whitelisted): assets.onestore.ms.edgekey.net, iris-de-prod-azsc-neu-b.northeurope.cloudapp.azure.com, i.s-microsoft.com.edgekey.net, publisher.livepersonk.akadns.net, fs-wildcard.microsoft.com.edgekey.net, www.tm.a.prd.aadg.trafficmanager.net, cdn.onenote.net.edgekey.net, ev.support.microsoft.com.edgekey.net, a1945.g2.akamai.net, skypedataprdcoleus15.cloudapp.net, e3843.g.akamaiedge.net, www.google.com, statics-marketingsites-eus-ms-com.akamaized.net, acctcdnvzeuno.azureedge.net, au-bg-shim.trafficmanager.net, acctcdnvzeuno.ec.azureedge.net, www.bing.com, dual-a-0001.a-msedge.net, cm.everesttech.net.akadns.net, lgincdnvzeuno.ec.azureedge.net, a-emea.rfihub.com.akadns.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net, assets.onestore.ms.akadns.net, c-s.cms.ms.akadns.net, lgincdn.trafficmanager.net, c.bing.com, cdn.account.microsoft.com.akadns.net, e1553.dspg.akamaiedge.net, c.s-microsoft.com-c.edgekey.net, 20221-ipv4.farm.prod.aa-rt.sharepoint.com.spo-0004.spo-msedge.net, spo-0004.spo-msedge.net, cs9.wpc.v0cdn.net, dual.part-0032.t-0009.t-msedge.net, h2.shared.global.fastly.net, cds.f7f2q8c3.hwcdn.net, a1985.g2.akamai.net, support.microsoft.com, c-bing-com.a-0001.a-msedge.net, i.s-microsoft.com, e15275.g.akamaiedge.net, storeedgefd.xbetservices.akadns.net, iecvlist.microsoft.com, e12564.dspb.akamaiedge.net, authgfx.msa.akadns6.net, go.microsoft.com, prod-video-cms-rt-microsoft-com.akamaized.net, arc.trafficmanager.net, cdn.onenote.net, prod.fs.microsoft.com.akadns.net, storeedgefd.dsx.mp.microsoft.com, geo.accdn.livepersonk.akadns.net, 160c1.wpc.azureedge.net, ie9comview.vo.msecnd.net, cs22.wpc.v0cdn.net, mem.gfx.ms.edgekey.net, tile-service.weather.microsoft.com, a767.dscg3.akamai.net, login.msa.msidentity.com, firstparty-azurefd-prod.trafficmanager.net, lptag.liveperson.cotcdb.net.livepersonk.akadns.net, c.s-microsoft.com, browser.events.data.microsoft.com, go.microsoft.com.edgekey.net, l-0013.l-msedge.net, e8819.g.akamaiedge.net, idpix.media6degrees.com.cdn.cloudflare.net, az725175.vo.msecnd.net, e13678.dspb.akamaiedge.net, query.prod.cms.rt.microsoft.com, wcpstatic.microsoft.com, cs9.wac.phicdn.net, www.tm.lg.prod.aadmsa.akadns.net, e13678.dscb.akamaiedge.net, browser.events.data.trafficmanager.net, e11290.dspg.akamaiedge.net, e13551.dscg.akamaiedge.net, www.microsoft.com-c-3.edgekey.net, query.prod.cms.rt.microsoft.com.edgekey.net, ocsp.digicert.com, geo.lpcdn.livepersonk.akadns.net, login.live.com, wildcard.weather.microsoft.com.edgekey.net, www-bing-com.dual-a-0001.a-msedge.net, audownload.windowsupdate.nsatc.net, e11070.b.akamaiedge.net, watson.telemetry.microsoft.com, e10583.dspg.akamaiedge.net, fs.microsoft.com, aadcdnoriginneu.azureedge.net, part-0032.t-0009.t-msedge.net, www.tm.a.prd.aadg.akadns.net, skypedataprdcolcus16.cloudapp.net, web.vortex.data.trafficmanager.net, e55.dspb.akamaiedge.net, store-images.s-microsoft.com, blobcollector.events.data.trafficmanager.net, account.msa.akadns6.net, map.media6degrees.com.cdn.cloudflare.net, privacy.microsoft.com.edgekey.net, storeedgefd.dsx.mp.microsoft.com.edgekey.net.globalredir.akadns.net, au.download.windowsupdate.com.edgesuite.net, c-msn-com-nsatc.trafficmanager.net, store-images.s-microsoft.com-c.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, a1449.dscg2.akamai.net, arc.msn.com, acctcdn.trafficmanager.net, skypedataprdcolwus02.cloudapp.net, www.microsoft.com-c-3.edgekey.net.globalredir.akadns.net, msagfx.live.com-6.edgekey.net, mscomajax.vo.msecnd.net, windows.microsoft.com.edgekey.net, a.rfihub.com.akadns.net, img-prod-cms-rt-microsoft-com.akamaized.net, windows.microsoft.com, waws-prod-ch1-019.cloudapp.net, target.microsoft.com, 20221-ipv4e.farm.prod.sharepointonline.com.akadns.net, e1723.g.akamaiedge.net, ctldl.windowsupdate.com, aadcdnoriginneu.ec.azureedge.net, web.vortex.data.microsoft.com, lgincdnvzeuno.azureedge.net, a-0001.a-afdentry.net.trafficmanager.net, privacy.microsoft.com, e16646.dscg.akamaiedge.net, e13678.dscg.akamaiedge.net, skypedataprdcolwus16.cloudapp.net, www.microsoft.com, c1.microsoft.com Report size exceeded maximum capacity and may have missing behavior information. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtReadVirtualMemory calls found. VT rate limit hit for: https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9

Simulations

Behavior and APIs

Time	Type	Description
21:58:52	API Interceptor	1x Sleep call for process: dllhost.exe modified

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\4JV84ELQ\www.microsoft[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	13
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aKb:JFKb
MD5:	C1DDEA3EF6BBEF3E7060A1A9AD89E4C5
SHA1:	35E3224FCBD3E1AF306F2B6A2C6BBEA9B0867966
SHA-256:	B71E4D17274636B97179BA2D97C742735B6510EB54F22893D3A2DAFF2CEB28DB
SHA-512:	6BE8CEC7C862AFAE5B37AA32DC5BB45912881A3276606DA41BF808A4EF92C318B355E616BF45A257B995520D72B7C08752C0BE445DCEADE5CF79F73480910FED
Malicious:	false
Reputation:	low
Preview:	<root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\KB8ECSTC\publisher.liveperson[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	2.469670487371862
Encrypted:	false
SSDEEP:	3:D90aK1r0aKb:JFK1rFKb
MD5:	132294CA22370B52822C17DCB5BE3AF6
SHA1:	DD26B82638AD38AD471F7621A9EB79FED448A71C
SHA-256:	451ABBE0AEFC000F49967DABF8D42344D146429F03C8C8D4AE5E33FF9963CF77
SHA-512:	6D5808CAD199A785C82763C68F0AE1F4938C304B46B70529EA26B3D300EF9430AD496C688D95D01588576B3A577001D62245D98137FD5CD825AD62E17D36F15C
Malicious:	false
Reputation:	low
Preview:	<root></root><root></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{B1F80D67-B795-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	69832
Entropy (8bit):	2.1890685010663664
Encrypted:	false
SSDEEP:	192:r5Z+ZP27W7tbfbNMzsLffNcsrN2EWfFTo3WtrNymMV5N1oxdYg:rvqey576zsjrNIfFcGtRSpWl
MD5:	50F5D3D6CDD5DC31525A7450E1F4AACD
SHA1:	CDC08B0B2DC8CFB67FB337E99CABAD79F0593537
SHA-256:	80373788539778DDA541EE4C222D8F68C6C95F2FB3492535798FEC7946F66C8E
SHA-512:	4C77BE7737BFA1D63F2C141958760CA7D2FD516777E64489CD82971D9D84FCA4FD53D8E5DF768334C779C6F83E01ADB512B0ED7AB0958A689DAD946DE78152AF
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B1F80D69-B795-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	98792
Entropy (8bit):	3.438271221548559
Encrypted:	false
SSDEEP:	3072:LhxxhxWhx9hxThxXE8NhxBhx9hxThx5E84hx1hx2hx9hxThxTE8ahxM:nHpQ
MD5:	FADEBB36D1D05A3BC665E5BBD14330C9
SHA1:	B150792E17051C8FB6FF838C46D4908D257989C5
SHA-256:	BA57D87271BE7016A310F89722D4CCC636F8C254D58C871A8336CD4F000DCC84
SHA-512:	ED2C58FE57E79F34C5193D3848361BA177432202A97910A77B00EA740BB299EC0D79B3CBFA7C4ADCD01939F319C2778B92A56603EEE85A4022A3487394A244A3
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{B87EB934-B795-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.5849867813044705
Encrypted:	false
SSDEEP:	48:IwWGcprovGwpa+EG4pQU2GrapbSlGQpKNG7HpRFTGIpX2RnGApm:rKZoZQ+06U4BSPAsTTFkhg
MD5:	A6C14F2EBE980F94C62CE895B4775DB1
SHA1:	527CB10C7F74D20F81DCE457EE62662FD80D68EE
SHA-256:	00CC1EE293AFA9DAB87B28E4B20351BD6254D2C4F12D3C9A3C2BC93739F4B1E0
SHA-512:	2F2957811ADD08A62BA364A8E24341F5A58FD69B8CAE502819AEE33DB3F1A2A0FAC37CA82BD9C733F0EF45B79EAD493D70DAEA3B74C13C935AF63DF3381D710A
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C7DAD766-B795-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	223386
Entropy (8bit):	2.859114694202881
Encrypted:	false
SSDEEP:	3072:AUNda+RnknGvRnkHmE7MpE7M2dE7MCCrd5LaXM2MqM6:t
MD5:	BD3E141BABE2BA8010E951A83ADCBFB2
SHA1:	DF58E92E852FC5F1E3D3087B3A3326633418DEF3
SHA-256:	13171A1DF2E4EA9A3F55510ED65152F0403AD71E08508B4E97D8908584BFD973
SHA-512:	384F253A37CDB1F5B79EB16801C763100460C74D3770ABC242A79D65B8706315D108491D46EC069C1F3DEFAFBF3632994682FBD7E42B72449E28A79B36C9DA06
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D11906A9-B795-11EB-90E4-ECF4BB862DED}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	19032
Entropy (8bit):	1.5845224266559494
Encrypted:	false
SSDEEP:	48:Iw40GcprmgGwpaJG4pQBGrapbSnGQpKqG7HpRPTGIpX2AGApm:rnZNQL6RBSRAFTtFXg
MD5:	8BB8734C44CCEAD0EC95B26047BAED2E
SHA1:	B79494837E9F9A655394765BB3CC92A4E793FE92
SHA-256:	5818675CCB6EF5831C63434C02534B1131C058900939E2F54617998E9588D35F
SHA-512:	9CCFD831944EBE39268D3BBAB98BAB90B57F558583C52359C7D02E74DCADD4AA294D7F04C5A56BE1FEBC0C6194183357EC9F6DF123025046A32A46CAA211913E
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\ynfz0jx\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	36378
Entropy (8bit):	3.1628987794068735
Encrypted:	false
SSDEEP:	48:bARAYAYAGgyyyyyyyyyyyyyKA0nA9QQQQQF+rR+eR+eR+GgyyyyyyyyyyyyyQR+D:WQQQQQuf/mn4QQQQQ3+tZ
MD5:	8CA999FB0942F958F25B0651854487B3
SHA1:	5424394C390545506F09A35BF9025D21897005F8
SHA-256:	3BAD690DDFAA78B788DDFEF626AE5DC69604B9C417BFA68178DB889AD9586ED8
SHA-512:	91CB71F524486D7C736B4AC61070087456E7052F498AEFC5FDC06F7C417E7CEEE0D0D2D7367FC8558C891B2AFF02C3BF6E039364209E0AD7575261F5C58C13B3
Malicious:	false
Reputation:	low
Preview:	(.h.t.t.p.s.:././.w.w.w...m.i.c.r.o.s.o.f.t...c.o.m./.f.a.v.i.c.o.n...i.c.o.?.v.2.~(................h(......(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17833_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 120 x 51, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	9379
Entropy (8bit):	7.965581634932349
Encrypted:	false
SSDEEP:	192:OJG38qGxtZ47TF8bMkwZJQgwL5uvnBRVTvPb36fJsh7pE6DsO:Fsqw0F+MkCjwVEn3db3WOhVE6wO
MD5:	5E8F409003FCDCD12694A2B70EB01323
SHA1:	04CD5A76689DAE1188956B1BB799B75966AD8D8D
SHA-256:	BD722B96E110791578292B16468D45A2564B7EF8CE694BE8E151A91AC3EEAEF7
SHA-512:	5C0575D6B27738E05F03EF86A9415B8C059224CDFF74EB4FD46DB4E5438EFE38B2123A161514DE2CEDAC3796A29A70DB44758BF1D95FF594532E2587C08B0237
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17833_en_1.png
Preview:	.PNG........IHDR...x...3.....\..}....pHYs.........g..R....tIME.....6'.."T....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..w.eG}.?Uu.K.:O....F(.e%Y.......#..p..`........=fe....c.>>.c`.E.l0I.c..A...$........n.......LkF...{...u+}.~..0.X.$..Z.....4...........^L./G?6v.....{....z..:.N.[........G+....aL...sa+U,..v.V,..\..\|...4.^pk.[.b..UO...!.s..4.b.Y5Z.X....\|.;........H..oi....R.\|A....V.J.s.2......d.H...tA.{..._...r.g...W...^.3::..=o........s...L[/%./.%..}'.l.!..6.Y.p...9r...u.Y9.z.K.\..jZ..z2........N.\|.u/..yO.].0..e.......e..Y...Nn.\U.........<........H.J.1..A...%Z.:......%...\...0....].}!......D`.l...)...s.9..tf.&.\.?V,.]+Y...H.UI..lWp.......5.&`"...h (....<{z...It}.l.'...J.wS......w3 .9........b.uiM..$cq...1nlp.j.r....-...HJ")..a.....18..i.4..d.-[ B.[...H.B)...RYC.X......Ps....$...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17838_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 289 x 86, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	28084
Entropy (8bit):	7.98236040456328
Encrypted:	false
SSDEEP:	768:dpsyhPlXlGg9+LQK9zd+d5Nkr0FnwZwTt9odI:dplR0g9k5dQ++wSTth
MD5:	20170E6781ED8060A9D3A723DD592A83
SHA1:	E34F2FF24C9619416B04CB9002C3E8A90C2182C3
SHA-256:	6E622C1ECC31F9B456468BDC42182694319811E0BC97A60C8C3FD0B6EB6BCC3F
SHA-512:	A947A9BF90F36AC2F5815174C50607FAC79D2978E1BE735714BFE75338E53A4A37A0A79C3657AD6CA163F1D45CBB8A615E83A1A320654E85F26B307CAFB9A1A0
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17838_en_1.png
Preview:	.PNG........IHDR...!...V......M .....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx...e.u..[.9..^.]e[(.....F.hR..D[.h..i.?...O.f.......A....... i2@@4A.@.)Tefe...fw..s.{Y....A.`......=...\|{5.ZG.....\.\.$...+..+.O[.@.J..J>U...+..+.T.....J..S.+...+..OU.Uh.J..J>M....J..S.+...+..OU.@.J..J>U1.i_..\..'-W..\.\|.r.BWr%W....].\.W t%Wr%.... ]...o=[R..{ ...D"...(>\|./...../]../.v.Oy...p...K.....C.I .....%].....u...L.K.....\..%^....x.I..o1.%.T..h"B@.0J(.(D.m.3.?`.Z.7_......1F.zr../5....^.,.....x......5..J..d.J.@"AE.@.DP..o.....U.p./..........#"....K..s.}....l..z..9GQ.D%.3.EQ.^..>..u."......1FRJ(.....8 .0#~.4\|y8..#j..zX.EHy.&QD.A..N....L.7..5.a..w..I~.~??...n........a..u........$.$...A%$).n.......,.(...iT..G..2.F...R.Q.......I.....#he0. ....X.....5

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17844_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 143 x 89, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	11859
Entropy (8bit):	7.9688027356590085
Encrypted:	false
SSDEEP:	192:oO4bvMVMQFE4siG+v7ZXFA3cacLbgdIIdFp++qCVlr2LXu4vThePF:f4bvMVMQ+YF6TcLbSpFpIWBB9
MD5:	1C29AAF0AD54E4D8FB723A29F59A705B
SHA1:	FE0DAFF4432594DEC53F42080024B1BB11A5B04F
SHA-256:	C0DA6EFE7CD5540FBE0BB19E37D20D2E4709A10F1049F7E95D7F98138AEF3869
SHA-512:	533C7B7A5093595033F04CA66AEC672854A20728036EB7D0F8543639E86C4B4A174499085459BAA30B20DFDCA7F0BD7B12A8294254DADA2E32E46CCB770B1741
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17844_en_1.png
Preview:	.PNG........IHDR.......Y.......w.....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..y......ER.......lc......0.thl 8=.{....~C&....3Lf.&.qO.;...1IO&m...f..O.qcc 1../.....TR.$.2..T..Y......#.......o...<..8..z..d<l^~.0.Z~.n)......Qw...G.w....eJ.#..,.q.]9..yaD.A@...B.#..,.c"y...9..3^..V.cA...q..x!..... ..>..V.'..y.'.2.....A.fQ..o.....[;.T.=..8..g>..Uc....=.'.S.L^.p..r....S....O..z. ..Z_f1.g<yp.IR..\a.w._...[.8...g>yN..Y.\|.8..#.g...A...../..<oF.g....q........j...p..8.zL..s"Yfm...g^...Qy.~..o......eD.\.'.X.$.....B.....2uw..3....7w.0fO....).&./..u]$i...0!\|t.<.86y.g.^.%..Q..~=..A...#.T.....v.i.... ...!_}..2.#B....W&X. .....B..%.....L....\|...'.UuPB.%..x..wl..M....%"...Q(+.b:....@f...KH..5...v...`#...qy.o.S.....%\..9,.d.!$ ..pKY.h..;......S........(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17847_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 200 x 47, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10256
Entropy (8bit):	7.96678890795153
Encrypted:	false
SSDEEP:	192:K7DxypTrhsacCf5S2qlrkY8FTUU4lkVA5gbKXV35rC3/sAytNTouxHhGKqK4:+ypxsTChj6rkY8q0VWV3FC3E3xBDqK4
MD5:	8AF4E3FF6548F3F1C86FE74B2797DEC9
SHA1:	664CE47730D8979E8592EEABD0F546EB8196AB5B
SHA-256:	4C42A90A51CA2068BEFDE3820B6753F6BD48398657983C979CC6598F22AF5C26
SHA-512:	E8EAAD6C9028FD1BB521C5167B994CC94EB4D9BB185DAA137B5EB6BF583B0F0FDF002AF42E2E6BF2A9F59D82A4C3EC22B0C308175F3E3F153F773991661020A9
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17847_en_1.png
Preview:	.PNG........IHDR......./.............pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..yxTE..?w.;.}......A......E...q\PG.E..W.}.A.7T\...Q.....A.UB......;I'...[...4.ME.\|..>In.:U.N.:.\|."m.Q'..h..o..%R......lj...N....:..F......"SS.@.6.E.....#t..]..{>..P....!4.......Q.....y..,.6F.../.Ft.h.o#$3(n... .H.4.<Dw.V..o&........o-...-.w...F.m@{.k4+.D..A....2........ Z.L$...L........>.J^!...ZR..........[..W..,..n.}~9..l..c.<..v.A.8.#..8..b....!R\|5.m......t.......ty.....l........Gp.q.f..h.3...'F.LJ.UK?b..W.jc..U....Br...... ".C...PL..=K).8v...IR@../...pUT5...%>.#h.. ..Jb.*M......i..dg.PS."zH..P......>.#..8.6.l...[.NMT.x..}.6$.)k\.u.PU.#h..'!..9dgg.&....b8.."..b.@a..1/T.....;.P..Av.@..PU.!h.RU...^.....s.)....n....]...b..BJKK.Dc..z.+...HJ.Bo@.,H..N.u..}E..t..n....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17853_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 204 x 116, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	10429
Entropy (8bit):	7.968104946499842
Encrypted:	false
SSDEEP:	192:aE3LZZRlRrJm3RXldqgjDaUfs+11gaVC6i/A2K2YU8COxT1I0Ia/:FXdJmhV4gjnf111iD/dKPU8Z3nIa/
MD5:	A0C38D4588A2252CF2A6DA3859BA3CB5
SHA1:	60729E92501EF7D34A3B8789C4A001226ECF4C8D
SHA-256:	390398E6948898FA393EF025497E4B775D24C4F2446EC1EEDFA7F5CA6F99E978
SHA-512:	5A6D08759033C2BEDA7994C19CCD40755F9DC9B85A52D02FEFAD59DBD8A5AF01B9253CC690A96941801D8E5C2091BDB37D365821D0AD586FAC77C2E91642B6B5
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17853_en_1.png
Preview:	.PNG........IHDR.......t............pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..}..........A.3..V.k...58A.;.r...v.k...R.........\]k...U...).....n.m].u..s]7.].u......w.>....+~.o.MM..~5.....-....h..S...........h.M...}d.....VOc...d..........z7....vg'..@.......fZ.)ie..........1e.Vu.G.^....Uu.`....^..Z....+.av.Vw..B..%./..zo-.E....h;.6...'....j..z.%R...S.;./.Ax.~.x8s.......... ......Y.9..M..........7-.ksZ'.P..4..9O...M.Y.......\.... .......+.C.?.V.0..7.G;.G......m.%=..Q..n..\|<...>...7..:Y..,..#uXiC52....,....n..\..f.~4......1....F,...K.I...0i[.....U;...%......4&T\.;..l.Qi..2b..........,.#.iM...mBx$`...h3z..=.%+. l...&..#.,.("..W]{..2...........jF.8*.W\@>.v...z....o){."R...c..0%....3.S)o..S..es.A.s.f.K...W...p...}:.J.b.......T.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17859_en_1[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 168 x 28
Category:	downloaded
Size (bytes):	2031
Entropy (8bit):	6.689870125542551
Encrypted:	false
SSDEEP:	48:tHU2k7N7YtG8EqNKf4O4GPS/XLZTc6f59C3d:pU2k7N7YrEoKfx4B2SW
MD5:	18C22A0D66266D8A25C0337FEE70F165
SHA1:	B4C9C09623891470A76D16061BB3CA8D0E817636
SHA-256:	ED169A2FDF1904FB34E0486950FC8E34E61D24274CCBDA7F3F9D5D1724FCA440
SHA-512:	CD36145E0FFBE83809BD9EF2253617F0C56D0CFB6E2198A81AF71FCFA1557FF47AA76D80D506C5B0B60036B9AD228F3074B03F12E53182E49CE74ADEB199F698
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17859_en_1.gif
Preview:	GIF89a....w..!.......,......................................................................................................................................3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f.........3..3.33.f3..3..3..33.33333f33.33.33.3f.3f33ff3f.3f.3f.3..3.33.f3..3..3..3..3.33.f3.3..3..3..3.33.f3..3..3..f..f.3f.ff..f..f..f3.f33f3ff3.f3.f3.ff.ff3fffff.ff.ff.f..f.3f.ff..f..f..f..f.3f.ff.f..f..f..f.3f.ff..f..f.......3..f.........3..33.3f.3..3.3..f..f3.ff.f..f.f......3..f.............3..f............3..f.............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f....3.f...........3..f.............3..f..............3..f..........3..33.3f.3..3..3..f..f3.ff.f..f..f......3..f..............3..f.............3..f...............H......\...m..V.....3j..m.@..T.R.g..-0R.L.b.K.&M.L.......v4...@.R....../.].c.K-.F..........x...B..8U."..."U...v.._....4..-.l........2$....MS...*.C..m..\....Q......V.C.P..2j...:...o.?.k

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17865_en_1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	"\002", baseline, precision 8, 237x48, frames 3
Category:	downloaded
Size (bytes):	3071
Entropy (8bit):	7.792844830942224
Encrypted:	false
SSDEEP:	48:1aOkVKIuESA/jThDCBsq/Mg7Y68l5bpO5bwlhY26Ubfge+q773nW+GqE8AAURW:mKzEV1DCZDUN5Fo9Ubfg7q7jnW92AAcW
MD5:	07C7598A44559BE4E2134267482D3913
SHA1:	8AEF72F4D63DFDFCF81D311BC53E82B68553C7DC
SHA-256:	885EE27522482E4D020991D91F7081C1C660877CF01DABAC8607991F5368B7BF
SHA-512:	FEC57BA3FE34F724CA3AD43F6A6684075CAD0BD78993791C33A93608669368E59D09915B2C87E6CB47E3F9F8848042FD35F6852421C52AD7BA0661F8ADAFD42A
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17865_en_1.jpg
Preview:	......JFIF.....`.`......LEAD Technologies Inc. V1.01................................ ."!....#(3+#&0&..,=-0569:9"+?C>8C3897...........7$.$77777777777777777777777777777777777777777777777777................Z.............................................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................0........................?...6.)\.W........(....'.:....c./..rY.......#.:l9...x.HdY#a..r..+9GPL..w....2(.2(..E..h......4....dP......E........3@.E.&E..h......4.P.@.(c0<S...=..F..PV.=..>.5p..l...SY\k...z..!.3)B..G@..=.F.D.kh.....^.p.7...........1^]./X....R.H.a..........R.....<C.Xt-*.....;.P.....5.a..W5..I.....%._ns....1<;......h..b.%.n.Ojv...D

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17867_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 227 x 100, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	14656
Entropy (8bit):	7.972416507342981
Encrypted:	false
SSDEEP:	384:y9/zLj2koOLGIO9BqR4oKIIBR4GYIzQ7UnAPuajh:y9bLyPOz0M6EMRsqQ7Untyh
MD5:	C1A78032E5E4FBF1B3593A9A7438338B
SHA1:	EB3C4DC89D757159A42EBD4890F44407BF1F3770
SHA-256:	34ED42CFE0851164BF9F63E329D2EBDEF4BFB9BC34ACA24ABBC25E5E74BB0BB7
SHA-512:	F64AA5A7C4E409C606064C336DF414D2F158963263F244497FBC95EDD6ADEDFB39DC47BD81EC300A63870556982F75627DF0EFE1E1C8A0F190B5C0E50A31ABC5
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17867_en_1.png
Preview:	.PNG........IHDR.......d......Y.{....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..y.eYQ'...Z{.3.)o..P.U.HQ2X..P.s..A.h...T...[.~.....N-..m.....(...@Q..5.<g..=...x..sn.!..}O.....uN.^s."......k.F..\|.;.Fk.e......$u....&.k..5I].'..I..=9hMR...Ak..FO.Z..5zr......$u....&.k..5I].'..I..=9hMR...Ak..FO.Z..5zr......$u....&.k.. ..w....A4#...T.A..%_.k.2.4......?..'..3/x.n.Q!.............w..U......."...s....]..# .#....?.....[.q..\.jA.7]..\|u4.E....../..u...".FC$.P..`.%_.k..Y.....3a.i..$....U.....T8..t.A. ..q._....../......I.W...4:....4.4....T..J...5...+.V...0c...FB).l...4..@U.y:qN..@..L.-..F!.....'k.5.W...@. .@"......#RY#. .eip.1:...j....U.......SS$W.bY.....4Q.DSg.g>.....UD\|-..X.V..Yn...WE...Q.._.>..qQ.....j..A..%.(...U.....J/jJ.f.P5UO..`...$I.A3B...F.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\17869_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 203 x 53, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	9077
Entropy (8bit):	7.9651577930677595
Encrypted:	false
SSDEEP:	192:Ipl8McB9+aqYngmIXM9a46Jstj4M+qFTmdWp+PqxVQzNYYJdHZunIfLa0mX7:/MQbvIyV6JstbBmDwQxrJYnga0A
MD5:	A230EBE8DB8EC19312079AA15C61D4B5
SHA1:	3C48A4A55A633A202E57965FFE774CA1A597C08F
SHA-256:	B2355B9288E1E9754EC5790CAE883B92E86D49299E47FD0CEC3C1A95313B86FF
SHA-512:	B109C08BCD9B38CE2FF69B52F4618CD18983A739C8756162BB7058121A62488D54EB4184411E005CB0ED7CFB038012F754FEE451B8140A559F7264CA926E9007
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17869_en_1.png
Preview:	.PNG........IHDR.......5......c.Z....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'.. .IDATx..y\\.....J.B.C ,Y.d...lF...h]j[.m..[....j[[......j..V..Y.J...$D.K......f`.{.?...3.`...}>\|.2..s....,..,.2.q...+.Wz.....[.U..j....:.[....M......_..#.d.6'..Fs....~.{I....\.HC..q8\...q.L.u..$.Lhh?..C.5*..~.K4...?o.(.b..&M...}^.P$#;...[...F....$@...&.ti.Z..f.......\.u.A...K.....L.?....b.i>.4....m...X.$.;..C..".........f..d..7A...FE.^M`._..&.N..V.)#"x..9....ZD.r....X..}G!.D... .d....c.9Y.}.....`...?..VMYY#.u...f.{..............A..y....6..@.dZ[....%..\|...Xb....o..E>..9...D.A..,c5.....422J.....w.a...[[..=Z...%y.k.....o...Dxx.e..u.kRX.v..(p.1<..4.&.(.]>.m.pl.h.....f....Y.O....`......<U.......e.x^xq+....c..W......V....>..+..m........8p....4..$%Ep..c.k.LVv..';..&..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel15_Mosaic_Item3_Lenovo[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 425x425, frames 3
Category:	downloaded
Size (bytes):	27942
Entropy (8bit):	7.936119416177169
Encrypted:	false
SSDEEP:	384:fg+BL+89mhvMDvlVuBHqs43UIZWv5kT2LLlMaHEyVr5IsfTo5L3mYh0jU:I+BS8UmwM3UuwCKVkyVr5IiT8L3mw0o
MD5:	6173503CE3F00A780A6670C9DC70F827
SHA1:	4BC8B0609EE1206C853FCE3D439E88BBD37B6E69
SHA-256:	B682745215FD5A4E6B868EA1F0C74F393FD112F9926ECF778C0302DDD1760C75
SHA-512:	E4704D541438B7D68615AB549E0A86ABEFD3D4E466153D1A71A799F3A463CA32A5BCABE5F2CDFEC507AF1BD579B453984A6397A8B300720FEFD5D581DCC5C63E
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel15_Mosaic_Item3_Lenovo.jpg?version=8de5791c-f31b-2106-bbe6-da0d0114083c
Preview:	......JFIF................................................................................................................................................................................................................%!.N/!2Ri.M.....J1...i1E.q%7 ...!....Q.M.J5.6!....2D..."M........,tn...... $J2cR.'%!$......o...i4.H..3.0m.(..G..`5'.......Z...6..C..j1hm.(....].w..X..d.).A'.......@J....U.......v8..58.L% .ANI..q.8qj.g.h......TLR.2E.).`A6..x..Zj.\7>....../u..m..$.\.HD......R...\9O5r.......S.E.1L..R# 2.M.........8&...v.........6A.).\|'/........9......U. 9.q..&...19.6.'.1.x...5..=.=..Y..8.r.10..&.....s.....e...<G.....\&A.Q.CLMM.1..N..........Wz_.....o.m...JHS..18I........W.&o....g..K.....~.9...RR...&..e..R...o^_....g......H..5.y....<"1.jj)2H%(.2.]._V.{...zr.1z.5....k..;'....Y,i7.62.,.U...^..1a..Q.x-.:....`.....1iA..Bi)MN.#,u.?.....\|[H.x._}......%...v}......I..'..UjZ....y.y=.}Y%?n.&\..{......V<(qLS.D.. S.4.EJ.S._*..?..#.kO....xxG..........F...w.MB.M

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel15_Mosaic_Item4_Laptop[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 425x425, frames 3
Category:	downloaded
Size (bytes):	29197
Entropy (8bit):	7.912570848111608
Encrypted:	false
SSDEEP:	768:KW0ns7jIIjz+8W1Y1fvbUNYW5H+x3OTHysMB:KW0sPIIj67Y1fY7JY3O+fB
MD5:	FB97AEC9612294AB06BA6B9DEDC89883
SHA1:	247C3E4E9CEF5DDDD2EE28593AA079E5C2C85E2D
SHA-256:	0A6CF55F2709D61ECB5F7D7D00623949EF2832D682F439560B55230D2EF8B9EB
SHA-512:	634FB7410F42E19BAB84ED5ABC89376EA580E4535AC9FDCDF6C161BCE8A6BE42B76BC2B9720890E21E42E64E14B89F59C6F1570295F1EEBD124B4ED12D246B87
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel15_Mosaic_Item4_Laptop.jpg?version=f0064a2e-27a2-92cd-adb6-98d8fa9518f5
Preview:	......JFIF..............................................................................................................................................................................................................`.G..h.~..Y..6.k...o.x...m...z......S....8^f.g...=.._..P..rg..=..<..>.3c..o..sk..w."?.=.K._?..?.._...Q.........G.o..:..3a.d.....lvi.......N......{_n.....esu.20....{;....)...~.....{..{....2.~.....1...p~....^_....l.z.....{...[......=^.mt.9>[.....c......?.Vy...../....?.iz.........z......9...l....j..P~....}.ym\t.L.vz.;......9.C....{...j.b...{...;..J.Z.>.....m..=Id....}..1.Q.q.E..L;:Yo....R.m\|.1.....l..Km...!.1.D..?...]}.\..e........<M..uvs..*..>.S.....t9...\ym..).5o..4c..{...=?g...+....>.x.....+.....t..o...u...._....~....}-.1.<8pc...)...>...Kc..c.c..........j.g.b.......\|....g...\X.S..X.p.....+.X..eX.}..1...W....c.L5.Z..s.\5.8....7.o.`...<..~...c_]j.c....pk......+..._. .....z.........c.....Y....Ek.f..r}b.4...(.c.f...2N^.K{cgg6..{Mr.....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel15_Mosaic_Item5_FingerPrint[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 425x425, frames 3
Category:	downloaded
Size (bytes):	33923
Entropy (8bit):	7.947833372756695
Encrypted:	false
SSDEEP:	768:OWcBlOZneG/+Hz4biqn+tuPJcgki+nwxjMXe:ObTOZn5/m4biZtKkiQ4jn
MD5:	E9C9090F342613396B11AD28B49074E3
SHA1:	B01241A8F003B6F9771ADC02E9A87CED7F5D3C7F
SHA-256:	65AD9702736D35C677712659D86108D310E0990B4FD84D2B8B5884DB5ACF0367
SHA-512:	05C1630F3F86E543ADC05549935A64C2B0516ACCEE9BD7E77295B6CCB911E32456521056F67A00FA8A9623A86DA5CEFB2B3FDC2390363B1827733669C2CAFC2E
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel15_Mosaic_Item5_FingerPrint.jpg?version=cfeec1b3-0aca-ea61-5d21-82f3fc9bd1a7
Preview:	......JFIF..............................................................................................................................................................................................................d..%lD Z.h..X.. ...H$..BHD.Z.H.2..X.d.....e`.... 0.$ Hd.I+^..`.XI..l%M.........". ..{.C$....^.....R.$.Hd.I...G{ .....2....3.$2@`..`0......[Ih.".....'-.. ....B-...?...BI..............21.d>.r/t>.."AEb..{.......v1.vVV^_ ..3..9..3.u...i.kC.......].k2......e\|....YKAx...%.....0.Y.e.....Y9y..~f.....2V.^..m.6...k..e..........D...0.yj...K.nnK...v..k.....C?#R......iabM....k5.fC..........f.....Z.M.S{.Z...].k^....egeg...i..X.2...e....f]..c...=.YY99....._!$.K.mick...Z.k.....fS........}-....7...../wF^._\|.7+%.y.y.Y.yGDI.^....6...v...H,.cX.?%..99.99.......c!,..fg=.....b..q.^../k5.c..5..Ca..6.......nw1...\|j.$..krY...........{.u..KBd$...~u....;VNzz...S...._Oe...nC...O0....y2Bd1...\?.u.....'.p.G..3...]6..9.{.22......`..^..=..%.&d...'.q..j......~..#..3:.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel15_Mosaic_Item6_Blue[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, little-endian, direntries=0], baseline, precision 8, 890x425, frames 3
Category:	downloaded
Size (bytes):	5648
Entropy (8bit):	1.743138723448018
Encrypted:	false
SSDEEP:	24:lK1h6A1aWwh82lYSgeobh9VbgbhGT3TyJEumGumNG0jJdYOkda:y11Lvn+Uh9RMhGCJEdGdNVJHr
MD5:	206E4799EBAD60F1C70129252BC5A7D1
SHA1:	4AFC730F7C9F2AD753E7F040F1B692E7C2AF9854
SHA-256:	260D43BC3C998FE12ABAD302F3BD0F41A4660EF8924269F970DE79F3AB33957A
SHA-512:	AEB398356C740CCBF0916AFCE49A45B5A484AD671154646B45C9081315F7F70ED803B4C3ED5D7092EEEB9DC48BDA735F9250589D435B7004717CCC6A8C8458E4
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel15_Mosaic_Item6_Blue.jpg?version=838eebb7-ef23-731b-ee07-deea2ae49dc8
Preview:	......Exif..II*.................Ducky.......K......http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.6-c148 79.164036, 2019/08/13-01:06:57 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmpMM:DocumentID="xmp.did:EA866DAA5CBA11EA88EEDBD181122FD0" xmpMM:InstanceID="xmp.iid:EA866DA95CBA11EA88EEDBD181122FD0" xmp:CreatorTool="Adobe Photoshop 2020 Macintosh"> <xmpMM:DerivedFrom stRef:instanceID="8F6B98E30D2E75BCEAE1C4EA6B2EEB5C" stRef:documentID="8F6B98E30D2E75BCEAE1C4EA6B2EEB5C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>....Adobe.d................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel_LinkNav_Briefcase_I_[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	770
Entropy (8bit):	5.4230480059503465
Encrypted:	false
SSDEEP:	12:TMHdPhGi/nzV0xoc/KYcc+jzHrKxft5SWjMa/7JBKnU6+WvWQ:2dMA5cLPyLkMa/NkU/Wvr
MD5:	E77F8C94269F5DA46F9E2D260F0E8A68
SHA1:	D5A6B5C2D4A3E08043B1C9D8484C744638DEB46D
SHA-256:	AFCCD82C63D87D6BD6390EE7CA32E6004446444A5278D83D2DC5F09DF20224FF
SHA-512:	5315E06EF854447173B9AED95357E53B17CDA3F4B078002F4C0ACAC2C6CDA1B9A1B05FC717928A069C837161255B383D6E389DD6235ED078DF5AB63362474DE6
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel_LinkNav_Briefcase_I_.svg?version=19243b0e-4d5a-e345-6747-92b9ef181fa2
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 25.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Isolation_Mode" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px".. y="0px" viewBox="0 0 64 64" style="enable-background:new 0 0 64 64;" xml:space="preserve">.<style type="text/css">...st0{fill:#0078D5;}.</style>.<g>..<path class="st0" d="M64,16v40H0V16h20v-4c0-0.5,0.1-1.1,0.3-1.6c0.2-0.5,0.5-0.9,0.9-1.2c0.4-0.4,0.8-0.7,1.3-0.9...C22.9,8.1,23.5,8,24,8h16c0.5,0,1.1,0.1,1.6,0.3s0.9,0.5,1.3,0.9c0.4,0.4,0.7,0.8,0.9,1.3s0.3,1,0.3,1.5v4H64z M5,21v4.8l19,10V32...h16v3.7l19-10V21H5z M59,51V31.2l-19,10V44H24v-2.7l-19-10V51H59z M25,16h14v-3H25V16z M28,36v4h8v-4H28z"/>.</g>.</svg>.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1920_Panel_LinkNav_PersonalShop_V2[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2376
Entropy (8bit):	5.0211850066186505
Encrypted:	false
SSDEEP:	48:cMAvf3y6YClc9jQcFESx6oCOPr6NZZf9shFGZ83:WvfC6YClQFFESxHVWNZdmhd
MD5:	AC7359B0D3C07F3C436F8B64E279EBEA
SHA1:	7CCC3AFEAA7E0669069FB38D2E583C979B8FF234
SHA-256:	E0AD01D0402E6C4D87CCCAC0571B7FFE9402CF3FC22ED036B04AFCD16CCCFEFC
SHA-512:	9C22DF160217048FC1F2E6D001D5FFBA38680BD4B6CBD412B7DB583D6B2FDDDAAF5883DEA4CB44DE386C9A8640BBB1539FAEC18CBD6434EC7D5E8649252968FB
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel_LinkNav_PersonalShop_V2.svg?version=34def8c2-5109-9555-2860-db5f024de09c
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 25.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="Layer_1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px".. viewBox="0 0 64 64" style="enable-background:new 0 0 64 64;" xml:space="preserve">.<style type="text/css">...st0{fill:#0078D5;}.</style>.<g>..<path class="st0" d="M63.2,57.7c-0.4-1.4-1.1-2.8-2-4.2c-1-1.4-2.1-2.5-3.3-3.4c-0.6-0.5-1.4-1-2.4-1.5c0.2-0.2,0.5-0.4,0.7-0.7...c0.7-0.7,1.3-1.5,1.9-2.4c0.6-1.1,1-1.9,1.2-2.7c0.7-2.4,0.5-5-0.5-7.4c-1.2-2.7-3.3-4.8-6-6c-2.8-1.2-6-1.2-8.8,0...c-2.7,1.2-4.8,3.3-6,6c-1,2.5-1.1,5-0.5,7.4c0.2,1,0.7,1.9,1.2,2.8c0.4,0.7,1.1,1.5,1.9,2.4c0.3,0.3,0.5,0.5,0.7,0.7...c-0.7,0.3-1.2,0.7-1.9,1.2L39,50.3c-1.2,0.8-2.2,1.9-3.3,3.4c-1.9,2.7-2.8,5.7-2.8,9c0,0.6,0.4,1.1,1.1,1.1h2c0.1,0,0.3,0,0.4-0.1...h0.1h0.2l0.1-0.1c0.3-0.3,0.3-0.5,0.3-0.8c0-1.1,0.1-2.2,0.4-3c0.2-1,0.6-1.8,1.1-2.7c1-1.6,2.4-3,4-4c1.8-1,3.7-1.5,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\1x1clear[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	3.122191481864228
Encrypted:	false
SSDEEP:	3:CUTxls/1h/:7lU/
MD5:	F8614595FBA50D96389708A4135776E4
SHA1:	D456164972B508172CEE9D1CC06D1EA35CA15C21
SHA-256:	7122DE322879A654121EA250AEAC94BD9993F914909F786C98988ADBD0A25D5D
SHA-512:	299A7712B27C726C681E42A8246F8116205133DBE15D549F8419049DF3FCFDAB143E9A29212A2615F73E31A1EF34D1F6CE0EC093ECEAD037083FA40A075819D2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/9be151e5/coreui.statics/images/1x1clear.gif
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2_bc3d32a696895f78c19df6c717586a5d[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/backgrounds/2_bc3d32a696895f78c19df6c717586a5d.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\2_vD0yppaJX3jBnfbHF1hqXQ2[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1864
Entropy (8bit):	5.222032823730197
Encrypted:	false
SSDEEP:	48:yvswNIBLBpJawmMH44log6gw/MHm7pJroog6gwkMH9Xog6gwdMHdqdyqog7C:ykfXYx+odPcs9B
MD5:	BC3D32A696895F78C19DF6C717586A5D
SHA1:	9191CB156A30A3ED79C44C0A16C95159E8FF689D
SHA-256:	0E88B6FCBB8591EDFD28184FA70A04B6DD3AF8A14367C628EDD7CABA32E58C68
SHA-512:	8D4F38907F3423A86D90575772B292680F7970527D2090FC005F9B096CC81D3F279D59AD76EAFCA30C3D4BBAF2276BBAA753E2A46A149424CF6F1C319DED5A64
Malicious:	false
Reputation:	low
IE Cache URL:	https://acctcdn.msauth.net/images/2_vD0yppaJX3jBnfbHF1hqXQ2.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" width="1920" height="1080" fill="none"><g opacity=".2" clip-path="url(#E)"><path d="M1466.4 1795.2c950.37 0 1720.8-627.52 1720.8-1401.6S2416.77-1008 1466.4-1008-254.4-380.482-254.4 393.6s770.428 1401.6 1720.8 1401.6z" fill="url(#A)"/><path d="M394.2 1815.6c746.58 0 1351.8-493.2 1351.8-1101.6S1140.78-387.6 394.2-387.6-957.6 105.603-957.6 714-352.38 1815.6 394.2 1815.6z" fill="url(#B)"/><path d="M1548.6 1885.2c631.92 0 1144.2-417.45 1144.2-932.4S2180.52 20.4 1548.6 20.4 404.4 437.85 404.4 952.8s512.276 932.4 1144.2 932.4z" fill="url(#C)"/><path d="M265.8 1215.6c690.246 0 1249.8-455.595 1249.8-1017.6S956.046-819.6 265.8-819.6-984-364.005-984 198-424.445 1215.6 265.8 1215.6z" fill="url(#D)"/></g><defs><radialGradient id="A" cx="0" cy="0" r="1" gradientUnits="userSpaceOnUse" gradientTransform="translate(1466.4 393.6) rotate(90) scale(1401.6 1720.8)"><stop stop-color="#107c10"/><stop offset="1" stop-color="#c4c4c4" stop-opacity="0"/></radialGradient><r

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\34246619Platform_20210506_34246619[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	3931
Entropy (8bit):	4.8079273430772025
Encrypted:	false
SSDEEP:	96:JbXNfza6QXVCDvtHwjavQg5xXVsryRyAcgo039V768KLaa2KATNp6+/QX4PZNwTc:Jbhe6QFaHxvB5xXVsryoAcgo039V768X
MD5:	2113FF57954680F90A4CDDD5A616F83F
SHA1:	5559FC2270328D3962FDACB108519786192B04BA
SHA-256:	07BE01E5A83F3D70C4D9B22FDB1F00BF0EADB88EF97C548E7122C7698D1A972E
SHA-512:	2475022E61CCD996B77435FCAAB3361EAB53221EA1D2AEB8CFD637064236964C9E95B3A685713D192D394A4CEF6DED801915AF64E76A85582518D068DA9F4B61
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/en-us/videoplayer/resources/34246619Platform_20210506_34246619
Preview:	{"agegate_day":"Day","agegate_enterdate":"Enter your date of birth","agegate_fail":"You may not access this content.","agegate_month":"Month","agegate_submit":"Submit","agegate_year":"Year","audio_tracks":"Audio tracks","agegate_dateorder":"m/d/yyyy","browserunsupported":"We\u0027re sorry, but your browser does not support this video.","browserunsupported_download":"Please download a copy of this video to view on your device:","cc_appearance":"Appearance","cc_color_black":"Black","cc_color_blue":"Blue","cc_color_cyan":"Cyan","cc_color_green":"Green","cc_color_grey":"Grey","cc_color_magenta":"Magenta","cc_color_red":"Red","cc_color_white":"White","cc_color_yellow":"Yellow","cc_customize":"Customize","cc_font_name_casual":"Casual","cc_font_name_cursive":"Cursive","cc_font_name_monospacedsansserif":"Monospaced Sans Serif","cc_font_name_monospacedserif":"Monospaced Serif","cc_font_name_proportionalsansserif":"Proportional Sans Serif","cc_font_name_proportionalserif":"Proportional Serif","c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\52-7ec320[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	169165
Entropy (8bit):	5.043574839315944
Encrypted:	false
SSDEEP:	3072:jzCPZkTP3bDLH0tfRqQ0xtLfj4ZDSIpTt813viY8R1j35Ap7LQZLPPJH7PAbOCxh:jlZAjLkJeTC
MD5:	FC80EE0EE4C1195A0A3573C1F22E53A8
SHA1:	82AEF853A84BE4A2C3684E67ED83F577DF61557A
SHA-256:	1B61B75684F6AC70F426526277CC6730A26CA157B7632FF0EB6A2DC4D15D94C8
SHA-512:	C367661A89582A133F88D6E141BAF95AF4C3DA42ED27954B856DD52B1D2593A9ED8B1EFE4BC176F845F5BD2FCDF14CEEA172AF7F68ACB334ADA871CD99F2BAFA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/16-3b4837/cf-7f2b14/7b-5ab060/b2-7c2f2c/af-85090f/b0-adecbe/42-6d7c67/52-7ec320?ver=2.0&_cf=20210415
Preview:	@charset "UTF-8";./! \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.body{margin:0}.context-uh

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\52-7ec320[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	266727
Entropy (8bit):	5.0713816871675546
Encrypted:	false
SSDEEP:	3072:iwzddg8HPbn/hL4fbv3DlF+ERyfJY6F0AJL55gGHjkzmEeTPNbaRgJ4J0ZRV8+uz:LLkJeTvZgTFR
MD5:	CD550A08D90AFDA203C05C2E1206C910
SHA1:	55556B38A332624E453B88EDA0E7DF28F08839D9
SHA-256:	484C03B4E10AC1E2C8FB531A3988A7F95A3F9FFA21E3CEDC1AB826565412695F
SHA-512:	5EED162FCCAFB14A9E9BF7775700C5DA9B5F7019CAA59B33CEB451AC020E21A0FFFD53D29E72D76F644F2540F2BF9A763F3761196261DE7F2ACDA8953F3CFDC3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/west-european/MICROSOFT-365/_scrf/css/themes=default.device=uplevel_web_pc_ie/42-6d7c67/e7-e4b626/4b-514590/2c-635258/97-8c42a8/33-100b4f/81-8f5a7f/b5-285959/c3-c2d1cf/21-7d6c87/c7-542157/c3-953460/71-219a9b/6c-2dbc3f/bf-60f63e/50-55fec2/c0-379397/fd-9178b9/52-7ec320?ver=2.0&_cf=20210415
Preview:	@charset "UTF-8";.x-hidden-none-mobile-vp{display:none !important}@media screen and (-ms-high-contrast:active){.c-uhfh button,.c-uhfh .glyph-shopping-cart,.c-me .msame_Header{border:none !important}.c-logo{margin-right:1px;border:none !important;outline:none !important}.c-logo.c-cat-logo:focus>span:before,.c-logo.c-cat-logo:hover>span:before{background:WindowText}.c-uhf-nav-link{border:none !important}.c-uhf-nav-link:hover{text-decoration:underline !important}#search{background:Window;color:WindowText}#search span{vertical-align:top}.c-uhfh.c-sgl-stck .c-uhf-menu button:focus,.c-uhfh.c-sgl-stck .c-uhf-menu span:focus,.c-uhfh.c-sgl-stck .c-uhf-menu a:focus,.c-uhfh.c-sgl-stck .c-uhf-nav-link:focus,.c-uhfh.c-sgl-stck .c-logo.c-sgl-stk-uhfLogo:focus,.c-uhfh.c-sgl-stck .c-logo.c-cat-logo:focus,.c-uhfh.c-sgl-stck .c-search #search:focus,.c-uhfh.c-sgl-stck .glyph-shopping-cart:focus,.c-uhfh.c-sgl-stck .glyph-global-nav-button:focus,.c-uhfh.c-sgl-stck .glyph-shopping-bag:focus{outline:2px soli

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\54-3764f9[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with very long lines
Category:	downloaded
Size (bytes):	30133
Entropy (8bit):	5.009269115634484
Encrypted:	false
SSDEEP:	768:68ErSq5YklxlNQ4gYq0qM+iPAeUxUDUzUBGjjjFjtrVrzdrd9:68ErSq5YkflNQ4gYq0qM+iPAeUxUDUzv
MD5:	6978BD8B7FDF8CA4360B783BBD4C33BF
SHA1:	C89ACEB6152ACA8F82F47F85FA48C0D9FB61926B
SHA-256:	D69E3231E28FBB9BB21122601BC7E55C83E31172D7E1087984E0544725385B4F
SHA-512:	62FEA0A26C353937F6541BB9433A0E6C926D3AA2D12E6CAA112373A07A3A11439DCE53B566093A580D608807A0977053E6D1275DDAD1F446A3EEC19F56B7FFF2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/west-european/mscomhp/_scrf/css/themes=default.device=uplevel_web_pc_ie/5a-0bf7d0/cd-a7831c/54-3764f9?ver=2.0&_cf=20210415
Preview:	.html,body,#primaryArea,#primaryR1,#videoplayeriframe{height:100%;width:100%;overflow:hidden}.m-video-player.full-width{padding-left:0;padding-right:0}.m-video-player.expand-preview-image .x-sfa-video img{width:100%;display:inline-block}.x-sfa-video{display:flex;height:100%;overflow:hidden;width:100%}.x-sfa-video img{height:100%;margin:auto;display:block}.x-sfa-video .f-video-trigger section div button{background:rgba(0,0,0,0.6) !important}.x-sfa-video:focus{outline:3px solid #FFF}.c-video-player{cursor:pointer}a.x-sfa-video .c-video-player{position:relative;padding-bottom:56.25% !important;padding-top:30px !important;height:0;overflow:hidden;min-width:320px}a.x-sfa-video .f-core-player{position:absolute;top:0;left:0;width:100%;height:100%}@media screen and (-ms-high-contrast: active){.c-video-player .f-video-trigger section{background:rgba(255,255,255,0)}}@media screen and (-ms-high-contrast: black-on-white){.c-video-player .f-video-trigger section{background:rgba(255,255,255,0)}}.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\94-3cd1e0[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	68489
Entropy (8bit):	5.371151075731659
Encrypted:	false
SSDEEP:	1536:7tV81ICDVRgJhAiUinqgDRQ7wYv6uxhBANIu:7v81+einqgD8Q
MD5:	5D7F2F04176CC5D3CAE1BCDB15EED40C
SHA1:	86E9C4DF0796E3A8146B751D3BB168860F838A82
SHA-256:	BABE97146AADB62C442E7BE58A72479B4F1760F76D45B7027C8347F00964662A
SHA-512:	EA448E9DF2780A804F1FA86AD667C6CAD6D112F7448C84A0B86DC2917390014C2367B3E057DEEA112B8C99607985DE99CD9561193B389B3DE4F02D7C76331F08
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/MICROSOFT-365/_scrf/js/themes=default/9e-bcc229/94-3cd1e0?ver=2.0&_cf=20210415
Preview:	var awa,behaviorKey;define("jsllConfig",["rawJsllConfig"],function(n){n.cookiesToCollect=["_mkto_trk"];var t=window._pageBITags.pageTags;return n.ix={a:t.userConsent\|\|!1,g:t.userConsent\|\|!1},n});awa=awa\|\|{};awa.isInitialized=!1;awa.verbosityLevels={NONE:0,ERROR:1,WARNING:2,INFORMATION:3};awa.behavior={UNDEFINED:0,NAVIGATIONBACK:1,NAVIGATION:2,NAVIGATIONFORWARD:3,APPLY:4,REMOVE:5,SORT:6,EXPAND:7,REDUCE:8,CONTEXTMENU:9,TAB:10,COPY:11,EXPERIMENTATION:12,PRINT:13,SHOW:14,HIDE:15,MAXIMIZE:16,MINIMIZE:17,BACKBUTTON:18,STARTPROCESS:20,PROCESSCHECKPOINT:21,COMPLETEPROCESS:22,SCENARIOCANCEL:23,DOWNLOADCOMMIT:40,DOWNLOAD:41,SEARCHAUTOCOMPLETE:60,SEARCH:61,SEARCHINITIATE:62,TEXTBOXINPUT:63,PURCHASE:80,ADDTOCART:81,VIEWCART:82,ADDWISHLIST:83,FINDSTORE:84,CHECKOUT:85,REMOVEFROMCART:86,PURCHASECOMPLETE:87,VIEWCHECKOUTPAGE:88,VIEWCARTPAGE:89,VIEWPDP:90,UPDATEITEMQUANTITY:91,INTENTTOBUY:92,PUSHTOINSTALL:93,SIGNIN:100,SIGNOUT:101,SOCIALSHARE:120,SOCIALLIKE:121,SOCIALREPLY:122,CALL:123,EMAIL:124,COMMUNI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Blog[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1244
Entropy (8bit):	6.621216062932674
Encrypted:	false
SSDEEP:	24:11hSWwjx82lY2T3v4V0u7AyJ3V+TpQ2eGNQebFzWvhfATXiwnI/Uu0:bBNn2z4xJ3fYRWpgywnI/Uu0
MD5:	8F8DF2A7D430812AC170089E6E1F89A5
SHA1:	963B745ECB62A21C86DD21B08C98FF0B28CBCB22
SHA-256:	43319333296E47BA21D33CF9AC03C72CFADB2F0C9CC181F896DE70129B605624
SHA-512:	84C84EBD302CCFAECC2610B245A7D7630EEB10D91928A9F43F516A788FFE8B7A163B729A4E14E0B5EF490D599D0EFD7FBBF2028384A165D403D1AB6E4DCAF1ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/f3229d48/office.testdrive/images/social/Blog.png
Preview:	.PNG........IHDR.....................tEXtSoftware.Adobe ImageReadyq.e<...%iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 6.0-c002 79.164488, 2020/07/10-22:06:53 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop 22.0 (Macintosh)" xmpMM:InstanceID="xmp.iid:E0DB8A6930A511EBB51D8748B1217C9D" xmpMM:DocumentID="xmp.did:E0DB8A6A30A511EBB51D8748B1217C9D"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:E0DB8A6730A511EBB51D8748B1217C9D" stRef:documentID="xmp.did:E0DB8A6830A511EBB51D8748B1217C9D"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?><......MIDATx.b...?.5...PRR..R.D....*@<....3.]s...,PE/.......q....b...?.W@.0...X.../... >..hr. ..Aa...H.$EEE] ...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MWF_SocialFacebook.png[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	469
Entropy (8bit):	5.368803468427014
Encrypted:	false
SSDEEP:	12:tvG1W3aA/QU2Z9Vflb9WbrCrfdo97LCcnwiA:tu1UQZ9/b9WbejSVwiA
MD5:	58064C0EDB5F8C89D1C066A50AF5ED7D
SHA1:	CB7B81145B59B505B74ED3507464201AB4BFF621
SHA-256:	6CD47E002200FC07167C3D1552C5E84693412784AE15B039383F4607A6DB08E7
SHA-512:	11A214A9A9DF47901D5BE6F867A7A2E739825CE12F98FD28755C16ADF1AEF1783E4082C6F89D9D522823458AFFC9CD60D070C27352E88A0A24F70545C17B340E
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/MWF_SocialFacebook.png.svg?version=ca2b09b7-dabe-cbfb-0459-457c6ac59270
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><defs><style>.cls-1{fill:none;}.cls-2{fill:#231f20;}</style></defs><title>Facebook-neutral</title><rect class="cls-1" width="32" height="32"/><g id="_Group_" data-name="<Group>"><path class="cls-2" d="M17.53,26H13V16H11V13h2V10.48a4.76,4.76,0,0,1,1.21-3.29A5,5,0,0,1,17.88,6H21V9H18.91a1.5,1.5,0,0,0-1.17.57,3.53,3.53,0,0,0-.2,1.37V13h3.12l-0.36,3H17.53V26Z"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MWF_SocialTwitter.png[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	848
Entropy (8bit):	4.81890078988595
Encrypted:	false
SSDEEP:	12:tvG1W3aA/QvZ2Z9VflbHM/dGmJr41PPhtUBaw7+Us5HQluq4hJ1fJY4fC2m:tu1UFZ9/ba01HIBRXMw4qgJ1fy4tm
MD5:	8724142EB655D2FD1BD91E144CB42B40
SHA1:	69812DA7793FB4D1314DEADB3CC2663E871B5071
SHA-256:	05AC6FDA6095A72ED257E3EB7548D0EADAF95D2BB9632145A03DD1EBC7A0D197
SHA-512:	8435F66F684E50C81E126C52DDDD4DBCA96E148274346021BC92D5A0803D69ED6DE0ABAD010A2D12B23A0EE549DE65D9BE87BDA8030CBB796F667B4363FF3975
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/MWF_SocialTwitter.png.svg?version=d2323c35-98f8-04ba-427f-b915c18959b7
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 32 32"><defs><style>.cls-1{fill:none;}.cls-2{fill:#231f20;}</style></defs><title>Twitter-neutral</title><rect class="cls-1" width="32" height="32"/><g id="_Group_" data-name="<Group>"><path class="cls-2" d="M27,9.17a9.37,9.37,0,0,1-2.26,2.34q0,0.32,0,.58a12.7,12.7,0,0,1-3.31,8.66,12.1,12.1,0,0,1-9.52,4.19A12.52,12.52,0,0,1,5,22.9,7.79,7.79,0,0,0,6.08,23,8.79,8.79,0,0,0,11.68,21a4.29,4.29,0,0,1-2.63-.9,4.43,4.43,0,0,1-1.59-2.23,4.64,4.64,0,0,0,.85.08,4.8,4.8,0,0,0,1.2-.15A4.4,4.4,0,0,1,6,13.41V13.35a5.69,5.69,0,0,0,2,.56,4.31,4.31,0,0,1-2-3.75,4.45,4.45,0,0,1,.59-2.28,12.29,12.29,0,0,0,9.28,4.72,5.12,5.12,0,0,1-.11-1,4.51,4.51,0,0,1,4.51-4.51,4.33,4.33,0,0,1,3.29,1.43,9,9,0,0,0,2.87-1.11,4.38,4.38,0,0,1-2,2.51A9.23,9.23,0,0,0,27,9.17Z"/></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\MeControl_HMuKYHTRtxjWQ-nqLwSv3w2[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	17262
Entropy (8bit):	5.45150627760132
Encrypted:	false
SSDEEP:	384:JViPE0pbgrw/vb+MQbBRsWyWhP6P7VsUjf6HryTznPoA:JViBgrkusWhPoT6HryTzoA
MD5:	1CCB8A6074D1B718D643E9EA2F04AFDF
SHA1:	D29DA81C9E3BAA5EC758074BED2B3A08F0695CA5
SHA-256:	500D164EC7407D1E776E1C42408E785E41089481CF8CFB58BFD880F1A2AED29B
SHA-512:	43454AC8500AB94ACB057AF42D94CD602CC613B12AD2B85A85D3FB42DC3E6F3ED446AFADBD14C0C3B92830A3127E9EA95A86A606808A037D5DF0041B34901AFD
Malicious:	false
Reputation:	low
IE Cache URL:	https://logincdn.msauth.net/16.000/content/js/MeControl_HMuKYHTRtxjWQ-nqLwSv3w2.js
Preview:	function _iz(a){return a?true:a==0\|\|a==false\|\|a==""}function _Du(a,b){return _iz(a)?a:b}function _J(a){return a instanceof Array}function _BD(a){return "function"._g3(typeof a,true)}function _F(a){return typeof a=="string"}function _BE(a){return _iz(a)&&_F(a)&&a!=""}function strOrDefault(a,b){return _BE(a)?a:b}function _A3(a){if(!_F(a))return "";if(a.lastIndexOf(".")<0)return "";return a.toLowerCase().substr(a.lastIndexOf(".")+1,a.length)}function _A2(a){return document.getElementById(a)}var $J={_dx:false,_b:function(c,a){var d=null;if("img"._g3(c)&&_iz(a)){var g=_A3(a.src);if("png"._g3(g,true)&&!$F._ml())c="span"}var b=d;if("input"._g3(c,true)&&_iz(a)&&(a.name\|\|a.type)){if(!$aE._i._g3(a.type)){var f=document.createElement("div");f.innerHTML='<input type="'+(a.type?a.type:"")+'" name="'+(a.name?a.name:"")+'" />';b=f.firstChild}else try{var e="<"+c;if(a.type)e+=' type="'+a.type+'"';if(a.name)e+=' name="'+a.name+'"';e+=">";b=document.createElement(e)}catch(h){b=d}if(_iz(b)){a.type=d;a.na

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Prefooter_Icon-18_Support[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1230
Entropy (8bit):	4.3235255788059925
Encrypted:	false
SSDEEP:	24:tu1jkD8d7JN6o4xS9hM0vfhgWlU38FaYmSs6juZsJ8:0j88d2Rxs+0G0+3quqy
MD5:	A9357B4791C45A090A37F6AFD94006C3
SHA1:	089E77B728743B3E5727D2A17D2AD812A4BB547F
SHA-256:	E9DE540DD5168537127EC5012D770302DD945F1C9BE533499146BD6FB0930794
SHA-512:	720E690C6A1BF34AA8250447501D958E06B07C6D9E8172B8567109C81BB2D3C8620446B17793A9996F65BF334C111DADAD7A121F75EA0427BE5AC089ADFD950D
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon-18_Support.svg?version=4a9a4c35-089f-e35e-f8db-f08df9dd53b2
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#2f2f2f;}</style></defs><title>Prefooter_Vectors</title><path class="cls-1" d="M36.32,16.83q.15.67.24,1.34a10.69,10.69,0,0,1,.09,1.36,11.07,11.07,0,0,1-.93,4.6A13.14,13.14,0,0,1,33,28a10.62,10.62,0,0,0-2.18,3.14,9,9,0,0,0-.76,3.73v4.38a3.23,3.23,0,0,1-.26,1.28,3.27,3.27,0,0,1-1.74,1.74,3.23,3.23,0,0,1-1.28.26H22.43a3.23,3.23,0,0,1-1.28-.26A3.27,3.27,0,0,1,19.4,40.5a3.23,3.23,0,0,1-.26-1.28V34.84a9,9,0,0,0-.76-3.73A10.64,10.64,0,0,0,16.21,28a13.1,13.1,0,0,1-2.69-3.84,11.07,11.07,0,0,1-.93-4.6,11.93,11.93,0,0,1,1.64-6.07,12.28,12.28,0,0,1,4.32-4.32A11.94,11.94,0,0,1,33,10.9l-1.54,1.56a9.85,9.85,0,0,0-3.14-2.05,9.64,9.64,0,0,0-3.67-.72,9.53,9.53,0,0,0-3.83.78,9.91,9.91,0,0,0-5.24,5.24,9.52,9.52,0,0,0-.78,3.83,9,9,0,0,0,.76,3.73,10.61,10.61,0,0,0,2.18,3.14,12.76,12.76,0,0,1,2.42,3.35,11.4,11.4,0,0,1,1.09,4H28a11.77,11.77,0,0,1,1.09-4,12.4,12.4,0,0,1,2.43-3.35,10.63,10.63,0,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Prefooter_Icon-19_Community[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1348
Entropy (8bit):	4.456440022830228
Encrypted:	false
SSDEEP:	24:tu1jkD8d76KYyZcdT+Yn08lPHwBao9fQOWNS8RF6+gWyv960YiSzNT:0j88dSyCdT+YnhxQBasfQOixRo6TiIT
MD5:	E5B67DCFF829BD2B2168961DC39DFC5B
SHA1:	8DFCE4D60A6369AB410DE865CEB139E54223BD66
SHA-256:	4F52C44E4B9296F008E79C7C46FEB21028C0FBB9D5F1CE59F390C1B86EA6D1C4
SHA-512:	FE4CF05C7A8BC230CB3EEB688DACD267E6DD3426BDE1FCD6AF6BFDE468BACC5266F0E0D6A3C4E479FCBEC0115C34C85908B6C21A63EF19735FC6DD8AB65A3D95
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon-19_Community.svg?version=4a149663-0cd4-3657-a2e5-828f12093a87
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#2f2f2f;}</style></defs><title>Prefooter_Vectors</title><path class="cls-1" d="M40.4,16.09a14.41,14.41,0,0,1,1.11,3.24,16.2,16.2,0,0,1,.37,3.42,15.54,15.54,0,0,1-.63,4.44A15.84,15.84,0,0,1,32.88,37V38.5H21.63v2.25h4.5V43H14.88V40.75h4.5V38.5H8.13V22.75h2.25a15.5,15.5,0,0,1,.56-4.19,15.78,15.78,0,0,1,11-11,15.86,15.86,0,0,1,8.62.07,15.9,15.9,0,0,1,4,1.8,15.55,15.55,0,0,1,3.34,2.84A15.91,15.91,0,0,1,40.36,16h0Zm-30,20.16H30.63V25H10.38Zm3-18a13.36,13.36,0,0,0-.77,4.5h6.75q0-1.14.07-2.26t.21-2.24Zm8.79-8.42a13.49,13.49,0,0,0-4.46,2.35A13.3,13.3,0,0,0,14.44,16H20a26.31,26.31,0,0,1,.82-3.19A13.65,13.65,0,0,1,22.19,9.83Zm8.44,12.92q0-1.14-.07-2.26t-.21-2.24H21.91q-.14,1.13-.21,2.24t-.07,2.26ZM26.13,9.34a1.53,1.53,0,0,0-1,.38,4.22,4.22,0,0,0-.86,1,9,9,0,0,0-.72,1.36q-.33.76-.58,1.49t-.43,1.39q-.18.65-.26,1.05H30q-.09-.4-.26-1.05t-.43-1.39q-.25-.74-.58-1.49A9,9,0,0,0,28,10.7a4.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Prefooter_Icon-20_BlogWin[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1089
Entropy (8bit):	4.468502831358706
Encrypted:	false
SSDEEP:	24:tu1jkD8d7ClcUqFh5n09uuMDY3e2HcrRZ4nUoZ3ek5FxZrrk8:0j88doIpn4u3DY3p1U3a/Hk8
MD5:	FB5BD5CFD29BF797C72FACEC2B369461
SHA1:	24952FF3DBF90886CEF395F399E7587D4D94AC05
SHA-256:	2240B138CEF57FF9F0BB7AA67BC0969CA756F406014227FA053F31C07E7CFEED
SHA-512:	D71E4FFFF6C66A7DB3602E6AA632FD7F0412CB1C62D1A20B3B5FF96CFEE6B8577051FD0E9B8216D8ACF965298602DCD779BF8600ADC8DD94A37F5C6B83040C08
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon-20_BlogWin.svg?version=3b1d197c-2139-50c4-563f-360f55c40234
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#2f2f2f;}</style></defs><title>Prefooter_Vectors</title><path class="cls-1" d="M38.48,16.4q.58,0,1.4-.07t1.7-.08a15.6,15.6,0,0,1,1.77.08,4.86,4.86,0,0,1,1.58.41,2.86,2.86,0,0,1,1.13.93,2.65,2.65,0,0,1,.44,1.59V39.33a2.78,2.78,0,0,1-.22,1.12A2.92,2.92,0,0,1,44.75,42a2.78,2.78,0,0,1-1.12.22H6.37A2.78,2.78,0,0,1,5.25,42a2.92,2.92,0,0,1-1.52-1.52,2.78,2.78,0,0,1-.22-1.12V19.27a2.78,2.78,0,0,1,.22-1.12,2.92,2.92,0,0,1,1.52-1.52,2.78,2.78,0,0,1,1.12-.22H25.85l7.28-7.28a4.52,4.52,0,0,1,1.44-1,4.34,4.34,0,0,1,1.71-.35A4.2,4.2,0,0,1,38,8.16a4.58,4.58,0,0,1,2.37,2.38,4.28,4.28,0,0,1,.36,1.74,4.44,4.44,0,0,1-.17,1.29,4.09,4.09,0,0,1-.47,1,6.15,6.15,0,0,1-.72.91Q39,15.93,38.48,16.4Zm5.15,2.87h-8L20.54,34.36,12.1,36.47,14.21,28,23,19.27H6.37V39.33H43.63Zm-7.35-8.6a1.53,1.53,0,0,0-1.12.47L16.8,29.5l-.76,3,3-.76L34.32,16.53s0-.07,0-.11.07-.05.1,0q.27-.27.85-.76t1.16-1.06a9.1,9.1,0,0,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Prefooter_Icon-21_InsiderProgram[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1275
Entropy (8bit):	4.386840594449584
Encrypted:	false
SSDEEP:	24:tu1jkD8d79oOafB/UTY93mewLp3liprJ7Ta3/bvsNkhWCoEk:0j88dW4S3mDVCpGTvcSWCq
MD5:	81A31DA5DD04FD4857AB1857541A6FFE
SHA1:	5EF03C52F40F8E86374D7CF037AD75739AC6EBBE
SHA-256:	38057E8200F4CD79C7C483BAC5CFDD09415F1BE64A67CE4A3DE8D2B273AD78FB
SHA-512:	B644BD5390605554678185D19D585951C292CB8773C99B24159C4B1132E1C7CE1589150FA8066D88F0436667243DF64B54EED158A8DC7584F5B03E3982E54686
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Prefooter_Icon-21_InsiderProgram.svg?version=8768bb27-2df7-f685-7e06-2732b420aa68
Preview:	<svg id="Layer_1" data-name="Layer 1" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 50 50"><defs><style>.cls-1{fill:#2f2f2f;}</style></defs><title>Prefooter_Vectors</title><path class="cls-1" d="M23.87,30.2A12.14,12.14,0,0,1,31,37.82a11.65,11.65,0,0,1,.56,3.59V42.5H29.38V41.41a9.54,9.54,0,0,0-.78-3.83,9.91,9.91,0,0,0-5.24-5.24,9.81,9.81,0,0,0-7.66,0,9.91,9.91,0,0,0-5.24,5.24,9.52,9.52,0,0,0-.78,3.83V42.5H7.5V41.41a11.63,11.63,0,0,1,.56-3.59,12.24,12.24,0,0,1,1.56-3.2,12.19,12.19,0,0,1,5.57-4.43A7.44,7.44,0,0,1,13.81,29a7.71,7.71,0,0,1-1-1.51,7.85,7.85,0,0,1-.66-1.71,7.56,7.56,0,0,1,.38-4.82,7.72,7.72,0,0,1,4.07-4.07,7.64,7.64,0,0,1,6,0,7.72,7.72,0,0,1,4.07,4.07A7.56,7.56,0,0,1,27,25.74a7.9,7.9,0,0,1-.66,1.71,7.76,7.76,0,0,1-1,1.51A7.44,7.44,0,0,1,23.87,30.2Zm-4.34-.82a5.29,5.29,0,0,0,2.12-.43,5.51,5.51,0,0,0,1.73-1.17A5.62,5.62,0,0,0,24.56,26,5.28,5.28,0,0,0,25,23.91a5.22,5.22,0,0,0-.44-2.12,5.61,5.61,0,0,0-2.91-2.91,5.22,5.22,0,0,0-2.12-.44,5.28,5.28,0,0,0-2.13.44,5.62,5.62,0,0,0-1.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Print[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	476
Entropy (8bit):	7.35124642782842
Encrypted:	false
SSDEEP:	12:6v/78/8QCeKXzjl5V6VQTdwbtsxET1SDQi7N:sNfF6VYd6tf1SdN
MD5:	B8E8859FCD4E43D51233559C17A3C7BD
SHA1:	F0CA023F26A84761995FA0BF6935DE6A3B8AE6F8
SHA-256:	DC15A37B4015D0DECF639006E4F9002E742DDBFD7C669EC0AE469057F238B78D
SHA-512:	3605E4C4FE22E6E05553F89D34CFE8B3E5CA72FBDADCCD8B279835A0ECEFCD10B1BF2AD1ACCEEB168EE369E23A8AD205720FBF33A184188A7F23AEA7B0F22005
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Print.png?version=03620f3a-5d1e-5a73-a117-a2f71eee437d
Preview:	.PNG........IHDR................a....sRGB.........gAMA......a.....IDAT8O.S;..A.........M6.4....@.47....^I..<."&..W..Y...Y...........m...E.<..$..n...j..kL&......}.j.......)@......r..Q....]. .+.w...f3.R)...2^...ddO.^..Ud.BE..D..h...!........h..p..t...9.........1.."tD.......y.h.AQ.{."...J.D.U....c.b.i.h.t:..$&q..J..n.+9.r..B..F...e..`<...oS....Z-.H....NG...Jl..D.Z..@!...s<....m.'Ll..vc.?..~..v.n.9.;.m.5..K.A ......z=../>...M....r9..~.....go.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4pkvE[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 40 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	234
Entropy (8bit):	6.336886292770393
Encrypted:	false
SSDEEP:	6:6v/lhPnMtkiQg5gmlUkBNdMSwul9Kx+2lPpgt+SgU2KmiZUup:6v/7PVg5gSUkBDkSox+2VPSgU0iqc
MD5:	260A51F19FFB5DC5B69223FA27B28B7F
SHA1:	45DB7B29D637618990DDBE2C428875EB2B9E4B97
SHA-256:	38D313123BA702A51B25E52DF6C17F5CDF127C1BA2094F05F968AD2890CEB49F
SHA-512:	C0809F0BBEB79665DE95C7C7455E9FDFC878D6553B377F7B4F742034BC35624BA07CCD320B6557509BF3EE772CCEFFFE1017B498247DFF54563AFAD288B789C6
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pkvE?ver=d8fc&q=90&m=6&h=40&w=40&b=%23FFFFFFFF&l=f&o=t&aim=true
Preview:	.PNG........IHDR...(...(.....&.p.....orNT..w.....IDATH.c`.t@...!...a=.~......4..h.~..@#P!...hD..#.4.bD?.3 ...1X.t`...1...=.....D7...a ~.....8j.P1../T..f.AZ...p4..8j..0..#.....jK...b6tA..j..Yjbk=R` ...~...1.w....N.aG.@.z....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4pndL[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 40 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	916
Entropy (8bit):	7.699275648627113
Encrypted:	false
SSDEEP:	24:adCm1Rg/V4O59R2h6U2WRTR6DBix7QaOsG59Mni99H1:aRolz2hbR8BC7Q0G592i9d1
MD5:	3A78BC00E75A109AFC5AFA9D38FB6A7D
SHA1:	6D0CA05953B517487819172D32128DF704F85ECA
SHA-256:	F6C718F4E6D8C3385821ABA8B5DE1468F48B88650741B3152A9921C34ABC1CA6
SHA-512:	4E8053D72719C55ADC7D9457D293C7E913BF62629038B3DD86550D07FF4412D5C3CA6DACAA90D971AC56C5B8894F9A0DBD4EE472443D18AAF90BCC1D2815E703
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pndL?ver=5217&q=90&m=6&h=40&w=40&b=%23FFFFFFFF&l=f&o=t&aim=true
Preview:	.PNG........IHDR...(...(........m....pHYs..........+.....FIDATx...Mq..].tr.a\..^i$......A....4....4...'..G.<(e.&M.DR..r....g....f.N.......y...~k...k............e..:...q..f0.`...=>....?.@.......c..Z.V....j...'.....b............%w.).M>..w..A..G....k/...6.S.H.@...s.....=Pb...Kw../. ..Y..~).!H.>p.C..T`.4........._...'..........t..[4...U`.......I.....cA....\H.....Lx.@....(...'.6.......?......qy..LQ<.n..O.....z..N.(GZ...(.r.8............(..@]^.]Q...<?...+A.....;...`P.{..z.4r......3...z%8.:...;..f..luym.Wc..._....8G...St#.@..0.x...$....^....n......:.+8M. ...H.^..i......(u.Y...^}W.......`..+.:...x.....s"..F.........T...5.o......g..l.m..:..;k..AV.?KL.....V.p&.gs.u....\|]..V...zl....1......T`#....Z....X.QT.........rB..$&(v....gT...r$.."....g...>...u.E.....5$....../........D..g..g>X..1....:X!..YT..a.s...T...NL.%.~.oW!K..:.v."?...8..P.@9.TH4.1.^W.ET....L...n.......IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4pxBu[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 40 x 40, 8-bit gray+alpha, non-interlaced
Category:	downloaded
Size (bytes):	592
Entropy (8bit):	7.5191542877143895
Encrypted:	false
SSDEEP:	12:6v/7PoNuMxRUHNV7ROerL/EmNsgF8wUy+cghBZ+QXe0q1cg+SR:+o0M7cbUen/d8BZxcKg1R
MD5:	E8DCCE76EF06E598B2FFEDB2D2DF92C3
SHA1:	652895F799FCBACA551EC5911A88895DB90EE693
SHA-256:	BD58174AB1A620975F07510EC6480E6C2D97E84FEB5D8647873E172908942651
SHA-512:	1467EB0690B8747F28098B2032662C0014B2CEB647113DE40D99AA5F0F53D214F607392A09833BF41F91D8691A228239537A08860C1C3B31C3D90F6CB708A0C9
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4pxBu?ver=eae5&q=90&m=6&h=40&w=40&b=%23FFFFFFFF&l=f&o=t&aim=true
Preview:	.PNG........IHDR...(...(.....&.p.....orNT..w.....IDATH.V].. ...D0...@.#...D ...@."........^x.x.qwf........a.q`.?..........l...Gxh..{.......`,.l...E2..B,.......SF.c\|T0.x.5c..."..[A..l.....2.^_...jz.>.....<..m...\|A.8..H._f..;[....I..CN...$d...n..J...pGFfST..\|..4...5..9...?Q#2..f".W;... ........a.^.[2i..4..c... >."$....i.g.).+V.....d.x...h.I\|ta3...\...R..OQ....l...T.\|..C.*....].;..>..c..P.z.V...r....zbmB.....(.\|..e-.?..0Yr.h.....p..w.>+/....e.... JS....U...H...l..?...E.4.}.;....M.c.{....'9..!8.DOA."(..Q.q....- ..Q5....kO75m..Wn...w.U........r....,.D.z.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4qRrT[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 39 x 40, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	1421
Entropy (8bit):	7.260792221653173
Encrypted:	false
SSDEEP:	24:m32TjS9BKgNx+qIT+bHztMILCG0eC7g31maxWq47QBgSQN2ty:m32aPJnW+bHPFC04av4c+Su2U
MD5:	5DD39CE77CBA28DF85075622014B798E
SHA1:	CB240322BFD57BA8131DB39CAE7CC52E4D2B94CF
SHA-256:	11FAF400FC8C627C1D0C121B01B6553225900471B3DA4FD3C15136076F168CC7
SHA-512:	7D8C13B2C3D6BF7AAE75DF8828CC8E1C60D992F27B621AF69B540538A43BF2705C6F6E1A2559BC28DB5A57A9A7832932AC89895468858FC75BB276402CD23E98
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4qRrT?ver=cee0&q=90&h=40&b=%23FFFFFFFF&aim=true
Preview:	.PNG........IHDR...'...(.....J+.....vPLTE.................................................................................a..k..j..i..w....~......p..j..k..j..u........t..j..p........u..k...v..y..P.,(%++++**+-.i..w..[.,'$+++*.b..x..g.+('++,)'.[..x..S.0,./2.l..^.0,(/...e..i./-+0-+.^..x..x..V.0,)0//.l.._.1,(0.-.f..k.1.,0-._..w..x..v..y.k..52/MIFH...u..v.\..A=:C>;X...v.I..630k...y..w..x."...{..~.k.......AAA000QQQ......F...z..{.W.......FFF///HHH...I....NNN@@@.......x...........................................................................................................................w..x..x..v..x..{./////..z..z..z..y.,,,...)))***......................w.y....tRNS...\|........y......N..S.._........................................................................................................................................,0...................orNT..w.....IDAT8.c`.....#.:....c.P.....l.[..l.f.u...........CS..../...\|B[....<~>^..2...0L..(^u."x...i.....H...Au..@u.[..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4qU6q[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1574
Entropy (8bit):	7.805404668945285
Encrypted:	false
SSDEEP:	24:6gTrHE73tcUxgaOK2NXHbQ4XKzo08x+tBgpV/TRajnKqK6zc0bIouc/XQuHfbB:R7EjttUX38I0fApRd0nc6zc0mcoQB
MD5:	45794016DAD729E18F72C2DF007216A4
SHA1:	6B617D457FDE4FFBC1B25BA280A5DF70B728FEEC
SHA-256:	1DCBE5E67A5E8BBA355D3CA78EA8CD1C0DCBCFAA1CC7D5BCFABCB39078F1138C
SHA-512:	F31AE156E41100E205FCA19C10F85595BE1D60B606901DB431B0206B19C6F6486926F8CAD33D836E5CF4118FF2346407A04EEF2D29300386707D9046A60CFDDD
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4qU6q?ver=b2f2&q=90&h=40&b=%23FFFFFFFF&aim=true
Preview:	.PNG........IHDR.../...(.....n"......pHYs..........+......IDATx..kl.U..w....B.Z."j.>........h.H.......6..G.>..[Z...B.R.b........l.TcD..`i.J.P...w....3kwe.I.{..{.9.s.;w...H...U.}.<.:.....c.JR.C..v.Z m..`9c.P(.^^^.G.7.?I!...."...1x.......V%..1........\|.=MD!..t<..1......;.N..&...W.....z+q...<^..1.D#XM%$.]$..awB.....Z...+..Z.X...H...N.8au.%.l.K).S8]....<....m.k$.b..--.0...<.rY......5f.0^....)Ix..E.'...$....j&....d..,$.68.D...'..h...1...j..}}..yx..s..D....SRRrJ..&......t..y..M.!.n0..JH.{I....^.....\|n.o'I..^V..>.n...]. .18..\...J2.D......t.....}...)=..x.V.N+.t..(\...>..DO>.^.2r...8.....$....5.4}a.W....\|.~.....T..........-^0=......{EEE..G.XK.r.Z..H..$[.E..Z.y.s=ym..2.@ .1...NH......p......-..W..D......x<.~.?\|QR!.I.R..c .p..._.u.f\|..7#.l...iT[K.Y.oqq..I.........B.(.i=.G.,`&B..4)...q;..T.G.+.A.\|QQQ...1......p..........$.E....X~.N.......5!.m<H.e.2........4...XA..r.....r."...4.D..$..c.$Q..$..R.)..6c.-Z.H./.Z%.o.\|$..r\.....RF..rd>/I@..v.I...J.C....=..K

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4qWNO[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 37 x 40, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1439
Entropy (8bit):	7.765980595252698
Encrypted:	false
SSDEEP:	24:32Mwc0LRTuCdcj81tHR3xAPSUns9AQBwRi7HsBkN4mcKfbF1P2hoJ1:3BwcWTuCKj815APds9xBw0j1FJshI
MD5:	9C6EFD87891A9500C7D3D0DB6539F10E
SHA1:	79A1EEED952487FA681DDBD9852730F4503D00E9
SHA-256:	F5BA8BBACBA8023FAB55BE785C2B501FF5C9A12FC504FF123DE0038B16E5040C
SHA-512:	7D274EE4D5233C9AD7E0B5E6157FA38A2DC779A4C3F10E6A0B666C0FE76AA8FB0E4957C10428891A168D45BA47551C3065432035BEFCCD9C16A0619DB156CB6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4qWNO?ver=5b3d&q=90&h=40&b=%23FFFFFFFF&aim=true
Preview:	.PNG........IHDR...%...(.....y.3.....pHYs..........+.....QIDATx...k\E......].mjIR..Db@.X.`....i.1."..TTP.....}0..P..j..Hj~(.D.R.V%..!..1......lOn..f...8..3...9sf...F...y:.N.vtt....H.......?...r..nP.....3D.X{{..Q.....p..."v..}..)PZ.....X/..u...$(...S...Q.De..\.n.67....."=U.....`;,[9{W.-................V./%....3....8c.ZPrz.....;.jX4.O.%.DP9.K%%%.9+.e.t.8..,(.!/.... ._.8P'..$.&.4.....1.......I....^...l.O...i.KT"..b.T7::z.............+.+.......b.....V).$.j......l,l.......Jw1...8??.I._>C.Jz.@..8..6 ....!.+..J......e.L&.ho.X.T.Hj..X.V$...../.T.^.....E).Vzy...H......._..D.q...o....0..{..>./...(.XZZ.MLL\......oii.{{{.A'.../.............-//.fggg...S.D....*!...Y......7j..x.:...r.y..Z^.B.....%....Z5prttx.e}.V~...i.......#.....N....YEMM.L..>.8..=".JF....DSS......vA.4/..(....U.......i..u... ../...466.777.S...9r`.8..FJ...9.....P..k.nA....h!..%D..?.....H...l\|jjJ/..-}/i......`m..,..&.Je.%.tE...hr.R.....NNN.R.++}.,...~..i..o..\|.>..E:kQ6..l..[."z6RJ.D..Z}O...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4r4UB[1].wdp Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG-XR
Category:	downloaded
Size (bytes):	13472
Entropy (8bit):	7.909838986250562
Encrypted:	false
SSDEEP:	384:HrIsjwJefhr7zQGaXLPN3AkU9wWFrGTQgXlmmHkP0:8sjwJepr7zQGGLPOfiWFiUAG0
MD5:	D5CAE4A05CF2A40076F2110ACB6BA327
SHA1:	B07CD3ACADC0035C155D24847AE423B43F6CB855
SHA-256:	4DEED85457D7BA9BAF22CC867E9BD1967C73209FE94407B54BE787AD21A2977F
SHA-512:	2E83200ACCD8A1269CC2E2FD66EB5D57BE0551E63B8E51C92F571A6AA96572F55F387EDD6A1FC82A3BE15F7B5B52BA7855578F6F48B3F8E9056A5C6CCAD658D7
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4r4UB?ver=3307&q=90&m=6&h=180&w=321&b=%23FFFFFFFF&l=f&o=t&x=558&y=161&aim=true
Preview:	II.. ...$..o.N.K..=wv.............................................A.......................$..B........$..B.....................4......WMPHOTO..E.q.@..0...,8:B.. ........1o...... ....L........Q5.bn.2)g.6~.].\|...R........-..&x........a..'R..V.F.).D..Y... ..../(.#h.rN......0\|.x........... ..r...l..Q.FME..$z. o"...l....r..=0...r...r..-..C....G.,.e.lxU02.. .DL_.~e!#v..X...EFknS.M..QS.Ca.`...G..xR)#..OE.h...?K.H....HbUU92V.......MmB...v.IxT..o.2..o...)p..\|K...YI...e....I.3.$W..b.7.>A".ND...\|....;LU...2-./..K....5e71.##..`!}..?...$.....\t<.u.1..j...qQ...Dn Z..{1t.Y.P.h..or...^.+E...C.).D.Gdn..B....c./F...J..m..j.n.W...k5Dl.U.e.2#+4`..U.:l.......!.....D.... T.t.A..@!.......D......!l...W... . .$H..)........Y..3......2OU..1...m`..I..._..\@D.Q....d...6....D.Qy.\|R._..G...B'..(....N..`x..I...DN.h ...D40..R....@@....jnF.Xw4<j.u.c.....v..Bd..=..K..D...bql.>y....X....%$a...j...i......LAH...l..f.d....F6S&l.@A...S.(..5.Y..-g!.........H...!....$G..GA...$...F.....ZG

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RE4wocw[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, resolution (DPI), density 96x96, segment length 16, baseline, precision 8, 1083x609, frames 3
Category:	downloaded
Size (bytes):	24443
Entropy (8bit):	5.3182523203987575
Encrypted:	false
SSDEEP:	192:pyJWvS2Ee3X6asg30D+4XaHTckaH8CQFCUlQIUgaMgtJxJxJxUg/mKL:ynZYv3KzHWFrlQIUhMgtXXXdj
MD5:	6239D8416C1634CEA797495435BCA1DD
SHA1:	38742E7BD78A93C5E46442DDA1EFF88DE610A975
SHA-256:	F57A4A28D183F7F279B4F512437D629066465E3F05D496C1F688456CE1543FCE
SHA-512:	4EF72678C68CCE44ED73ED2078E5D1A76B43DC2066D828A442C9440D32512F99D4205FCD2A4994DF7FBFC8140C56C22BC1A4C2C3CF77DC50B0E8F742CDE5D860
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RE4wocw?ver=b219&q=0&m=8&h=609&w=1083&b=%23FFFFFFFF&l=f&x=60&y=69&s=1872&d=1053&aim=true
Preview:	......JFIF.....`.`......................................... $.' ",#..(7),01444.'9=82<.342...........2!.!22222222222222222222222222222222222222222222222222......a.;...........................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz......................................................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz....................................................................................?..j.(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(......(....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\RWDmbY[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 1600 x 600, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	660745
Entropy (8bit):	7.992992278714512
Encrypted:	true
SSDEEP:	12288:rEFzLQYrNAjNSooXY8SlwIf2MaA1HSA2MaCKoNlYpeUAVtVvVj0eO7n1sFaqzHZ+:4tkciLoXYLwscA1HqMDKc4eJzVvVjkR3
MD5:	1FECD697964D83FF7A774B535AAB4FB6
SHA1:	81CE44A2192B884E4474DC5D53D5DDF2DC36E7D4
SHA-256:	277448E5104DEDEA1024A8FCF8E6CF5F6EA2F4EC2D80F42FBF9C58BD13A97184
SHA-512:	767A775E0201D307C6A940F75E7D3C938671B20DDA6FFB6FD711ABA79B42FE3E633B6F37DB42BF26EC0C68E88818B6CB4C3CAD59722D6493B6A1ACE68DEEEB22
Malicious:	false
Reputation:	low
IE Cache URL:	https://img-prod-cms-rt-microsoft-com.akamaized.net/cms/api/am/imageFileData/RWDmbY?ver=b7fc&q=0&m=8&h=600&w=1600&b=%23FFFFFFFF&l=f&x=0&y=202&s=2120&d=795&aim=true
Preview:	.PNG........IHDR...@...X.....:.B....pHYs..........+......IDATx...l..u....".2..L+...+.).c..P...0.f......0.f.....1(c..PiU....J5Y.6.TCR..).G....o..l....P(..gu...:............m.j.5..@M.&P.....j.5..@M.&P.....j.5..@M.&P.....M.......j.5..@M.&P.....j.5..@M.&P.....j.5..@M.&P.......#..j.5..@M.&P.....j.5.>.....O=u.q..{.....u.O.Z.c..-..."...2[.aK.8....\.O..}E`......{..":p.k..4;.k.";Nb.....N..8.(.y..zy.N@.M+...%...ZV`........DsX.n.YCF..Z..p.....\|.J:.]._9.v_...c8..ct.m.?..Z~<...KUn...9....jb.e5u.sv.,....3..Sc.'...$....!..:q.b3._a...k......r..jxR...,......=j.H}.........l....y......0..5..@M.&P.....j.5...[~..q.. .=U....+s..p..?.C(.......cq..g..T.....s....I.. .....D.0.z...G...e.O.b.K5.g...=.#.#.x.=.d.K.vV.txW\{R.7..S.=Oa..BO3[j.T9.A<C.5N...P..{.E......2..3v. ......A..N..?.h..t...#..0f\.%......`.a..}.y..^.A...b...\|.g.l_.......{i...v....[.k.c...9f...GMr.lr....>.p]q..s>\|3...C.;..w...o.W.Wz..;.].!OV.A..m8...+..#...i....O...k.9.G.rn{3B5...zch....;...c.m.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SurfaceHome_Lg_LinkNav_Panel_2_image1[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1161
Entropy (8bit):	4.484268885657083
Encrypted:	false
SSDEEP:	24:twcB464wj4pR5N7GPzP+S2VlsRoOY4TLSzitiWjbr7Nzeh+8jw:VrALUzP+SygoCLSzipbr7vF
MD5:	6F974ACB4E979FD3445E79E49FE72B82
SHA1:	950ED5BC60777B284956E8CCC418346BB5F905E6
SHA-256:	85BFC00A602796E9A5D55DE82F47042EE0D8BD735B213D6AE5C6ECE995783458
SHA-512:	4DCCD2A891DBE8A923EDEA65FA43393881A19BDF294446C8B70BF7EDF5C5AE557A6D35C1CD5E704B8E531F9041354DE48567E638075A46D12BFEBFD95795DC6A
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/SurfaceHome_Lg_LinkNav_Panel_2_image1.svg?version=9257ec5f-8430-88a9-e2cd-c455f7ce172c
Preview:	<svg enable-background="new 0 0 27 21" viewBox="0 0 27 21" xmlns="http://www.w3.org/2000/svg"><switch><foreignObject height="1" requiredExtensions="http://ns.adobe.com/AdobeIllustrator/10.0/" width="1"/><path d="m26.325 15.745c.103.103.197.237.281.401s.155.338.211.52c.056.183.101.366.134.548s.049.345.049.486c0 .234-.049.459-.148.675-.098.216-.232.408-.401.577s-.361.302-.577.401c-.215.098-.44.147-.674.147h-23.4c-.234 0-.459-.049-.675-.148-.216-.098-.408-.232-.577-.401s-.302-.361-.401-.577-.147-.44-.147-.674c0-.141.016-.302.049-.485s.077-.366.134-.548c.056-.183.127-.356.211-.52s.178-.298.281-.401l2.925-2.926v-11.32h19.8v11.32zm-1.125 1.913c0-.038-.007-.091-.021-.162-.014-.07-.033-.141-.056-.211s-.047-.138-.07-.204-.049-.113-.077-.141l-2.856-2.84h-17.24l-2.855 2.841c-.028.028-.054.075-.077.141s-.047.134-.07.204-.042.141-.056.211c-.015.069-.022.123-.022.161l.042.042h23.316zm-19.8-5.358h9c0-.994.188-1.929.562-2.805s.888-1.641 1.54-2.292c.652-.652 1.416-1.165 2.292-1.54s1.812-.563 2.806-.563

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SurfaceHome_Lg_LinkNav_Panel_2_image2[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2700
Entropy (8bit):	4.0512327807053135
Encrypted:	false
SSDEEP:	48:Vrm52wylgV/NtnyzXzGb5ZGkOnYJR/Kn/ARttPMntx5fe5UP6:dr5o/XnyzXzGb5ZGkOnYJM/Ajt27B6
MD5:	AB93076893C8F78FCFF45E52EDEFF382
SHA1:	E7792E494227FB92724EF33EFAC24A102FB3F3BD
SHA-256:	B9AFCDFFE50AAE8D924F007A8CA6C2CF5F42C4B9C55FBA8AB274D26FD2CC7E0C
SHA-512:	93D5418572990F455297AA5CC27FDBDEFA544C4FD2882F4A772D513047ED229285071BBA39ABDC2CAD5D4625D0E89FC66AD72812B7534F9940659FB22177A375
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/SurfaceHome_Lg_LinkNav_Panel_2_image2.svg?version=da456df5-7733-1a20-6668-991b453cd479
Preview:	<svg enable-background="new 0 0 27 21" viewBox="0 0 27 21" xmlns="http://www.w3.org/2000/svg"><switch><foreignObject height="1" requiredExtensions="http://ns.adobe.com/AdobeIllustrator/10.0/" width="1"/><path d="m22.844 6c.3 0 .58.059.843.176.261.117.49.278.684.48.196.203.349.442.461.715.113.274.168.567.168.879v6.82c0 .969-.188 1.822-.568 2.561-.378.738-.878 1.358-1.505 1.857-.625.5-1.337.877-2.138 1.131-.802.254-1.625.381-2.47.381-.704 0-1.317-.043-1.838-.129-.519-.086-.982-.211-1.386-.375s-.768-.369-1.088-.615c-.323-.246-.645-.531-.966-.855-.323-.324-.658-.683-1.007-1.078-.347-.394-.745-.826-1.195-1.295-.241-.25-.484-.5-.731-.75s-.49-.504-.729-.762c-.525.25-1.045.5-1.562.75s-1.033.5-1.549.75l-1.292-2.918c-.494.516-.99 1.025-1.488 1.529s-.994 1.014-1.488 1.529v-16.652l10.062 10.5v-8.379c0-.312.057-.605.169-.879.112-.273.265-.511.459-.715.196-.203.423-.363.686-.48.263-.117.544-.176.843-.176.421 0 .766.075 1.039.223.274.149.49.344.651.586s.276.524.343.844c.067.321.11.653.129.996.018.344

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\SurfaceHome_Lg_LinkNav_Panel_2_image4[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1230
Entropy (8bit):	4.465658582341525
Encrypted:	false
SSDEEP:	24:twcB464wjm3HwyrNSPXhypqHaG2Zzz7FfuKaEWbhyUAadSyh:VrCreXhygHaG29FfDS/fP
MD5:	9807E2D0143042B099454E83F29FD3C5
SHA1:	8FD51F53C496175F8C07733A8C17497E16B51F59
SHA-256:	B042FD8196D7BEB8048862F6E0819AE253980A415E123F88AC6816363DB3545A
SHA-512:	CEA0F87D718C623C0CA156BA311136932A6484F76A08698E87B9D89C13F5D05B45DB1E2B4E7ECB0D17C732F59B6C92C6A827B6058B51368D0ADFDC4F94AB2DD2
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/SurfaceHome_Lg_LinkNav_Panel_2_image4.svg?version=f06b4b40-4b8b-535a-1bdc-60d370824ced
Preview:	<svg enable-background="new 0 0 27 21" viewBox="0 0 27 21" xmlns="http://www.w3.org/2000/svg"><switch><foreignObject height="1" requiredExtensions="http://ns.adobe.com/AdobeIllustrator/10.0/" width="1"/><path d="m21.312 4.214c.716.312 1.363.711 1.94 1.196.579.484 1.071 1.034 1.478 1.646.407.614.72 1.276.94 1.989.22.714.33 1.455.33 2.224 0 1.066-.204 2.065-.61 2.999-.407.934-.965 1.749-1.672 2.446-.709.697-1.537 1.246-2.485 1.647s-1.963.601-3.045.601c-.846 0-1.671-.13-2.472-.391-.801-.26-1.54-.643-2.215-1.148l-3.126 3.077-9.375-9.231 10.938-10.769h9.375v3.714zm-10.937 14.111 9.375-9.231v-3.786c-.146-.032-.326-.054-.537-.066-.211-.013-.433-.024-.666-.037-.231-.011-.462-.03-.689-.054-.228-.024-.434-.066-.617-.126-.184-.061-.332-.143-.446-.247s-.171-.248-.171-.433c0-.209.077-.389.231-.541.155-.152.339-.228.55-.228.399 0 .792.004 1.178.012s.775.056 1.166.144v-1.694h-7.165l-9.376 9.231zm7.813-.902c.863 0 1.673-.162 2.429-.487.758-.324 1.418-.765 1.984-1.322s1.014-1.208 1.343-1.953c.33-.745.4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Surface_Home_Hero_Spring_21_color_V1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1920x720, frames 3
Category:	downloaded
Size (bytes):	90291
Entropy (8bit):	7.8974920099993415
Encrypted:	false
SSDEEP:	1536:8Nl1BLC7px1ZsC9vC/LCLUMYLop2gEMgKlDnafFKhTjZGHbqrJ4RstXF8m11LQyZ:8NlmfvsGv0UUFcUhMhlDaFKhTjQWr6Ap
MD5:	49F61229D41A16BC4CB3207BDAFF459B
SHA1:	EEB2AE255DB97C20CD0CC7876E456B7A45D3E86F
SHA-256:	6B1B23D66D6842FAE03A6E21C159CEF8F054FB7925D316B222397E5D175420F4
SHA-512:	DE2E95AAF8A83749F75FE427B88934AF27FCD14F8D7822520AE317719D626D2D2DEFD0A4C628611937CFA25BCBBE8E9183060211FE4AF24392C5340FF8FDAE1F
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Surface_Home_Hero_Spring_21_color_V1.jpg?version=672b6412-c20f-66ff-49d7-10347a5ab07e
Preview:	......JFIF..............................................................................................................................................................................................................@.I$...IU$..$..5.C ...U.4h.&.&..D.H.H$P .A .A .I..@.H4I$.UU.a.UU.2.uYq.WF..K.%.%.wwwwwwww....r....ws...I .I..Q.CR.CUU..UF.5T!4h.M.I$.I$.I... .. .H .A$.D.h.h.P...!.Cp.....2.IrK..K..........E......w.wrI$.d.C$.Q.CP.F.P.5Th.F."...h...$Q....H$.A .A .H$.E..4.......UUUT.\|.S...IteUT..\..].....)w.)w.)w..\.....$.CRI!.I.I(.d..J.h.Q.h.h.$.I$... .. .A .A .H$.@.I.I$.a....UUU\...C.Eur..D.%.r....]....w......r....I.I$..I..Q.R....CUF...4h.$.@.h...I..A.....A..A..9....I.......UW98..{4MH...G..}.T.r].......qIwr....r.)..$.HjI%T.J2HjUHj...j....&..@.$.I.(P ....$.H .H$.. .I$. .UQ.TeUUJ....;..&..5...o....@MT....].....\..w....r..^.I(.$.I$.$....2..j.......&.&..h.A$.H ....I..A..H$.I$...5(.2.T..~.G..$..?..5........`.j].Wwww..R.]......]....$...I..HjI..J0...U....&..I4I$.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Surface_Home_Mosic_Fall_20_Studio_2_en-us_V2[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1067x1204, frames 3
Category:	downloaded
Size (bytes):	65223
Entropy (8bit):	7.654821000346925
Encrypted:	false
SSDEEP:	768:owa5TqsH9Rk5gw0PQE5pcx66V7sGFXsqR/Se/voVMQ7pryXHdo9MahGMn8jMHBa0:IzH9RkCKt9seSe/vKlgran8zIcijYeZ
MD5:	5B7962F8382200712B20A18026AB88D3
SHA1:	61D43D9EC3785CD4831CC44C3532E5F580B26195
SHA-256:	0E6E7B32EBBCFA08DD1E10F08B5CC5CAE44B5715FF6C088CB726F3B2E191AC91
SHA-512:	885D9AC6B62F9FE6E49B309F1D44E7BC3FC0FF05CBF7985452779EE7518223EABC41B9A606FEE72B94AB58CA69775D48CDDDAF5589FCCF7349A8C0B89E0D730C
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/Surface_Home_Mosic_Fall_20_Studio_2_en-us_V2.jpg?version=baee2e89-216e-2abc-0a9c-736048910609
Preview:	......JFIF........................................................................................................................................................+....................................................................................................................................................................................................................................................................................................................}$...I(..b.IP.......s.E;.......W.....X..XX..h.@.),RYD...N@......mw$.K.dR..,Y`....a}...................Y@...../.~........8.._.>..,,(..Q(EK).).e.O....<................).T...,.BT.e.,YH.U......................E.P.Q,...)..T..}g........p..F.x=..,...e.Yb...X..KYS/.]k.. .....p?.>.x=......YH....".......g.......8.._....R.%.TT.Ie........e.K.{..[.......p..>>......@T...!`.....b.U...T.................{.HT....YR.R.B.`T...2...S.............c.....R.....P...).*..J.\|R._..o........_.z0....%......b.T..,P.).R.R._.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\Twitter[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 20 x 20, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	369
Entropy (8bit):	7.156142843233795
Encrypted:	false
SSDEEP:	6:6v/lhPUFR/vE7UZnVcNbYP9RqPCLzLmAhd8UBVTyyuhowJctIvKnqhQiqbWFkqCF:6v/7i/XqNbYPuPCUUju+wytIvKnqhdqB
MD5:	93CA1A80FFCE09717DFFCE31F46C6AD3
SHA1:	39E9F6103A283006234A4FBB63616298C4F99574
SHA-256:	02AC1C1A2BF961E85B8D3B4038DC18D781C3162C441871114001D3E2A357D565
SHA-512:	B10A7C31FD53570A852C19509DC9E977F74B0516399E32FA48D6818EFB51DC6EF2EDC61C55BEAC70870C05FEE719CEA707ABFE82F6E49BCDCB44C54CF2AFFB83
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/10609c90/office.testdrive/images/social/Twitter.png
Preview:	.PNG........IHDR.....................sRGB.........gAMA......a.....IDAT8O..?K.a...B.'.1pihj1.....ADhls.....'...Z\|.5..H..{.. T4..Q......y'n~..q...<.'g.=F.C.}.p.4b8.6.2^....1T\|Z.H.l@..%.P........A.f....6....M...^.....S.`...."......u...=...^.x.....=..~...4..k...&.y...*C..e.j.K..I......-...&&o9.:~.-.;G.jG./..........\|%Np.W.@..F..[.b.s.1.0f...A0.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\arrow_px_up[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 7 x 9
Category:	dropped
Size (bytes):	829
Entropy (8bit):	0.6055646407132698
Encrypted:	false
SSDEEP:	3:CKY1q/rylAxrt/laIFBYEQvyIFle:sGFaIFBYfvDfe
MD5:	95B65C94F57061E15ECC8304D3E578D5
SHA1:	A7483D668A780949FDA842F39877A3C08D0FC51C
SHA-256:	BDA2D6EB8E72B3DBCA5EEF086178033F8A2BB3481180B2C63295FCF23843D960
SHA-512:	B17552D90D0038531A5F4E78DA553F9109346CB25851F38996BFAB54906A898DE848FEFFD31E8D0BF0A32D956513CA7ED72D2F4C3AE47922C6F9D370584288EF
Malicious:	false
Reputation:	low
Preview:	GIF89a...........3...........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................!.......,............... .`.....\8....!>L(.b@.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\azuremediaplayer.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	620423
Entropy (8bit):	5.728631442716718
Encrypted:	false
SSDEEP:	12288:LBq+eT6V6R4aV05SDYSICrpYlFMcC1RocZBBMTtDDyYszjL43urfp53YhRjg2sjn:LBq+eT6E65tPuf
MD5:	E497E6868B3C48B534610B6446969A77
SHA1:	9E8394E2914897517783EAD4B3279AEE3BE7686E
SHA-256:	C45F7559DDBC271AF8A56DC959304FB511D76A40249CAB3EC31C67B79B2D2BA8
SHA-512:	4E0900E091FBDD32ABE653E72CEE1BD8DD0E576A67D500C65685FE517892D6F6DA7762DC1FE90D25721F8B6519B1B39854ADA9F7C72F2EB610F658C53DA09BF2
Malicious:	false
Reputation:	low
IE Cache URL:	https://amp.azure.net/libs/amp/1.8.0/azuremediaplayer.min.js
Preview:	/* Azure Media Player v1.8.0 \| (c) 2015 Microsoft Corporation */..function _handleMultipleEvents(n,t,i,r){vjs.arr.forEach(i,function(i){n(t,i,r)})}function _logType(n,t){var i,u,r;i=Array.prototype.slice.call(t);u=function(){};r=window.console\|\|{log:u,warn:u,error:u};n?i.unshift(n.toUpperCase()+":"):n="log";vjs.log.history.push(i);i.unshift("VIDEOJS:");r[n].apply?r[n].apply(r,i):r[n](i.join(" "))}function ObjectIron(n){var t;for(t=[],i=0,len=n.length;i<len;i+=1)n[i].isRoot?t.push("root"):t.push(n[i].name);var e=function(n,t){var i;if(n!==null&&t!==null)for(i in n)n.hasOwnProperty(i)&&(t.hasOwnProperty(i)\|\|(t[i]=n[i]))},u=function(n,t,i){var o,s,r,u,f;if(n!==null&&n.length!==0)for(o=0,s=n.length;o<s;o+=1)r=n[o],t.hasOwnProperty(r.name)&&(i.hasOwnProperty(r.name)?r.merge&&(u=t[r.name],f=i[r.name],typeof u=="object"&&typeof f=="object"?e(u,f):i[r.name]=r.mergeFunction!=null?r.mergeFunction(u,f):u+f):i[r.name]=t[r.name])},r=function(n,t){var f=n,o,c,s,l,h,i,e;if(f.children!==null&&f.childr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\background_gradient[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.02, aspect ratio, density 100x100, segment length 16, baseline, precision 8, 1x800, frames 3
Category:	downloaded
Size (bytes):	453
Entropy (8bit):	5.019973044227213
Encrypted:	false
SSDEEP:	6:3llVuiPjlXJYhg5suRd8PImMo23C/kHrJ8yA/NIeYoWg78C/vTFvbKLAh3:V/XPYhiPRd8j7+9LoIrobtHTdbKi
MD5:	20F0110ED5E4E0D5384A496E4880139B
SHA1:	51F5FC61D8BF19100DF0F8AADAA57FCD9C086255
SHA-256:	1471693BE91E53C2640FE7BAEECBC624530B088444222D93F2815DFCE1865D5B
SHA-512:	5F52C117E346111D99D3B642926139178A80B9EC03147C00E27F07AAB47FE38E9319FE983444F3E0E36DEF1E86DD7C56C25E44B14EFDC3F13B45EDEDA064DB5A
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/background_gradient.jpg
Preview:	......JFIF.....d.d......Ducky.......P......Adobe.d................................................................................................................................................. ...............W..............................................................Qa.................................?......%.....x......s...Z.......j.T.wz.6...X.@... V.3tM...P@.u.%...m..D.25...T...F.........p......A..........BP..qD.(.........ntH.@......h?..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\d7-de3320[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	394823
Entropy (8bit):	5.30161002536564
Encrypted:	false
SSDEEP:	6144:1fwtwmyU4srxCqFOp03Mw1+/cg3poEjOJ2MVuGiHr6LkQ:xawmxxn917q+
MD5:	B2FD768947568A5662CCF6BB997A5A8E
SHA1:	C2698A8F72DDB52155597968DE2F6F9806A3ED0A
SHA-256:	C1C2570AF78E579B706B5C4DD7EFD9247189F4B5634AE20119B25135C5CDF48F
SHA-512:	6520DA3315900BCC4C0A860E5A33CE31CD548105115630D6A0FBEA11E2E561F5D3BF9529BACFEA580D09BB0E04BDB286F4EA4F918FB31B0013EE21EC209B5822
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/MICROSOFT-365/_scrf/js/themes=default/9e-6ade99/b4-ce5167/2b-b6ab60/7e-a075ed/28-8f59e1/1e-b84759/58-f3fc85/d6-6e76d0/19-9c8e36/a3-e4fa11/b2-9d8af8/66-afd0b6/f5-7e27a5/d7-de3320?ver=2.0&_cf=20210415
Preview:	define("notificationBanner",["jqReady!"],function(n){"use strict";function i(){var o=document.querySelector(t.id),f,i,s,e;if(o)for(f=o.querySelectorAll(t.clsMessage),u(),i=0;i<f.length;i++)if(s=f[i].getAttribute("data-sel"),e=document.querySelector(s),e){var h=f[i].getAttribute("data-pos"),c=n(f[i]).clone(),l=c[0];r(e,h,l)}}function r(i,r,u){try{switch(r){case"replace":n(i).html(u);break;case"replaceText":n(i).text(n(u).text().trim());break;case"prepend":n(i).prepend(u);break;case"append":n(i).append(u);break;case"before":i.parentNode.insertBefore(u,i);break;case"after":default:i.parentNode.insertBefore(u,i.nextSibling)}i.classList.add(t.clsPosElement.substring(1));u.removeAttribute("data-pos");u.removeAttribute("data-sel");u.classList.add(t.clsActiveMessage.substring(1))}catch(f){}}function u(){for(var i=document.querySelectorAll(t.clsActiveMessage),n=0;n<i.length;n++)i[n].remove()}function f(){i();document.addEventListener("moduleRefreshed",i)}var t={id:"#ownb-wrapper",clsMessage:".o

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\default[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	213574
Entropy (8bit):	5.16776280268403
Encrypted:	false
SSDEEP:	6144:STQZaZEzF0a6OGYL0seowg6ehsymCJ2i/T9VTSfaTHgJi7eshMcgGW3la:ScZaZEzX6OGYQseowg6ehsymCJ2i/pVP
MD5:	D2B48740CC5B0E12A364F40013FE3EB2
SHA1:	7DE6C08601F195A7F7E24A77311599FC9F53D30F
SHA-256:	2C9F395C5E8815C014A253BD8792F53BF4E69975F4B95DA791B75A71C3BDE698
SHA-512:	BACE9A9210B5977739B14078C22111D1B02E31A1C56FBEC38D17DB94140F1F07A248C733355AC0D16D7F8FFB1E4D0ECDA68B35F77E97D586E5D714D0A3D37A5D
Malicious:	false
Reputation:	low
Preview:	.<!DOCTYPE html ><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext" xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta name="viewport" content="initial-scale=1.0, width=device-width" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><title>Microsoft Services Agreement</title><meta name="Title" content="Microsoft Services Agreement" /><meta name="CorrelationVector" content="0000000000000000.0.0" /><meta name="Description" content="" /><meta name="MscomContentLocale" content="en-us" /><link href="https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/16-3b4837/cf-7f2b14/7b-5ab060/b2-7c2f2c/af-85090f/b0-adecbe/42-6d7c67/52-7ec320?ver=2.0&amp;_cf=20210415" rel="stylesheet" type="text/css" media="screen" /><link href="https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7" rel="stylesheet" type="text/css" media

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\e3-082b89[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	111975
Entropy (8bit):	5.23061719734599
Encrypted:	false
SSDEEP:	1536:uzUHQTAz7pxhX2OG+59gEkpCI+IX8BJWxFu209RhY8WOyd1EwgXA9GKamAMKSAAU:uzUzpxJIS20y9d1EwgXA95KScDCE4+
MD5:	B262085F48671616EFE0257B98C3F466
SHA1:	AA207DB69ECACA2D8198803A8A0AF654D9C0823C
SHA-256:	C63CC1C08E9AD6D4EAB20045A3D5AD6E0B712486E676C45830217714E280C451
SHA-512:	17F99F9A70CAFE636D8DEC9EFE2AC6AB26F64C699020923F0C70C5B4C0B7304A99C0FFBCF0103C6F92C0BB295C46B085CAD52D811ED2BB3E2D6F9067E0FB03D3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/MICROSOFT-365/_scrf/js/themes=default/2f-63ce8f/2d-7a9063/dc-7e9864/4f-5115f8/7d-266f10/4a-abd94b/6d-c07ea1/9d-b58f60/f6-aa5278/cd-23d3b0/6d-1e7ed0/b7-cadaa7/c4-898cf2/ca-40b7b0/4e-ee3a55/3e-f5c39b/c3-6454d7/f9-7592d3/92-10345d/f8-73a5f2/79-499886/7e-cda2d3/69-13871c/b7-0ad59f/91-97a04f/1f-100dea/33-abe4df/17-f90ef1/e3-082b89?ver=2.0&_cf=20210415
Preview:	var __extends;define("ajaxWithAnimation",["jqReady!","jsll"],function(n,t){var i=["<div class='c-progress f-indeterminate-","regional","' style='margin:","0","px auto' tabindex='0' role='progressbar'><span><\/span><span><\/span><span><\/span><span><\/span><span><\/span><\/div>"],u=function(t,r){var u=n(t),o,f,e;u.length&&(o=(r.loaderType\|\|"").toUpperCase(),i[1]=o==="PROGRESS"\|\|o==="PROGRESSBAR"?"regional":o==="SPINNERLARGE"?"local f-progress-large f-center":"local f-progress-small",r.margin&&r.margin.length&&(i[3]=r.margin),f=i.join(""),e=(r.loaderPosition\|\|"").toUpperCase(),e==="TOP"\|\|e==="BOTTOM"?(u.addClass("ajaxloader"),e==="BOTTOM"?u.append(f):u.prepend(f)):(u.parent().addClass("ajaxloader"),e==="BEFORE"?u.before(f):u.after(f)))},f=function(t,i){var r=n(t),u;r.length&&(u=(i.loaderPosition\|\|"").toUpperCase(),u!=="TOP"&&u!=="BOTTOM"&&(r=r.parent()),r.removeClass("ajaxloader").children().remove(".c-progress"))},r=function(i){i.refreshElement&&u(i.refreshElement,i);var r=n.extend(i,{s

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\en[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text
Category:	dropped
Size (bytes):	184
Entropy (8bit):	4.873370132313155
Encrypted:	false
SSDEEP:	3:8ROFKGQIeNi1Xbvx9M84JxeCAIuREg7F6nmqD9yQXAzHW+q1ErX/JvucbNAWFq:AYSI0MXLxu2CAIuh7FUYQXArw1EFucbi
MD5:	3138D6704A4F58851758FE297667B351
SHA1:	4043586C45262B678B5B671D8B01BFD0A6DB08FB
SHA-256:	F5C289D8F7C451A3393A959E1C4E9A1C759FE629B12195DEBAF0A7EA1822F84E
SHA-512:	DC493711A9EC5DA5F84850A68AEAC2DE1BCCCAB2B2FBFBF9D8487DA41D89FB27D62A4548B754724BDE5A020777063E7D8F8948A5ED8CC2F9CEB9FC61EEAE55B6
Malicious:	false
Reputation:	low
Preview:	<head><title>Document Moved</title></head>.<body><h1>Object Moved</h1>This document may be found <a HREF="https://bingexplore.azurewebsites.net/bing-data-suppliers/en/">here</a></body>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\errorPageStrings[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4720
Entropy (8bit):	5.164796203267696
Encrypted:	false
SSDEEP:	96:z9UUiqRxqH211CUIRgRLnRynjZbRXkRPRk6C87Apsat/5/+mhPcF+5g+mOQb7A9o:JsUOG1yNlX6ZzWpHOWLia16Cb7bk
MD5:	D65EC06F21C379C87040B83CC1ABAC6B
SHA1:	208D0A0BB775661758394BE7E4AFB18357E46C8B
SHA-256:	A1270E90CEA31B46432EC44731BF4400D22B38EB2855326BF934FE8F1B169A4F
SHA-512:	8A166D26B49A5D95AEA49BC649E5EA58786A2191F4D2ADAC6F5FBB7523940CE4482D6A2502AA870A931224F215CB2010A8C9B99A2C1820150E4D365CAB28299E
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/errorPageStrings.js
Preview:	.//Split out for localization...var L_GOBACK_TEXT = "Go back to the previous page.";..var L_REFRESH_TEXT = "Refresh the page.";..var L_MOREINFO_TEXT = "More information";..var L_OFFLINE_USERS_TEXT = "For offline users";..var L_RELOAD_TEXT = "Retype the address.";..var L_HIDE_HOTKEYS_TEXT = "Hide tab shortcuts";..var L_SHOW_HOTKEYS_TEXT = "Show more tab shortcuts";..var L_CONNECTION_OFF_TEXT = "You are not connected to the Internet. Check your Internet connection.";..var L_CONNECTION_ON_TEXT = "It appears you are connected to the Internet, but you might want to try to reconnect to the Internet.";....//used by invalidcert.js and hstscerterror.js..var L_CertUnknownCA_TEXT = "Your PC doesn\u2019t trust this website\u2019s security certificate.";..var L_CertExpired_TEXT = "The website\u2019s security certificate is not yet valid or has expired.";..var L_CertCNMismatch_TEXT = "The hostname in the website\u2019s security certificate differs from the website you are trying to visit.";..var L

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\favicon_a_eupayfgghqiai7k9sol6lg2[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 6 icons, 128x128, 16 colors, 72x72, 16 colors
Category:	downloaded
Size (bytes):	17174
Entropy (8bit):	2.9129715116732746
Encrypted:	false
SSDEEP:	24:QSNTmTFxg4lyyyyyyyyyyyyyio7eeeeeeeeekzgsLsLsLsLsLsQZp:nfgyyyyyyyyyyyyynzQQQQQO
MD5:	12E3DAC858061D088023B2BD48E2FA96
SHA1:	E08CE1A144ECEAE0C3C2EA7A9D6FBC5658F24CE5
SHA-256:	90CDAF487716184E4034000935C605D1633926D348116D198F355A98B8C6CD21
SHA-512:	C5030C55A855E7A9E20E22F4C70BF1E0F3C558A9B7D501CFAB6992AC2656AE5E41B050CCAC541EFA55F9603E0D349B247EB4912EE169D44044271789C719CD01
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/favicon_a_eupayfgghqiai7k9sol6lg2.ico
Preview:	..............h(..f...HH...........(..00......h....6.. ...........=...............@..........(....A..(....................(....................................."P.........................................."""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333"""""""""""""""""""""""""""""" ...333333333333333333333333333333""""""""""""""""""""""""""

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ibs_dpid=358&dpuuid=5907226049393872976[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\ibs_dpid=477&dpuuid=b2b7833ec889d221af12f0ba5043f826a6000f25cf04b8f39e44a25b2082133fb0da87c991749652[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\icons[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), icons family
Category:	downloaded
Size (bytes):	4388
Entropy (8bit):	5.568378803379191
Encrypted:	false
SSDEEP:	96:2WZx42qACoApC6do8MPOGiN4mER38GTDfO/fv:1x42qAHAo6VMPi6mcTy
MD5:	77E1987DF3A0274C5A51E3C55CEE7C98
SHA1:	9B0FE96AF141AB09183F386F65BC627B8C396460
SHA-256:	EF04649D4D068673CF0FA47EF4C45C8BE291E703F4EC5FC0E507F17839120AA2
SHA-512:	B1E0CFB515FF2298799BA54574899D27B1FC043F66CC4E9591C504F88273B98697B99ED25955DB84986B39ED9F51864611833DC88064B14C29ADC020FBF6E295
Malicious:	false
Reputation:	low
IE Cache URL:	https://assets.onestore.ms/cdnfiles/external/oneui/oneui1.16.2/dist/fonts/icons/icons.eot?
Preview:	$.................................LP...........................G....................i.c.o.n.s.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .1...0.....i.c.o.n.s................ OS/2@.Mn...(...Vcmap.1.........Jglyf..........dhead.9.........6hhea.$.........$hmtx@...........loca". h...L...Bmaxp.3.`....... name............post{NK............................................ ........G..._.<............\|.......\|......................... .T...................................D.l...H.D.l....................................PfEd.@...........................................................................................................................................................................D...........(............................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\iframe[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	48389
Entropy (8bit):	5.123809708233803
Encrypted:	false
SSDEEP:	384:s5C3pnw6f+Mhe7R0iiPjREJErlwZmh3pC5Ol5lSFusI4mhCr1p1Uo:hPf+OgR0FRGEriZmls5mYgYmQ1p1Uo
MD5:	3AD2F6F3CC9CB6088EC78F3FDC310E26
SHA1:	302346F15C9FC603F6D13565A304EEC9F3DF85CE
SHA-256:	EA3F2F982E7A05F93BF4DCEEB96839359A5F5F6633AD5333B3BFA6DCCE5AA646
SHA-512:	81D444B13E5005E752069C493024FFD51671B0E2F0CDA8F4F3E6D144C6A4A125FA33979666F0876BCAA2660F3189EF383ED5A3FFCDECEFA315042261C2EAB991
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>.<html lang='en'>.<head>..<title>iFrame Cart Page</title>..<meta charset='utf-8'>..<meta http-equiv='X-UA-Compatible' content='IE=edge,chrome=1'>..<meta name="format-detection" content="telephone=no"/>....<meta name='viewport' content='width=device-width,initial-scale=1.0,minimum-scale=1.0, maximum-scale=1.0, user-scalable=no'/>...<style>...body {....background-image:url('https://lpcdn.lpsnmedia.net/le_unified_window/9.12.0.19-release_4769/resources/loader_on_warmGray5_75.gif');....background-repeat: no-repeat;....background-attachment: fixed;....background-position: center;...}....@font-face {....font-family: "Segoe UI";....src: url("https://c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.woff2") format('woff');...}......* {....font-family: "Segoe UI", Arial, sans-serif !important;...}....body #lpChat .lp_dialog_container .lp_buttons_area .lp_confirm_button {....color: #000 !important;...}.....lp-iframe-window, .lp_desktop #lpChat > .lp_maximized {..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/info_48.png
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\latest[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Segoe UI Light family
Category:	downloaded
Size (bytes):	28315
Entropy (8bit):	7.9724193003797
Encrypted:	false
SSDEEP:	384:+R0Z7+bHAtrQ1yBFbgqLct7rJhhPLLkHsrvSzaJu4mI3n5o+MmKCxDg6iT7jdVye:+uNUAtE3phPLLFTiMu+pxCjHyGEQ9zL
MD5:	17DFE73CB9C64527F7248B0A24DB317D
SHA1:	345198B9239FCDAF038FB2D3A919E4724037DBAA
SHA-256:	AD75FB92B2EBCE6C37640F03E1AB96A752F388BCE60C877ADE4780B13839E8C4
SHA-512:	421B56D93E9BD5E4B4449DD0FCDEE8D531087FD484C91530AAF0A67EDEA33D5AC2F14A7F4966C528C0F130F17F26629FCAB9F8AB47E950CEB5B9F1A827EA0728
Malicious:	false
Reputation:	low
IE Cache URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/light/latest.eot?
Preview:	.n...m............................LP#...B.............. ............................S.e.g.o.e. .U.I. .L.i.g.h.t.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .5...3.2.....S.e.g.o.e. .U.I. .L.i.g.h.t..........K..e..66......U.D.-..iu...4P\..GLFM..C?.;..-...~\|...P..\.(..)RI.....>.>..CE..SsV.jPR...H.......].R..&.n.hT.......x.....q .......wA[....F.........c.".......Zed..>.?...`..3...B..W....R....F.j....v..'?.5.k^........+..a...).._].x.#QSi.....\|<t....k.;..Hv1.G...L$.9....5.t.:...V.Y.......\|.@....B.....P`..2.Z.0....2`.FR.MF8.x....GP0..$:.....PYm.22..."S."1.j[=.=.mR........j....&.4...k..].1@..y$......"y..C..g7..k.B...V..F\...G.m.jK ...O....b.Qlo...!.N.V....t.[..p.N..~@1d...YX.."....R_i.4.$j.P..U....u9...<..6..4%........9`.....S...N.Y..L..B$2\.E.vhe...n..h..5..Z..K?.H..S...2..=R..x.....EX.2......$."....It8..z.+.h ..$.2T....}Z../....p..b0ae.qq.(-v1..E.!.l".a..p.).;..8t..7..^..W...4A.D\eOb$......b.NI.Pe.#$.O38....,....g..&\|...B{...].....9..u.8..~Y...3.X..ff.,.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\latest[2].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Segoe UI Semibold family
Category:	downloaded
Size (bytes):	30643
Entropy (8bit):	7.976822258863597
Encrypted:	false
SSDEEP:	768:UOtV1asJ9G0dAdnVrKX/HkVJRPvkgxYZ4Zoe:bLasJ9G0u0fk/RnkgxGof
MD5:	E812BA8B7E2A657F2B70CFACE93C7682
SHA1:	2F02CDDBB483F9B11BBBE74C3CA917A4C345FBAD
SHA-256:	3330C1DEAC468874238DD0C6BF902179A8731EDA8A208C7D01DAC0AB1EAE1BC9
SHA-512:	354B2DB12BC1D67F26F94352B0B663DAD64C46C107454FC19CFEA01C54BB09340BC26C06DE1B96FF826F5287CE246A6317722BAE41B72B63BA86FDAF844BA94E
Malicious:	false
Reputation:	low
IE Cache URL:	https://i.s-microsoft.com/fonts/segoe-ui/west-european/semibold/latest.eot?
Preview:	.w...v......................X.....LP#...B.............. ..........................".S.e.g.o.e. .U.I. .S.e.m.i.b.o.l.d.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .5...3.2...".S.e.g.o.e. .U.I. .S.e.m.i.b.o.l.d........H.P..lb.7^......U.D.-..iu...:4P\..GLFM.Y.#?.;..-...~}_).z{.rmD.1".$.....{.t.....=...!cK...%.~.....g........j.9S....6. ..n..V.]pz...e.....#X...=,.p.F..6&.VR...k$~J..n....7.......K.8..T.....x..J......#.J.XaQ.Q%_{3..xr.... 0Dm...k..Ep..........>..?Pk!KB..C...Q.q..1=6<,.S.F.&B..J.....ya2b."S.......6.2.......H........09A...Tb/.&.d..#.E.:.E.(..I5.M..444d.1........K..l...l.O..VBb...:..:b..Mh.'=4.d/..o.k.mMm........bx..!..S.@E.....>@:..k.JCas..7."..uG3hR.h..w..8W>.4.........pX....J..a....}.Y......(>H^=.`=.mg.!.....w'...J.<.ob..3A .../.....5%.'....XS0a......I.Ia....a...=..g..........{V1+.."_)7$2 O..!bb.=..\|.s.1..2qm..#.O......+E(I..1....EgQ.....E)R.m.?.8.q...J.G.@!f..n.F.r#..(..2p.?.9.8..?.d]..s..0.9.f..A...r.iq....x.g.aO....S.....R0i..BT.yl.".<k...:&Ja.\.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\linkedin[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 32 x 32, 8-bit/color RGB, non-interlaced
Category:	downloaded
Size (bytes):	340
Entropy (8bit):	6.89748464898483
Encrypted:	false
SSDEEP:	6:6v/lhP1RnDspTAkgcqadiGjXMnThBRqDOLWlQ78GwKjFkYCaprI51Fu/Vp:6v/79G9AIqa4GrMnFql+7xjFmirIoz
MD5:	082196E344000587C008B768820283B6
SHA1:	A0A3A982764456CF74F75B47F7B5C517A628E586
SHA-256:	A91DC0F2545A1929E0C6A180C1728C433B23602A4C8AEC06552F5604525689CA
SHA-512:	FDBC29F6D3DF628007683DD6D8A8F3F0FA1CF743C72AC1F078F2C5FE37A360182B1CBA371F0F20B4F795F3BC3A1135103A2BCE190F69FA7ED8E31205CEF6C96A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/onerfstatics/marketingsites-neu-prod/_h/b23f9ba2/coreui.statics/images/social/linkedin.png
Preview:	.PNG........IHDR... ... ............tEXtSoftware.Adobe ImageReadyq.e<....IDATx.bd,..@K..@c0j..[..).o,..)........g/<.De.@L.2..9..Q?. .C..$..-.......K.[....p?x.]..K.Z.H..<m......L.@....7^}Y........./D.Vl..........`.:.:.i.9...tHz.V.mN.......@...........3.9.L<.`..'......../..g?D.T....oX.T..;V.h.6R-`.m.Z@1..0..Ec^..\|.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\marching_ants_b540a8e518037192e32c4fe58bf2dbab[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	3620
Entropy (8bit):	6.867828878374734
Encrypted:	false
SSDEEP:	48:ZumKaT5ezv47j2/ZiRDlq16x8XvEUcg777shHdpHVGJqFd:Eal647jPDlL8XvEUcg77kVGyd
MD5:	B540A8E518037192E32C4FE58BF2DBAB
SHA1:	3047C1DB97B86F6981E0AD2F96AF40CDF43511AF
SHA-256:	8737D721808655F37B333F08A90185699E7E8B9BDAAA15CDB63C8448B426F95D
SHA-512:	E3612D9E6809EC192F6E2D035290B730871C269A267115E4A5515CADB7E6E14E3DD4290A35ABAA8D14CF1FA3924DC76E11926AC341E0F6F372E9FC5434B546E5
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_b540a8e518037192e32c4fe58bf2dbab.gif
Preview:	GIF89a`.........iii!.......!.&Edited with ezgif.com online GIF maker.!..NETSCAPE2.0.....,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....`.....9..i....Q4......H..j.=.k9-5_..........j7..({.........!.......,....`.....9.......trV.......H....`.[.q6......>.. .CZ.&!.....M...!.......,....`.....8..........:......H..jJ..U..6_....../.el...q.).....!.......,....`.....9.....i..l.go.....H..".U...f......._......5......n..!.......,....`.....:..i......./.....H...5%.kE/5.........In.a..@&3.....J...!.......,....`.....9.......kr.j.....H...-.{Im5c..............@&.........!.......,....`.....9.........j..q....H...].&..\.5.........8..S..........!.......,....`.....9.......3q.g..5....H...:u..............Al..x.q.........!.......,....`.....9......\.F....z....H...zX...ov.........h3N.x4......j..!.......,....`.....9........Q.:......H....y..^...1.........n.!.F......E...!.......,....`.....8.........i,......H....*_.21.I.........%...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\marching_ants_white_166de53471265253ab3a456defe6da23[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 352 x 3
Category:	downloaded
Size (bytes):	2672
Entropy (8bit):	6.640973516071413
Encrypted:	false
SSDEEP:	48:ZaOdwduTYPpS9pZy9vDNi1miicsvrJkafMiS+MGQ09DU/X9/4Xp6m5Z9SQcq:4CIuTYPpSTc9vcPZX9/2gzQ/
MD5:	166DE53471265253AB3A456DEFE6DA23
SHA1:	17C6DF4D7CCF1FA2C9EFD716FBAE0FC2C71C8D6D
SHA-256:	A46201581A7C7C667FD42787CD1E9ADF2F6BF809EFB7596E61A03E8DBA9ADA13
SHA-512:	80978C1D262BC225A8BA1758DF546E27B5BE8D84CBCF7E6044910E5E05E04AFFEFEC3C0DA0818145EB8A917E1A8D90F4BAC833B64A1F6DE97AD3D5FC80A02308
Malicious:	false
Reputation:	low
IE Cache URL:	https://aadcdn.msftauth.net/shared/1.0/content/images/marching_ants_white_166de53471265253ab3a456defe6da23.gif
Preview:	GIF89a`............!..NETSCAPE2.0.....!.......,....`.....6......P.l.......H....I..:qJ......k....`BY..L..&...!.......,....0.............<....[.\K8j.tr.g..!.......,....3............^;...\UK.]\.%.V.c...!.......,....7........`....lo...[.a..*Rw~i...!.......,....;........h.....l.G-.[K.,_XA]..'g..!.......,....?........i.....g....Z.}..)..u...F..!.......,....C...............P.,nt^.i....Xq...i..!.......,....F...........{^b....n.y..i...\C.-...!.......,....H..............R...o....h.xV!.z#...!.......,"...L.............r.jY..w~aP(.......[i...!.......,(...N.............r....w.aP.j.'.)Y..S..!.......,....H.........`......hew..9`.%z.xVeS..!.......,5...A.........`...\m.Vmtzw.}.d.%...Q..!.......,9...=.........h......3S..s.-W8m...Q..!.......,A...5.........h.....N...:..!..U..!.......,H.............h....M.x...f.i.4..!.......,O...'.........i...tp......(..!.......,X.............j...@.x....!.......,].............j..L..3em..!.......,e.............`......!.......,n..............{i..!..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\meBoot.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	158441
Entropy (8bit):	5.5487164826749975
Encrypted:	false
SSDEEP:	3072:5iJTI1B9EHzBbiiPRJfD51eEGSZzACifqSASP:gJcaBbi2GPCYqSASP
MD5:	075745C8863CD68B5045A3069E2D7B9F
SHA1:	7606871F90B48F3B570B2A3744131CB69A158E4A
SHA-256:	72A3C99D27666F9AC1D757995CCF4DE8C2D1DD5E44DD0641410DB8C0EC51848B
SHA-512:	3A1922ACCE42392C16837067B62F839D6FAE5C533A31687C7CB97D71CAF846CE9A09805AE75BC8FCD4D58928E54F6292B28FFE355D18F694552DA443C29E641F
Malicious:	false
Reputation:	low
IE Cache URL:	https://mem.gfx.ms/scripts/me/MeControl/10.21123.2/en-US/meBoot.min.js
Preview:	MeControlDefine("meBoot",["exports","@mecontrol/web-inline"],function(t,w){"use strict";var c=function(){},i={},u=[],p=[];function S(t,e){var r,n,o,i,a=p;for(i=arguments.length;2<i--;)u.push(arguments[i]);for(e&&null!=e.children&&(u.length\|\|u.push(e.children),delete e.children);u.length;)if((n=u.pop())&&void 0!==n.pop)for(i=n.length;i--;)u.push(n[i]);else"boolean"==typeof n&&(n=null),(o="function"!=typeof t)&&(null==n?n="":"number"==typeof n?n=String(n):"string"!=typeof n&&(o=!1)),o&&r?a[a.length-1]+=n:a===p?a=[n]:a.push(n),r=o;var s=new c;return s.nodeName=t,s.children=a,s.attributes=null==e?void 0:e,s.key=null==e?void 0:e.key,s}function T(t,e){for(var r in e)t[r]=e[r];return t}function d(t,e){t&&("function"==typeof t?t(e):t.current=e)}var e="function"==typeof Promise?Promise.resolve().then.bind(Promise.resolve()):setTimeout;var l=/acit\|ex(?:s\|g\|n\|p\|$)\|rph\|ows\|mnc\|ntw\|ine[ch]\|zoo\|^ord/i,r=[];function a(t){!t._dirty&&(t._dirty=!0)&&1==r.push(t)&&e(n)}function n(){for(var t;t=r.pop();)t

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\meversion[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	27697
Entropy (8bit):	5.241636390506632
Encrypted:	false
SSDEEP:	768:xkYipPf+462FvZ6QyALeMJyr8ePnVcqMr6tAH6spyo:Hipn+462FvZ1y+Jyr803i6tAH6spyo
MD5:	C64E115B9ABADC9F507E16AD640D40F7
SHA1:	BE2BF6BBE9F2875C8B3591D0724FC7913E37B89E
SHA-256:	A8005CD6EE847E719C01182A21D04D2BFD5AABAA873AE66F5C6CC8CFEB975DCD
SHA-512:	5F02351594AAE4F4B9ADE7575E3C09A3943BE30EDBC657895845A973006452955CD9681D004E4D14002367B7BDCBEBA9569FE69FCDA31BCCDF1FD2EB7934BF27
Malicious:	false
Reputation:	low
IE Cache URL:	https://mem.gfx.ms/meversion?partner=surface&market=en-us&uhf=1
Preview:	window.MSA=window.MSA\|\|{};window.MSA.MeControl=window.MSA.MeControl\|\|{};window.MSA.MeControl.Config={"ver":"10.21123.2","mkt":"en-US","ptn":"surface","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario","remAcc":true,"main":"meBoot","wrapperId":"uhf","cdnRegex":"^(?:https?:\\/\\/)?(mem\\.gfx\\.ms(?!\\.)\|controls\\.account.microsoft?(?:-int\|-dev)?(\\.com)?(:[0-9]{1,6})\|amcdn\\.ms(?:ft)?auth\\.net(?!\\.))","timeoutMs":30000,"graph":false,"aadUrl":"https://myaccount.microsoft.com","msaUrl":"https://account.microsoft.com/"};window.MeControl=window.MeControl\|\|{};window.MeControl.Config={"ver":"10.21123.2","mkt":"en-US","ptn":"surface","gfx":"https://mem.gfx.ms","dbg":false,"aad":true,"int":false,"pxy":true,"msTxt":false,"rwd":true,"telEvs":"PageAction, PageView, ContentUpdate, OutgoingRequest, ClientError, PartnerApiCall, TrackedScenario"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mwf-auto-init-main.var.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	307257
Entropy (8bit):	5.169381678188456
Encrypted:	false
SSDEEP:	3072:09GZepVIQHj9bOFGBiXZcwW9L4szVbkps2M3gV4L:09GNW9BBkW9oiFL
MD5:	BFCD48223E39F7A846413DD5814365E9
SHA1:	13DDB26618D203607C9B12D0D0D80F03ECB71362
SHA-256:	5E484A06AE85C5A599A6511224405A773FB3AF3D9D6600AF8F5A1B4A2C39504F
SHA-512:	FD66AA707E23432C48C5709CD75C2235850884F198B339EEA8238395A0B875ED7890AA2A04DFDF82E46C152CA7ECE88EA2B4C64C978C94BF84E274BF47A049B7
Malicious:	false
Reputation:	low
IE Cache URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.22.1/scripts/mwf-auto-init-main.var.min.js
Preview:	/! modernizr 3.3.1 (Custom Build) \| MIT . * https://modernizr.com/download/?-eventlistener-picture-printshiv-setclasses !*/.!function(e,t,n){function r(e,t){return typeof e===t}function a(){var e,t,n,a,o,c,l;for(var u in s)if(s.hasOwnProperty(u)){if(e=[],t=s[u],t.name&&(e.push(t.name.toLowerCase()),t.options&&t.options.aliases&&t.options.aliases.length))for(n=0;n<t.options.aliases.length;n++)e.push(t.options.aliases[n].toLowerCase());for(a=r(t.fn,"function")?t.fn():t.fn,o=0;o<e.length;o++)c=e[o],l=c.split("."),1===l.length?Modernizr[l[0]]=a:(!Modernizr[l[0]]\|\|Modernizr[l[0]]instanceof Boolean\|\|(Modernizr[l[0]]=new Boolean(Modernizr[l[0]])),Modernizr[l[0]][l[1]]=a),i.push((a?"":"no-")+l.join("-"))}}function o(e){var t=l.className,n=Modernizr._config.classPrefix\|\|"";if(u&&(t=t.baseVal),Modernizr._config.enableJSClass){var r=new RegExp("(^\|\\s)"+n+"no-js(\\s\|$)");t=t.replace(r,"$1"+n+"js$2")}Modernizr._config.enableClasses&&(t+=" "+n+e.join(" "+n),u?l.className.baseVal=t:l.className=t)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\mwf-auto-init-main.var.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	298040
Entropy (8bit):	5.170582206405612
Encrypted:	false
SSDEEP:	3072:09GZg9tIQHj9b1skD1nPwwwW9/xNS/xg4DJ3P26:09GrW9/DCW9Yhu6
MD5:	9CA3E3920A1FB6F3A5D3FA1F40DA56F0
SHA1:	F4AC5E5BA4422919F4CC9A8499D672754F840CE4
SHA-256:	A5E5538AB72F6C15A94665A0828BECCE000BD96113DD7CBF877FB169CCE809AA
SHA-512:	D1979F0C625F9293D4E27608AC74566F71EF41995FF76E021C037726D93A45488F7A0F8F4353ADA9E39C058B77C65294BCAF7245B2EA20914E700AA773290649
Malicious:	false
Reputation:	low
IE Cache URL:	https://assets.onestore.ms/cdnfiles/external/mwf/long/v1/v1.23.1/scripts/mwf-auto-init-main.var.min.js
Preview:	/! modernizr 3.3.1 (Custom Build) \| MIT . * https://modernizr.com/download/?-eventlistener-picture-printshiv-setclasses !*/.!function(e,t,n){function r(e,t){return typeof e===t}function a(){var e,t,n,a,o,c,l;for(var u in s)if(s.hasOwnProperty(u)){if(e=[],t=s[u],t.name&&(e.push(t.name.toLowerCase()),t.options&&t.options.aliases&&t.options.aliases.length))for(n=0;n<t.options.aliases.length;n++)e.push(t.options.aliases[n].toLowerCase());for(a=r(t.fn,"function")?t.fn():t.fn,o=0;o<e.length;o++)c=e[o],l=c.split("."),1===l.length?Modernizr[l[0]]=a:(!Modernizr[l[0]]\|\|Modernizr[l[0]]instanceof Boolean\|\|(Modernizr[l[0]]=new Boolean(Modernizr[l[0]])),Modernizr[l[0]][l[1]]=a),i.push((a?"":"no-")+l.join("-"))}}function o(e){var t=l.className,n=Modernizr._config.classPrefix\|\|"";if(u&&(t=t.baseVal),Modernizr._config.enableJSClass){var r=new RegExp("(^\|\\s)"+n+"no-js(\\s\|$)");t=t.replace(r,"$1"+n+"js$2")}Modernizr._config.enableClasses&&(t+=" "+n+e.join(" "+n),u?l.className.baseVal=t:l.className=t)}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\oneds_Xr2D7Nex80v7A-8bxF8jgQ2[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	82052
Entropy (8bit):	5.312628857785992
Encrypted:	false
SSDEEP:	768:paVnZVNvlcxbEFWEI3+d8lLCNMnSpjaQ2Z8q2G/b8bSqY4gs8Lh1mAXbQON9fAvC:cuediuNMk1T/qTlAvrQUAluA
MD5:	5EBD83ECD7B1F34BFB03EF1BC45F2381
SHA1:	CD1E0062A04B11EEB36586766BF5144955250E65
SHA-256:	4C57821AA26F21DEEBC39E3C750BC4FE246C430E5E50F4ADD0CFF53943C8C608
SHA-512:	9B56B2F1F301AD65D03514E1EC557830501805CBB81A891A518601898AE4F3C8A4C063D64036C2E8F1E539E5989CB608D535A01552BCADF008B53D1B699E9E88
Malicious:	false
Reputation:	low
IE Cache URL:	https://acctcdn.msauth.net/oneds_Xr2D7Nex80v7A-8bxF8jgQ2.js?v=1
Preview:	/!.. 1DS JS SDK Core, 2.3.4.. * Copyright (c) Microsoft and contributors. All rights reserved... * (Microsoft Internal Only).. */..!function(e,n){"object"==typeof exports&&"undefined"!=typeof module?n(exports):"function"==typeof define&&define.amd?define(["exports"],n):n(e.oneDS=e.oneDS\|\|{})}(this,function(c){"use strict";var i="function",o="object",n="undefined",a="prototype",s="hasOwnProperty";function e(){return typeof globalThis!==n&&globalThis?globalThis:typeof self!==n&&self?self:typeof window!==n&&window?window:typeof global!==n&&global?global:null}function r(e){var n=Object.create;if(n)return n(e);if(null==e)return{};var t=typeof e;if(t!==o&&t!==i)throw new TypeError("Object prototype may only be an Object:"+e);function r(){}return r[a]=e,new r}function t(e){for(var n,t=1,r=arguments.length;t<r;t++)for(var i in n=arguments[t])Object[a][s].call(n,i)&&(e[i]=n[i]);return e}var u=function(e,n){return(u=Object.setPrototypeOf\|\|{__proto__:[]}instanceof Array&&function(e,n){e.__prot

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\oneplayeriframe[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	4569
Entropy (8bit):	5.028076310140503
Encrypted:	false
SSDEEP:	96:LC/x2zNBspkzAses94/KnfuxIOASrISQ0ixwUIjOzpR:LC/x2hBspkUses94/KfuxIOAS8IixwXa
MD5:	E7E0151C8481698D4C40846137616EBB
SHA1:	7A75827A9D7A58555CBC7C87E4F3BD241BFBDCB4
SHA-256:	C72AE6657922A1D9D4D0E6AE6232DF5B6666AD59186DFE438C8434881EC6674E
SHA-512:	EA92B39D49F1CBD2653486963C6DA9892C4742059ABB85AFC874AC88A152439CD8887F7773065F842F41C866F26916625323210C5FEFC1E629313C108B5AAA0A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/videoplayer/js/oneplayeriframe.js
Preview:	var MsOnePlayer;(function(n){function i(n,i,r){var u=new t(document.getElementById(n),i);u.onPlayerReady(r)}n.render=i;var t=function(){function n(t,i){var r=this,u;(this.playerDiv=t,this.playerData=i,this.playerReady=!1,this.onPlayerReadyCallbacks=[],this.playerEventListeners=[],this.onMessageReceived=function(t){if(t&&t.data&&t.origin===n.iframeOrigin)try{var i=JSON.parse(t.data);if(!i\|\|i.playerId!==r.playerId)return;i.data&&(r.playPosition=i.data);switch(i.eventName.toLowerCase()){case"playerready":r.playerReady=!0;setTimeout(function(){var n=r.iframeElement.contentDocument.getElementById("primaryArea");n&&n.removeAttribute("role")},1e3);r.doCallback(r.onPlayerReadyCallbacks,r);break;case"postjsllmessage":r.sendTelemetyData(i.data)}r.doCallback(r.playerEventListeners,{name:i.eventName})}catch(u){}},t&&i&&i.metadata&&i.metadata.videoId)&&(n.iframeOrigin[0]==="%"&&(n.iframeOrigin=n.iframeOriginDefault),n.siteName[0]==="%"&&(n.siteName=n.defaultSiteName),this.playerReady=!1,n.playerCou

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\override[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	1531
Entropy (8bit):	4.797455242405607
Encrypted:	false
SSDEEP:	24:Udf0F+MOu2UOqD3426TKgR2Yyk9696TkMYqdfskeEkeGk/ksuF9qaSm9qags:Ud8FYqTj36TKgR2Yyk9696TkMYO0keEW
MD5:	A570448F8E33150F5737B9A57B6D889A
SHA1:	860949A95B7598B394AA255FE06F530C3DA24E4E
SHA-256:	0BD288D5397A69EAD391875B422BF2CBDCC4F795D64AA2F780AFF45768D78248
SHA-512:	217F971A8012DE8FE170B4A20821A52FA198447FA582B82CF221F4D73E902C7E3AA1022CB0B209B6679C2EAE0F10469A149F510A6C2132C987F46214B1E2BBBC
Malicious:	false
Reputation:	low
IE Cache URL:	https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7
Preview:	a.c-call-to-action:hover, button.c-call-to-action:hover{box-shadow:none!important}a.c-call-to-action:hover span, button.c-call-to-action:hover span{left:0!important}...c-call-to-action:not(.glyph-play):after { right: 0!important;} a.c-call-to-action:focus,button.c-call-to-action:focus{box-shadow:none!important}a.c-call-to-action:focus span,button.c-call-to-action:focus span{left:0!important;box-shadow:none!important}...theme-dark .c-me .msame_Header_name {color: #f2f2f2;}...pmg-page-wrapper .uhf div, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf span, .pmg-page-wrapper .uhf p, .pmg-page-wrapper .uhf input {font-family: Segoe UI,SegoeUI,Helvetica Neue,Helvetica,Arial,sans-serif !important;}..@media (min-width: 540px) {.pmg-page-wrapper .uhf .c-uhfh-alert span, .pmg-page-wrapper .uhf #uhf-g-nav span, .pmg-page-wrapper .uhf .c-uhfh-actions span, .pmg-page-wrapper .uhf li, .pmg-page-wrapper .uhf button, .pmg-page-wrapper .uhf a, .pmg-page-wrapper .uhf #meC

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\script[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	121249
Entropy (8bit):	5.258860505507024
Encrypted:	false
SSDEEP:	1536:+JXd+YOlaYOyguxH6GdXJKjZtQ3EBJ0PYmwYmEZeQ8Wt2Db7ACu8J8IvC7CQBgAc:ed+YOlaYOyguxHbdX2nX5PaCfey
MD5:	B110D87662D257F657ABCCEF7AF5CD09
SHA1:	FD7519D842B6344448E6F1D69DFFA5F896FAE4A6
SHA-256:	65E82E7414D88BC864191400084C24DA27052E7A61F9F3C1F1EFDFEE433D558C
SHA-512:	EF429EE8701D0748DE81CEE25D15C9674487691ACA8982F6D43DA519E1CDFD5082D9DE5A71D1FB457250828433856BAB4A2CE7E035152FE9C16224FA433D35D1
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=0502864a-b6ef-2f14-9f8e-267004d3a4e0_c5ea3348-55af-729a-2641-14f0312bacf3_742bd11f-3d7c-9955-3df5-f02b66689699_cb9d43d2-fbae-5b5c-827f-72166d6b87fc_49488e0d-6ae2-5101-c995-f4d56443b1d8_7dea7b90-4334-c043-b252-9f132d19ee19_38aa9ffb-ddb5-75be-6536-a58628f435f5_e3e65a0a-c133-43e7-571d-2293e03f85e6_4ca0e9dc-a4de-17ba-f0de-d1d346cb99e2_06310cd8-41c6-3b11-4645-b4884789ed70_5c27e8aa-9347-969e-39ac-37a4de428a8d_d6872b5a-5310-a73c-7cb3-227a3213a1c5_be92d794-4118-193f-9871-58b72092a5ac_64c742e2-b29c-b6c1-fdd9-accf33ec40bd_cf2ceca9-3467-a5b3-d095-68958eee6d4c_cec39dd8-f1d3-56f1-abfc-a7db34ff7b46_ec5fa2c9-3950-ff57-a5c3-1fa77e0db190_d19f9592-65df-bcc9-e30e-439b875c3381_76a3d06f-f11f-77ef-9bfd-6227ba750200_5e1caa45-461c-3b04-f88b-8cd50af16db5_c2dceda8-20b4-7d3f-13b6-9cac67d7df17_914fa41b-cc86-d3b0-4e15-2fdfa357bcc7_40c6c884-da6e-7c2c-081f-4a7dfe7c7245_ae79ba96-1a9d-debd-a5b1-f3067213b9b8
Preview:	function getQueryValue(n,t){var r=new RegExp("[\\?&]"+t+"=([^&#]*)","gi"),i=r.exec(n);return i==null?"":decodeURIComponent(i[1].replace(/\+/g," "))}function getStore(n){var t="ClosestStore.asmx",r,i;$(".store-geo[data-GeoStoreLocalServiceURL]").length&&(t=$(".store-geo").first().attr("data-GeoStoreLocalServiceURL"));i="POST";typeof n!="undefined"&&(r={latitude:JSON.stringify(n.coords.latitude),longitude:JSON.stringify(n.coords.longitude)},t=t+"ClientGeo",i="GET");$.ajax({url:t,type:i,timeout:5e3,data:r,contentType:"application/json; charset=UTF-8",dataType:"json",error:function(){$(".store-geo").remove();$(".store-editorial").fadeIn(1e3)},success:function(n){if(typeof n!="undefined"&&typeof n.d!="undefined"&&typeof n.d.City!="undefined"&&n.d.City!=""&&n.d.StoreUrl!="undefined"&&n.d.StoreUrl!=""){var t=$(".store-geo:first").text();$(".store-geo a").html(t+" "+n.d.City);$(".store-geo a").attr("href",n.d.StoreUrl);$(".store-editorial").remove();$(".store-geo").fadeIn(1e3)}else $(".store-g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\script[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	50466
Entropy (8bit):	5.403327253117392
Encrypted:	false
SSDEEP:	768:3Vs4A3c/bSKCzUm4D19h3j9UIAyjYXQgyjYXEoygRRsRnMtoafRnvdMIKebqH:h6c/bSKCzUm4DDh3j+9XQ4XE+BZdMIK9
MD5:	633B23CA8A850C508C146635DB4239F5
SHA1:	CF78DA53BD7561F3ACB33710016ECBF60E9F0204
SHA-256:	DAA1677D2640BE8A77F6C69EEE3911D2F8CF81DAA7BB604800A2D63A8F130C95
SHA-512:	82D4887AB9BB6A449FB0E5B6DEF80215B5F9E51058DCB1B8B7CD583A880F93428C3FB75B37C0E9481843203A4878FEF32424B5CD2EBCDD811D92604A1C1BCAEB
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=1a053411-4f63-d069-d3b8-11d5d720eeb4
Preview:	function ShowSelectedComponentKeyPress(n,t){if(window.event.keyCode==13)return ShowSelectedComponent(n,t),!1}function ShowHighLight(n){var t=$("#div"+n).height();$.browser.msie&&parseInt($.browser.version,10)==7?$("#div"+n+" > .highlight").css({width:"0",height:"0","background-color":"white",float:"left","border-top":Math.round(t/2+.3)+"px solid white","border-right":"0.75em solid "+$("#div"+n).css("background-color"),"border-bottom":Math.round(t/2+.3)+"px solid white"}):$("#div"+n+" > .highlight").css({width:"0",height:"0","background-color":"white",float:"left","border-top":t/2+.3+"px solid white","border-right":"0.75em solid "+$("#div"+n).css("background-color"),"border-bottom":t/2+.3+"px solid white"})}function SetRightSideNavigationMenuHeight(){$("[id^=dvModuleGroup_]").hide();window.location.search.toLowerCase().indexOf("bookmarkid")!=-1&&SelectBookMark();window.location.search.toLowerCase().indexOf("componentid")!=-1&&LoadSelectedInternalLink();$(".div_side_comp").length>0&&$(".

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\script[3].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	1822358
Entropy (8bit):	5.79324363999698
Encrypted:	false
SSDEEP:	49152:dGzwWwtErl7HXLdJI2n7dc4SILggk9i7VnWRkzS6VmnS30i6B9auHRR8/e+9F5SZ:7vB+Ny
MD5:	39D7503C73C4B9E99C6E0572C5964007
SHA1:	7B95C9ECA6F03B75E59B9916E6012E1912F67EA1
SHA-256:	203CDE7D6A106751583536731FD3678412925FCAB46593D9AB3B8C541627CB00
SHA-512:	FEF256E3EB9DF544BE939E1868C2CF08648841A95642C3ACEB2B9BE1F236B524FFF052CE440B54E498DD679EE75DB47EE9B06B326A7635BA8FE80EB8727DA201
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSScripts/script.jsx?k=fdbb2b09-be08-eb51-3dd8-9b4d1f64243f_2ae8129d-fde8-2dba-04a3-244180de8ae9_47e83ccc-ecfc-6f98-b981-755b2bfad91f_286673de-a0d8-5a7d-a0cb-28aaf9428fbf_e151f4c7-d675-33c5-e63f-d0492e9ef34c_da6fc213-c3d8-dcb6-1429-16b93fa0ee4d_758972cb-d321-e5b7-3cef-28d8b1bcb5f7_b02da3f0-b00e-ca1f-59d4-f9dee84deb72_b87dcf1d-d924-ca9e-d82d-b5ddf52216b6_12cfa907-5165-8e09-aef4-3b571e0d9a6f_afc628e5-eae9-c661-5322-66ad905c5a1f_4b6a647a-20b1-6c9d-7ea9-55baee524342_0672bcaf-3214-8196-63f9-badec82b5521_c8e45edc-7732-8d91-49e3-ab3224fe8bae_f6523997-afd8-42bc-ae14-d8d1455c6de1_aa8b03c9-0fe4-f89f-0b29-3903983e74d0_8b6018a0-61bc-151c-2351-a7a50d347fe5_04ba3982-e58b-6415-57b8-bd40addb5c6f_6ef97ac9-cbfe-73e0-a706-6f05baf3f4bc_d85b532d-4104-bd94-affe-35a64db2dffb_342faa43-5d79-89a1-4f75-637e916585c0_1ad26ef8-7f3b-47aa-bbbe-8522a7a460ba_b9e71751-e6fb-7c2f-10dd-905e9e0531c4_de15b5ee-705b-f4d1-c22a-30e0bb76b881_ddb2b35f-0052-8ff2-85d1-a86c728272a1
Preview:	function changeSupToAnchor(){var t="",r="",n=[],i=[],u=0,f;$(".pmp-devices .supFn, .cfb .supFn").each(function(n){i[n]=$(this).text();$(this).parent().attr("href","#"+i[n]+"superscript");$(this).parent().attr("id",i[n])});f=$("#ss-footnote-text").text();$(".pmp-devices sup, .cfb sup").each(function(){t=$(this).text();t=t.replace("*(","");t=t.replace(")","");n=t.split(", ");for(let t=0;t<n.length;t++)for(let e=0;e<i.length;e++)if(n[t]==i[e]){r+="<a aria-label='"+f+" "+n[t]+"' href='#"+n[t]+"' name= '"+n[t]+"superscript' class='c-hyperlink supBLink'><span class='supText'>"+n[t]+"<\/span><\/a><span>, <\/span>";u=1;break}u==1&&($(this).html(r),r="",u=0)});$(".pmp-devices sup, .cfb sup").find("span:last").remove()}function tooltipOnFocus(){$(".surface-social-share a,.m-video-trigger button").focus(function(n){var t=this;t.t=JSON.parse(JSON.stringify(t.title));t.title="";var i=$(n.currentTarget).offset(),r=$(n.currentTarget).height(),u=$(n.currentTarget).width();$("body").append("<span id='c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\servicesagreement[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with very long lines, with CRLF line terminators
Category:	dropped
Size (bytes):	213572
Entropy (8bit):	5.167630636494556
Encrypted:	false
SSDEEP:	6144:CTQZaZEzF0a6OGYL0seowg6ehsymCJ2i/T9VTSfaTHgJi7eshMcgGW3la:CcZaZEzX6OGYQseowg6ehsymCJ2i/pVP
MD5:	03D5DF3673B6E04044B1F3EE42CD18B3
SHA1:	BB8FCA157BA981BDC5AC9DBDEDE0F81794EAD9EE
SHA-256:	4458916D4D8D75F08AFA4A73F3355D375CF3C1A787BE60EBECDF2365B92EDE15
SHA-512:	BAB1C4CB31636FE9F772FEB2028307F9BBA2A92B464E174A298FC5AB1CCD5A995B7CC25F98A057C1FC7EEF35FDC0BE946932E3813F7E25C7951C1F81880AEEF3
Malicious:	false
Reputation:	low
Preview:	.<!DOCTYPE html ><html xmlns:mscom="http://schemas.microsoft.com/CMSvNext" xmlns:md="http://schemas.microsoft.com/mscom-data" lang="en-us" xmlns="http://www.w3.org/1999/xhtml"><head><meta name="viewport" content="initial-scale=1.0, width=device-width" /><meta http-equiv="X-UA-Compatible" content="IE=edge" /><title>Microsoft Services Agreement</title><meta name="Title" content="Microsoft Services Agreement" /><meta name="CorrelationVector" content="o5biJswQ/kGev3LL.3" /><meta name="Description" content="" /><meta name="MscomContentLocale" content="en-us" /><link href="https://www.microsoft.com/onerfstatics/marketingsites-eus-prod/west-european/shell/_scrf/css/themes=default.device=uplevel_web_pc/16-3b4837/cf-7f2b14/7b-5ab060/b2-7c2f2c/af-85090f/b0-adecbe/42-6d7c67/52-7ec320?ver=2.0&amp;_cf=20210415" rel="stylesheet" type="text/css" media="screen" /><link href="https://statics-marketingsites-eus-ms-com.akamaized.net/statics/override.css?c=7" rel="stylesheet" type="text/css" media="

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\slider[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	177162
Entropy (8bit):	5.095650872558704
Encrypted:	false
SSDEEP:	3072:DAwmeEZACGBeDNmo9WwqTatIjxrfdx811vWSltmZYVCgGHLR/3xnxHZzyP5kTP3F:jEZACg
MD5:	82783CBE7D9E03F188F2BE826AE0202C
SHA1:	83B63EDC6AD58468015A825567EB2DE2DD88A85F
SHA-256:	AF23E254ACFE2B0C5196C6D902CF15802693EE0D2250309A3E0D9911537C9374
SHA-512:	40CCC05DF3D2292433CA3EA0E49AFBA21A44FCE7C69FAD5B14DEFA87776ADD2E497D1D0DB41046160C141B071FBEB3D7B0BEBBB9673CBF94BA0C20E42BC134ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/mwf/css/MWF_20210208_31270267/west-european/default/button/glyph/heading/image/list/pagebehaviors/selectmenu/slider?apiVersion=1.0&include_base=true
Preview:	@charset "UTF-8";./! 1.58.2 \| Copyright 2017 Microsoft Corporation \| This software is based on or incorporates material from the files listed below (collectively, "Third Party Code"). Microsoft is not the original author of the Third Party Code. The original copyright notice and the license under which Microsoft received Third Party Code are set forth below together with the full text of such license. Such notices and license are provided solely for your information. Microsoft, not the third party, licenses this Third Party Code to you under the terms in which you received the Microsoft software or the services, unless Microsoft clearly states that such Microsoft terms do NOT apply for a particular Third Party Code. Unless applicable law gives you more rights, Microsoft reserves all other rights not expressly granted under such agreement(s), whether by implication, estoppel or otherwise././! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css /.html{font-family:sa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\social[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	112978
Entropy (8bit):	5.163861138977889
Encrypted:	false
SSDEEP:	1536:GV8Utc49kADAKlyvpkmO5KqqVkii7nmFMfW6znlLXAirhnlOc8Azngzhe9WOU0RM:slyvpklZYWtzkAzg
MD5:	AE0935FF464917159FE28FB684DE6BC3
SHA1:	ADFF2BFEA6BC0129E2634639EB89BB1CDC43A05D
SHA-256:	172BEB2DDE1857755325F5BA1E6F7A4212CA1439C9CA73FBC5FF81C35A5579BE
SHA-512:	408DD35EF31CACB16035609E8F2D3FF8C241B22112738B0EA97E99E8367BDC33D2601FD196AD29905215D8B1DC123E7057968388DEDD140395E88638AC3FD124
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.microsoft.com/mwf/js/MWF_20210208_31270267/alert/autosuggest/contentplacement/contentplacementitem/flipper/flyout/glyph/heading/hero/heroitem/hyperlinkgroup/image/list/pagebehaviors/singleslidecarousel/skiptomain/social?apiVersion=1.0
Preview:	define("componentFactory",["require","exports","htmlExtensions","utility","stringExtensions","pageBehaviors"],function(n,t,i,r,u,f){"use strict";Object.defineProperty(t,"__esModule",{value:!0});var e=function(){function n(){}return n.create=function(t){for(var i,r=0,u=t;r<u.length;r++){if(i=u[r],!i.c&&!i.component)throw"factoryInput should has either component or c to tell the factory what component to create.Eg.ComponentFactory.create([{ c: Carousel] or ComponentFactory.create([component: Carousel]))";n.createComponent(i.component\|\|i.c,i)}},n.createComponent=function(t,r){if(t){var o=r&&r.eventToBind?r.eventToBind:"",f=r&&r.selector?r.selector:t.selector,s=r&&r.context?r.context:null,u=[],e=function(n,f,e){var a,c,l,o,h;for(a=r.elements?r.elements:f?i.selectElementsT(f,s):[document.body],c=0,l=a;c<l.length;c++)o=l[c],o?(o.mwfInstances\|\|(o.mwfInstances={}),o.mwfInstances[n]?u.push(o.mwfInstances[n]):(h=new t(o,e),(!h.isObserving\|\|h.isObserving())&&(o.mwfInstances[n]=h,u.push(h)))):cons

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\style[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	137436
Entropy (8bit):	5.360850019087837
Encrypted:	false
SSDEEP:	1536:+Fk5W00zHVaAgrBmeZCstBwB/BxBf9e969j9S9h919g9Z9C9f9g9Z9e979Q9t9Vp:+Fk5W003MC/
MD5:	D0519383C16A2B2D2879BFBF15845F0C
SHA1:	B2FBBC365B2CA853B1CBEAAA0F10BB05148ED9AA
SHA-256:	046BA9FDD7992751785036A03AB6EDD3052465C23C2BAD1ADC80905DC6AA39A9
SHA-512:	2DB8E6E4AD75F756D0B70071EC49EA4FF54360AFDAAC007C0FFD5ACF575961E661DD275329347210AD71206885A50DA2E58F12CE84E6C7A3BC3D5EDD81E3B5BE
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSStyles/style.csx?k=3c9ade18-bc6a-b6bd-84c3-fc69aaaa7520_899796fc-1ab6-ed87-096b-4f10b915033c_e8d8727e-02f3-1a80-54c3-f87750a8c4de_6e5b2ac7-688a-4a18-9695-a31e8139fa0f_b3dad3e4-0853-1041-fa46-2e9d6598a584_fc29d27f-7342-9cf3-c2b5-a04f30605f03_28863b11-6a1b-a28c-4aab-c36e3deb3375_907fa087-b443-3de8-613e-b445338dad1f_a66bb9d1-7095-dfc6-5a12-849441da475c_1b0ca1a3-6da9-0dbf-9932-198c9f68caeb_ef11258b-15d1-8dab-81d5-8d18bc3234bc_11339d5d-cf04-22ad-4987-06a506090313_50edf96d-7437-c38c-ad33-ebe81b170501_8031d0e3-4981-8dbc-2504-bbd5121027b7_3f0c3b77-e132-00a5-3afc-9a2f141e9eae_aebeacd9-6349-54aa-9608-cb67eadc2d17_0cdb912f-7479-061d-e4f3-bea46f10a753_343d1ae8-c6c4-87d3-af9d-4720b6ea8f34_a905814f-2c84-2cd4-839e-5634cc0cc383_190a3885-bf35-9fab-6806-86ce81df76f6_05c744db-5e3d-bcfb-75b0-441b9afb179b_8beffb66-d700-2891-2c8d-02e40c7ac557_b1fe3f15-7512-0a8f-a55b-b316245621b5_f9c8eff0-3e34-2c33-6c0d-1fa7c5077eec
Preview:	@font-face{font-family:'wf_segoe-ui_light';src:url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.eot');src:local("Segoe UI Light"),local("Segoe WP Light"),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.eot?#iefix') format('embedded-opentype'),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.woff') format('woff'),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.ttf') format('truetype'),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/light/latest.svg#web') format('svg');font-weight:normal;font-style:normal}@font-face{font-family:'wf_segoe-ui_normal';src:url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot');src:local("Segoe UI"),local("Segoe"),local("Segoe WP"),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.eot?#iefix') format('embedded-opentype'),url('//c.s-microsoft.com/static/fonts/segoe-ui/west-european/normal/latest.w

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\0W10PBUV\wdg-global.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	5805
Entropy (8bit):	5.278923653755367
Encrypted:	false
SSDEEP:	96:UKbTXTwvME3A3UmUZZH//iuLXFgH5XsrhUfGtA4DtPigKUZwr9reeKMQTesOnOsA:5bTXTwYwHn6C1UfGtzB6gvPziI3
MD5:	EF4613E3C20BFE5E3F07B49BD0B66C1E
SHA1:	EDE2835F716750EDC0245E2AF061732427F5A8ED
SHA-256:	3DC7C03D651B5E29363C365C3B83B83A508865A194639070A20ABD863FBBC054
SHA-512:	D8D6F060B4FCB2C781C8574BE01368BB8F25C314098BEF844859452DF88B77C9E7D088F190F111135F44C80F82F47F9AF4822240FEDEDD4F040F991CAE20EDC6
Malicious:	false
Reputation:	low
IE Cache URL:	https://query.prod.cms.rt.microsoft.com/cms/api/am/binary/RWfyex
Preview:	(function(n,t,i){"use strict";./!. Some of the plugins here are extracted from WET. Details below.. * Web Experience Toolkit (WET) / Bo.te . outils de l'exp.rience Web (BOEW). * wet-boew.github.io/wet-boew/License-en.html / wet-boew.github.io/wet-boew/Licence-fr.html. * v4.0.25-development - 2017-05-04 . /.var r=t.wdg\|\|{};r.doc=n(i);r.win=n(t);r.html=n("html");r.siteMuseCtaSelector=".mscom-link.c-call-to-action";r.modules=r.modules\|\|{};r.jqEscape=function(n){return n.replace(/([;&,\.\+\\~':"\\\!\^\/#$%@\[\]=>\\|])/g,"\\$1")};r.modules.refactorSitemuseCtas=function(){n(r.siteMuseCtaSelector).contents().wrap("<span/>")};r.modules.setPrefooterDrawerInMobile=function(){n("#prefooterDrawer").click(function(){var t=n("#prefooterNav");n(this).attr("aria-expanded",!t.is(":visible"));n("#prefooterNav").slideToggle()})};r.modules.noCookieYTVideosWithConsent=function(){t.mscc&&(mscc.hasConsent()\|\|n('iframe[src="youtube.com"], [data-source="youtube.com"], [data-youtube*="youtube.com"]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\.jsonp[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	284445
Entropy (8bit):	5.820038793619243
Encrypted:	false
SSDEEP:	6144:d09yDBxStzwfzRM9M2Oviz/ZdbRHI2dYp2:ZlfzR6MSRoSYY
MD5:	B60BFB20163A12919F30540457709F86
SHA1:	D0CCCA80FF2486412A1F3015C5C0458C44971605
SHA-256:	8EE18CC979DEAA7F026DFA264DDA88683D4C23E3786DF6BEF2A969F5898747CE
SHA-512:	69817B1A8F7D67B9EEFAFF5C42058053F99AC44ECBA8449C2A121E0108EA9623D481200D598DF9704B20B527E7CB294EB884661E9B145A62A140CFF56084177E
Malicious:	false
Reputation:	low
IE Cache URL:	https://lptag.liveperson.net/lptag/api/account/60270350/configuration/applications/taglets/.jsonp?v=2.0&df=0&s=store-sales-de-ch&b=0
Preview:	lpTag.callback({"serviceMap":[{"service":"routingMsg","account":"60270350","baseURI":"va1.agent4matching.liveperson.net"},{"service":"agent","account":"60270350","baseURI":"va-e.c.liveperson.net"},{"service":"smt","account":"60270350","baseURI":"va.v.liveperson.net"},{"service":"coreAIFeedbackOnlyDomain","account":"60270350","baseURI":"va.aifeedback.int.liveperson.net"},{"service":"coreAIAutomation","account":"60270350","baseURI":"va.automationlookup.int.liveperson.net"},{"service":"msgEwtAPI","account":"60270350","baseURI":"va.lp-msgewt.liveperson.net"},{"service":"lineConnector","account":"60270350","baseURI":"va.line-gw.liveperson.net"},{"service":"transporter","account":"60270350","baseURI":"va.transporter.liveperson.net"},{"service":"lpEng","account":"60270350","baseURI":"z1.lpEng.liveperson.net"},{"service":"leBilling","account":"60270350","baseURI":"va.le-billing.liveperson.net"},{"service":"leRBMstr","account":"60270350","baseURI":"z1.bi.liveperson.net"},{"service":"openPlatfor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17842_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 214 x 60, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	4180
Entropy (8bit):	7.897544732032488
Encrypted:	false
SSDEEP:	96:7IBzJT5H8+EZDd6qxquKPrZyYP1uKGP7Q8k0MZk2:7IBzd5clZDdPxDKjglPs8J52
MD5:	1B100A233D593E01553898E6778610C9
SHA1:	CDD11E91DBE4CB3BB8126A92DF8C4BF2BC132100
SHA-256:	0145910A5359A633E8AA55F42615663911B4E6187BFDE7514B750DD9ADE49624
SHA-512:	665449B91B988C50C45FF5B202427C004102E1C11B0804C94880972A68EC45F586DF231CE7793DB15F1EE76C97ACBE1F41C963B19D9622E2C6FC0353E7C1CB0C
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17842_en_1.png
Preview:	.PNG........IHDR.......<......<D.....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'....IDATx..{lS...g%`...IG..5N2..1.(H0...@.U+1&..D7...u. M.6..Zi.Qi...R....hQ+.,#MJCE. 2^ZLX vh......t...u}.....8...}..k...=...B)..h4....z......F3.hai4.@E....ht..]j4S...+..A8\|....!...T....b.v...@6;...nd.w.F3....8FGM.....zz...yh...._..B.@.@............k4S..........r..B0t3..B.CI..Dn...C.PPJA.._.......K...`H..1...j....V6{.#.....j.1.,"..#...uT.si....V4z[JX.4..(...._.A....v.b9.j4.=e.KX+@V.....i.(e.p..E..th.P..R..F%.N~.....!...O.........j.y q-.Tj......51.D)....*..d......:.c/...q....P...\|.n4.?.H)x..\|......].......C].lwg...'..X..R6._.1..E...]E.},v.==......4..........t..`b.V..+H....RCnf{f<.I..........f.1..... .>S D.X.7Pq. .2.......L....D$r...\|.o......B ....n.....\..'...a....1..#[('6...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17843_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 154 x 67, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	6646
Entropy (8bit):	7.94363951231039
Encrypted:	false
SSDEEP:	96:mrJC31ZPp/pemKRt1pzUag+VoB+lgtL1GZUR8DbJmNoqz1AO6r9f8u2P:md4LxgJPpjVy+KthgbwTpAO6h0uM
MD5:	7BC75345DE8AF3169337518930F770FC
SHA1:	4D05126A3ECD4DCED3AFA680D15F903CEA09B3A7
SHA-256:	9CAD4CBDD0C91057E3AB312C06CCF3C3C9BF63AAFDEBF69CB4DE2DBB5D6A32B9
SHA-512:	EAB77B407B41199C0354A5BFC310BB2AC80B0EBCCD1077F36687F175A47B0E01C0D2801C883035A9BBD9A08A244999E64A8622DFFF41DB6FD87BADB23363C2BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17843_en_1.png
Preview:	.PNG........IHDR.......C.....d.......pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'....IDATx..{\.e....00 ...S@A.T.3.@...h)......z.].....M.-5.).......c..&..d..zr<l.r0 .m..p.............0.y.^.r....{>...^..{]x5777.3..x.=h2.Tb...........]!I%..j)...n..N..s.h.f..^.%X....../>A.'+9.._o.]j..w....B.m=G..a.iN]..^w.3.wRW..`..Qw......n7.....W...oW...s....p.Q..S.....#.z..P..i'.........t..r..............g.}..BaS........J]..2.......@0........\._......-.....Nh............W..{u...Z..><<...hbcc...A_y_jMF.TWp...8~.2g~(......x......z#...b@o_..y.0i0...u...z..].R.d.1\|~.8~....."...p.J%..O ..XjMF..\|O..2....b.U*..6.J......f...'%2.%#.I>.&f......57..S...Ct....j...g.Q<..D..._p..]fG....h.Zh3z...1.z.......IZ..G...4He..>.L..q...6.Y,.9s.......R.j.qr..[..;t.....~.c......H.d.........'.[

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17850_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 288 x 51, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	8205
Entropy (8bit):	7.954312663217692
Encrypted:	false
SSDEEP:	192:60cUNBFnSLZEV3HQDvR6MIVy/QwPb0kBsCLlK:VccZYZEV3wDUMIVypb9BVY
MD5:	C58E55CE74BC0F78FF2E49335C03197C
SHA1:	1AC5BCD40186F6D646F7DD1576A247A63B55FFC1
SHA-256:	1389BAF6F3F75FABA0EE8E0F7A2011C9A2D34FBD544083D8072804ED0B15296D
SHA-512:	CD3D14511BA377B3BE28FFF00FA76F4FAD7707AFF451333529080B76C5CE731B9D9A92FF51F00907D5DB98A09A19D4BDDE1AA4BE49A67263C47C08C4EB117B0F
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17850_en_1.png
Preview:	.PNG........IHDR... ...3.....7.......pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'....IDATx..{t[..I.,...rb.l'Jl,.4.E.j.pI...e....i...e.3.v2g..:S.uJ.8..I....e0....i..)..q .!v..&...&....ckoK.l...~.....?k.....}..:x.`...w4....z.....g 0..I...cy.......z..3t........p.N.....h9...O.J...M.P...c....V....\N...F..1RP.DQ......W..X..[O..0.'ja.J.Z..7.&..Ml.DQ..D}b.a.....L...-..i..i.....=....p...+....t.^.YQx..0N#..(.U.j!....7..!,....\.-....4.E.?...Z...)((L...3G.p...@.i.).N..(9.Q@.}..!..p @v.....x...A_..*y.U(Lt,..El.y....78N\|..+..4.?..............7....@.i..........\}:..P.bS.F.F......U.q.:......3G.......j....[.V;..(((..9.....x.....t.^;..H..FJ..B!q.K.zB..9.Z......}h\|...0.....V......ph..N......5.....z)(.c.I....A...CS.'.E5..G.T.0....@.bS..V,...Ph.bS..Z`p4.k..P$4...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17852_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 200 x 35, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5996
Entropy (8bit):	7.9159304631414455
Encrypted:	false
SSDEEP:	96:aGHt4Tf7q25MfUkvZ2GjqXVX3EtENKKz1lGaZWAP5o9OEBStq90iY2Wt8O51pZ:aaGTR5MfUkvZ2sqXVHdpplGIrPCOEBSh
MD5:	8A5B6EA2FF21D904838E51D7D4608888
SHA1:	60B21C061845880E79FC2EAB76CEBEFA7571F4FD
SHA-256:	3620CCCDE950C83C3D85FEBF07F0B621CD5EA5A06A4CB38686F47A1A4E511374
SHA-512:	37C6C5455D0CFA9EE45913526074D32E9718E0C6804A168DF4BA1A823C0378971AED7B9077BB44845E56A5F75347F7B46B484D728F44709E436091997F2FB4F7
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17852_en_1.png
Preview:	.PNG........IHDR.......#.......E.....pHYs.........g..R....tIME.....6(f4?.....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'...7IDATx..].H......]._...#La..DH.y4.....7..).!.,...\P...hA.}...X.....P!.....>"....P!......8....8.?.cM&.h.....C..;....{.=.......i:..A....9.q.K........k.@.r...-L...f\.._......%b"......ibv.....5.%.;q..J.k%R.DL .'b"-.w......._..%.X..&.J..yU.Z...(..a-.D.......:...K\.c.>...M.t.0..4.......r...i.d.;..v"!...\..p\.......&...;{@......<..`p.......k.<...8....y.r.e...>u_.q.O.....:Nx3...a....#WW.CU.&K0kjar..7.0.......70D..T.!....L...w.X........_$l.....m.y.=~T..b.00.3.........,...,.S....\|C#..w....Y..BN...@./....!h:...O:`...KA.......4.o..NL.1.(u0=......5....p.;A?L..5.i.3...8.`..3..~..L.@....c.....F.0.{...'..~.-....0..V.?;WH...i``.B....^...H....e.{zzhdd....C,..?.......4..........\.......]...\|.1I-,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17858_en_1[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	"\003", baseline, precision 8, 71x67, frames 3
Category:	downloaded
Size (bytes):	2112
Entropy (8bit):	7.5956670415277205
Encrypted:	false
SSDEEP:	48:1aOkVmuIuESAmGmV/RAaHZyiOAQSK5WG8S/4GfI4:mmuzEjmV/rZKcUlI4
MD5:	BC14B5903940C3135048BE3AE2377B16
SHA1:	D63527631ACCF3125F7C7BB492493AD7D1113302
SHA-256:	C9A1F73842BCB61C1A623AA78E3B319EA7C74AED0EB52DF3977F176DAF11792B
SHA-512:	876A6511C2563CCC7434FF071EF2131294E3422A83C0B68526D6A0F77D25434DF158BFEA12652B254C47BDE56FECD1698DF2EED8E520B4E9B8860502047E2A9A
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17858_en_1.jpg
Preview:	......JFIF.....`.`......LEAD Technologies Inc. V1.01................................ ."!....#(3+#&0&..,=-0569:9"+?C>8C3897...........7$.$77777777777777777777777777777777777777777777777777...C............Z.......................LEAD Technologies Inc. V1.01...............................................................................}........!1A..Qa."q.2....#B...R..$3br........%&'()456789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz.........................................................................................w.......!1..AQ.aq."2...B.....#3R..br...$4.%.....&'()56789:CDEFGHIJSTUVWXYZcdefghijstuvwxyz..............................................................................C.G......................?....(..<u....&}.M.K.H.O1g.>a..M.s...._.,....K........-e..B.......M....._.,....K.....K....x.[......\|..p.D....I....Q.....(...^.w'.sam4..."V8..@........e........ah........t.........<s.\|...:...mya.W.u;....{..J....x:.....L...?=....Lr~...(.......(....<c.?.v..>...-.......D...?.....(.w.'....}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17862_en_1[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 283 x 55
Category:	downloaded
Size (bytes):	4671
Entropy (8bit):	7.704752470967286
Encrypted:	false
SSDEEP:	96:x/EqR/KAfTe30aYhM/XncsybhX4l5TCSVmswptBDNauA2YGPFDK:xshKy0aYa/3kijTCZBDmGPpK
MD5:	670857FC682181E88808B9A13F8B2F3B
SHA1:	5ECA1A28B84938D0390ACCD2898F7003EA8FB377
SHA-256:	9F56E28E95824B1287AC361482A0891DEC67CD8C640DED737EB2EB0E450DEA13
SHA-512:	80D41DFE2AB7F01B80FAADDB65637A05F5B6CFC38CC02163C98DEDE22FAF479C5D2407B55EF1141BE92A9F38863BF9E0823047E63C3BCDE337ABECD9397E2A6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17862_en_1.gif
Preview:	GIF89a..7.w..!.......,......7................................`.%h..o.$y.$....'$..!.1-.86.--.$ ."&.SW.50.A;."(.HL.57.VW.$/..&.QL."$.89.GA.WW.ca./3.pp.&.7C....;G.B>.7:.Y[. .RL./3...FQ.IG.X\...lk..!.;F.LR...ZR."4.'/.?P._^.6<.kU...DJ......RY.Zi....>>.bf.qu.sg.z.78.os.+/.GZ.~......"8.<N.SI....l].HH.nh..VX........u..qk........}l..]................... ..a....................<..........I........W..c.....t..e....g...................................................................................................................................................................................................................................................................................................................................................................a..H......\....#J.H....3j.... C..I...(S.\...0c.I...E6s..... ..z..J.d.%Y.]...%up.lJ.Q4....RG...`....BH.6.qS'.....py+...#.Xab*,-4.q...A@K...B..Y.....c.5..PcfE.!.f..M...I^p@Y...c..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17863_en_1[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 426 x 64
Category:	downloaded
Size (bytes):	8742
Entropy (8bit):	7.693694060203599
Encrypted:	false
SSDEEP:	192:0XLH/4/5qWPR1hVnGflAWhhCFEt1vMbZSzfkNa/gUKGvl:0D4h1hMdAWnCYMq3zll
MD5:	A9A480EF42B0C0F056A26F50E906F3A9
SHA1:	4AB5B4A9640DF03776642AF607B055D6A51E90AD
SHA-256:	EBDC3D936546B9D16C4D9DAE6329D3F6556F26E6CBB471480BE309BEB552C32C
SHA-512:	AD259B93D5F6600776F57EF403065869ED68A8E6068BAD0E1CF56D60A7A270AAE48B721273BA1D8E510F740EE8786C58BBBD395D500A750FF2CEBEA18814CD0B
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17863_en_1.gif
Preview:	GIF89a..@.w..!.......,......@.....................................'.&5 6L#A^'Gg)29+Np+Nq/Qs0CU0Je5Vw8@F<Z{?TgD_~HZjJQTJe.Rk.W^_XdkYp.\w.ahjamrcg`dt.d}.ippk..luxp}.q}.tvgt..u{{w..z..}..}..................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................H......*\....#J.H....3j.... C..I...(S......0c.I...i......@g.....!Hj.IT$..P.J=.....F`....M%....J...&94P.....%d.X#s..DA....oC...<.0A..$^......$b.\.G.d..9T...g....6.X1c./..lya..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\17868_en_1[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 314 x 51, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7136
Entropy (8bit):	7.947681510493374
Encrypted:	false
SSDEEP:	192:0CsDLhw/7PMaEd/BeJGDQVhNcbPHyml1XD0+9:YLqRgciQDNczSml1w+9
MD5:	FE1DF6AD290B254AF5A56BFAB1DDFD17
SHA1:	870BFDFFB26561BC40FC3BFF2C4A83689904BA07
SHA-256:	FBA6077AB6B7BC5914314C40694E7AE881FEC9ABEBD22BE3C29724C797F275F0
SHA-512:	DF81088062F96D3BB71A9EBCCA6940FC141FF65B38DB3E629C8FE49FC0D56D589F7502A8207B61A0D43C256FA82A353F85A0B994B0909AEC37F00A2428E23878
Malicious:	false
Reputation:	low
IE Cache URL:	https://bingexplore.azurewebsites.net/bing-data-suppliers/images/17868_en_1.png
Preview:	.PNG........IHDR...:...3......:. ....pHYs.........g..R....tIME.....6'.."T....tEXtAuthor....H....tEXtDescription...!#....tEXtCopyright....:....tEXtCreation time.5.......tEXtSoftware.]p.:....tEXtDisclaimer.........tEXtWarning........tEXtSource.........tEXtComment........tEXtTitle....'....IDATx..{P[..W.....`C...R.....@C.R..:NK...7.\.mi.....}L.c.....c.[g'xP.u..-....:[...<.....C..a...' .......^.x8q.g&..{......9....~D..H.&L].3q......#......l..aG...AX.....hk..5..RlFZJ......U&-5....$._.......=/.<.9i)IQ.e....."n.c.#M$..G..OU.>+.<H.mx.../.~........>>..i..74.J.g>......TEEen..-...JX....<..=...(/)....-......Rd.:.....[KS.Q..K\..U..i.....b..6.u(/)Dm....B.....x+o.....s`..X.[[.....l..oP............DC#..z$k3.....F..A......)m.....(...A.......19}.N...zk.g.\...../...*j..m.......::..v..i.I...[.\.../61.:.HOM..v.yvOEEEE.....EG...."q96o.x.[....EF....I.......}...fw.....>Z.B....c..1...CL...."...]ai5>../....g...=D....yQ.x...`}...o#Q..e..U[d.....E....Dm........[X..... ....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1920_Panel03_Banner_StayonTrack[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 319x175, frames 3
Category:	downloaded
Size (bytes):	22127
Entropy (8bit):	7.97303135615474
Encrypted:	false
SSDEEP:	384:fe3fEE89k9fcFMAPYvbHl1QoAU9fqvwiszc67KQAXnZ4X7lBe39ja:ofEE899I3QrU9OwiGqnZwBBepa
MD5:	8DE360BD280335CA4EB199888252B72F
SHA1:	D76A8ADBE21D2E3C6B190CFA03A6671687C664AB
SHA-256:	6657B4E1C66B69E166F70BFBE9BF59F9A6E7D2764C8B3259AD7D363AA0943C75
SHA-512:	4AECEC0CD0D4D00BF00A4278314D828DAD3315B2B7C6BE76D2311E8D4DFA74352EC2FD4D11763F914990A67403167C1BCB16D8296AD7E4A7FCBC585E10881C3B
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel03_Banner_StayonTrack.jpg?version=b9ff2aa4-ba31-cad7-3920-ed5467501d7b
Preview:	......JFIF........................................................................................................................................................?...................................................I....M...Y8.f.'.:P......U...3.........,..rf..)...Y8....0e.WA...uJ{.Y....S%....#._BP6..nc~\|..%...nN.gE.?.k=../u.....S...^.......ei.m.x'.........q...:...:...H.rn.t/.v_k...t...8...G:.E..!.V.r.4A!\.4/...[fb..@l...k.c<.1.......L.}Q.....i..../...[k-](c..h.!.0C1.......f.M5.t.C..qYR;f.{c....gt.....t]...c4...8.ik^.......xq.P.#.3:Q..>....yg@.....@sP..;..[COT....1..}.B..e..gDp...,..4..~.%(..%.ms....<1.}.j..T...O..E.e.F.l.e.@'.a5.%.......oz>...#...g..\.o}......c......M.z#..E....w[;.@.."l.n..v..Pd.......?.[.Pj.9..#.z....J..+..%.........\|....M....{.H...E...2&lriF...I.Be>...#...5.-9;.J<!y.:Ud...7.....x..\...H..@.Cq....X..........ak&.&t..1.k..}.....m.zc.R.3F#...:.zt)..Y.[..F..9.[./cA.>m.o.>..MC.../nY.C......0...f@..{...Z.t...jG..b....H..Z.:..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\MEEXW4H4\1920_Panel05_PriorityFeature_GetThingsDone[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, JFIF standard 1.01, aspect ratio, density 1x1, segment length 16, progressive, precision 8, 1040x585, frames 3
Category:	downloaded
Size (bytes):	80543
Entropy (8bit):	7.934604031810399
Encrypted:	false
SSDEEP:	1536:0cQxZtUTe5zi2LtMuAJ5csKi0Oav3jMBsmBjTVHsW3KMBqR9Aeh:05xbUq5zig2J5csKH4SmBaW3KMMgeh
MD5:	7949AB2316B143F0F821FDB64378732E
SHA1:	1824FF40D53DD71B0F2EE9A6627B3B967B42AF6B
SHA-256:	A7AEB19A813C1CFAAF82D0F24C41FC624BE289C7C01475D6C3D8DFF566E4C4AF
SHA-512:	99A1A91EA4F3C37C8ADDC8B0F22FDBC5B83F031764D3588C23EB28BB6D723716C22BCC58AEED474AA9FE3BAD9006B9C404AFDB1A2610B09583A9F19E99B8F521
Malicious:	false
Reputation:	low
IE Cache URL:	https://c.s-microsoft.com/en-us/CMSImages/1920_Panel05_PriorityFeature_GetThingsDone.jpg?version=26655609-1c29-c3f3-4795-badd817e0fb8
Preview:	......JFIF......................................................................................................................................................I......................................................Zc..')9I..NNC.r.4...L..L..$.R..b....0Q.`....1.TTTTRH....C.$ND.".nRl.$.@..&......$...Tc....F1...a.....E(....f...&.)9...&..&.I.........IE%....1Q.T.a...EF.1.Q#. CM=......&.'"L.&9.....`....W..K..I%......1Q..#..1.c...F1I$.......&..)...H.&.6......w.wW7.E.T.R....E$........c..0QPPQ.TR.QI.... .Cm....I..)..`....].]]F.8.!.p.)Z..)EF1Q..c..1.c..1PQ..R.J"C@..&2@.....99.' C.L......B0.c....(cb..Q....1.c..1.c..1.Tb..F"D@`..lcm.2NRs......i.&k}fj1PQ..c..0.gh.J)F1QPP..c..B1..Tc..Q.G.h...Lcm.rr..H.i.`......1Q.T#..0.d$..Tb...(.B*.Q."...1QQIE!.i.wI..C%'')99.m.H`&.....J.Q.T"...1.N.$..b..c..F1..c..1Q.b.....@.......!..r.)..r&6.&......%N...c..F1.i..QQJ1..c..F1.c..B1Q.b....J.+...n..:Cl..nSrrl.$.H......]..a..1.c.....m$..Tc...EB1.c..1.b.......O'...m$i....nRr.7).A .........T...F....".n.

Static File Info

No static file info

Network Behavior

Network Port Distribution

Total Packets: 177
• 443 (HTTPS)
• 53 (DNS)

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2021 21:58:38.365139008 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.366488934 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.406517029 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.406657934 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.407454967 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.407684088 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.407797098 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.408365011 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.448668003 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449563026 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449609041 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449650049 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449670076 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.449678898 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449707985 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449712038 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.449723005 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.449731112 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.449738026 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.449759960 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.450634003 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.450675964 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.450714111 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.450723886 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.450756073 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.450761080 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.450771093 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.450782061 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.450905085 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.463489056 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.464133978 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.464333057 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.503786087 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.504200935 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.505070925 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.505109072 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.505156994 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.505302906 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.505389929 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.505399942 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.505836010 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.507806063 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.507849932 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.507888079 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.507889032 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.507905960 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.507929087 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.507967949 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.507994890 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508003950 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508007050 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508008003 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508055925 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508059025 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508095980 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508109093 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508133888 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508138895 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508172989 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508178949 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508218050 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508219957 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508263111 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508264065 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508301020 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508311033 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508338928 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508342981 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508377075 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508378983 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508414030 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508419991 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508451939 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508456945 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508488894 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508496046 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508533955 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508555889 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508582115 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508609056 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508622885 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508624077 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508662939 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508667946 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508701086 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508707047 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508744001 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508748055 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508791924 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508795977 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508830070 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508836031 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508868933 CEST	443	49711	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.508872032 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.508915901 CEST	49711	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.545638084 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.545675993 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.545701981 CEST	443	49710	152.199.23.37	192.168.2.3
May 17, 2021 21:58:38.545794010 CEST	49710	443	192.168.2.3	152.199.23.37
May 17, 2021 21:58:38.545855045 CEST	49710	443	192.168.2.3	152.199.23.37

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
May 17, 2021 21:58:26.726854086 CEST	49873	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:26.787735939 CEST	53	49873	8.8.8.8	192.168.2.3
May 17, 2021 21:58:27.848634005 CEST	53196	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:27.897981882 CEST	53	53196	8.8.8.8	192.168.2.3
May 17, 2021 21:58:28.673814058 CEST	56777	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:28.724617004 CEST	53	56777	8.8.8.8	192.168.2.3
May 17, 2021 21:58:29.473164082 CEST	58643	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:29.524719954 CEST	53	58643	8.8.8.8	192.168.2.3
May 17, 2021 21:58:30.608608961 CEST	60985	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:30.658081055 CEST	53	60985	8.8.8.8	192.168.2.3
May 17, 2021 21:58:31.953881025 CEST	50200	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:32.004240036 CEST	53	50200	8.8.8.8	192.168.2.3
May 17, 2021 21:58:32.855246067 CEST	51281	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:32.904634953 CEST	53	51281	8.8.8.8	192.168.2.3
May 17, 2021 21:58:33.698427916 CEST	49199	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:33.751737118 CEST	53	49199	8.8.8.8	192.168.2.3
May 17, 2021 21:58:34.065778971 CEST	50620	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:34.130645037 CEST	53	50620	8.8.8.8	192.168.2.3
May 17, 2021 21:58:34.912420034 CEST	64938	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:34.961848021 CEST	53	64938	8.8.8.8	192.168.2.3
May 17, 2021 21:58:35.284869909 CEST	60152	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:35.388839006 CEST	53	60152	8.8.8.8	192.168.2.3
May 17, 2021 21:58:35.746741056 CEST	57544	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:35.799887896 CEST	53	57544	8.8.8.8	192.168.2.3
May 17, 2021 21:58:36.793464899 CEST	55984	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:36.851726055 CEST	53	55984	8.8.8.8	192.168.2.3
May 17, 2021 21:58:36.913674116 CEST	64185	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:36.965301037 CEST	53	64185	8.8.8.8	192.168.2.3
May 17, 2021 21:58:37.527039051 CEST	65110	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:37.604625940 CEST	53	65110	8.8.8.8	192.168.2.3
May 17, 2021 21:58:38.074434042 CEST	58361	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:38.132263899 CEST	53	58361	8.8.8.8	192.168.2.3
May 17, 2021 21:58:38.297780037 CEST	63492	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:38.363020897 CEST	53	63492	8.8.8.8	192.168.2.3
May 17, 2021 21:58:39.243021011 CEST	60831	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:39.292649031 CEST	53	60831	8.8.8.8	192.168.2.3
May 17, 2021 21:58:40.411345959 CEST	60100	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:40.460711002 CEST	53	60100	8.8.8.8	192.168.2.3
May 17, 2021 21:58:41.983298063 CEST	53195	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:42.067840099 CEST	53	53195	8.8.8.8	192.168.2.3
May 17, 2021 21:58:42.267159939 CEST	50141	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:42.317811012 CEST	53	50141	8.8.8.8	192.168.2.3
May 17, 2021 21:58:44.369205952 CEST	53023	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:44.427360058 CEST	53	53023	8.8.8.8	192.168.2.3
May 17, 2021 21:58:51.674302101 CEST	49563	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:51.675354958 CEST	51352	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:51.733488083 CEST	53	49563	8.8.8.8	192.168.2.3
May 17, 2021 21:58:51.734913111 CEST	53	51352	8.8.8.8	192.168.2.3
May 17, 2021 21:58:51.815512896 CEST	59349	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:51.873389006 CEST	53	59349	8.8.8.8	192.168.2.3
May 17, 2021 21:58:52.185940981 CEST	57084	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:52.235275984 CEST	53	57084	8.8.8.8	192.168.2.3
May 17, 2021 21:58:52.388921022 CEST	58823	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:52.438216925 CEST	53	58823	8.8.8.8	192.168.2.3
May 17, 2021 21:58:54.756340027 CEST	57568	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:54.757730007 CEST	50540	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:54.815692902 CEST	53	57568	8.8.8.8	192.168.2.3
May 17, 2021 21:58:54.841346979 CEST	53	50540	8.8.8.8	192.168.2.3
May 17, 2021 21:58:55.049062967 CEST	54366	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:55.111737013 CEST	53	54366	8.8.8.8	192.168.2.3
May 17, 2021 21:58:55.710128069 CEST	53034	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:55.761503935 CEST	53	53034	8.8.8.8	192.168.2.3
May 17, 2021 21:58:56.451200008 CEST	57762	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:56.511217117 CEST	53	57762	8.8.8.8	192.168.2.3
May 17, 2021 21:58:57.092875004 CEST	55435	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:57.159373045 CEST	53	55435	8.8.8.8	192.168.2.3
May 17, 2021 21:58:57.290550947 CEST	50713	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:57.348341942 CEST	53	50713	8.8.8.8	192.168.2.3
May 17, 2021 21:58:57.756345987 CEST	56132	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:57.805865049 CEST	53	56132	8.8.8.8	192.168.2.3
May 17, 2021 21:58:58.987631083 CEST	58987	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:59.039942980 CEST	53	58987	8.8.8.8	192.168.2.3
May 17, 2021 21:58:59.823039055 CEST	56579	53	192.168.2.3	8.8.8.8
May 17, 2021 21:58:59.904544115 CEST	53	56579	8.8.8.8	192.168.2.3
May 17, 2021 21:59:00.113535881 CEST	60633	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:00.188522100 CEST	53	60633	8.8.8.8	192.168.2.3
May 17, 2021 21:59:00.707778931 CEST	61292	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:00.757379055 CEST	53	61292	8.8.8.8	192.168.2.3
May 17, 2021 21:59:02.468065023 CEST	63619	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:02.520152092 CEST	53	63619	8.8.8.8	192.168.2.3
May 17, 2021 21:59:03.967237949 CEST	64938	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:04.017453909 CEST	53	64938	8.8.8.8	192.168.2.3
May 17, 2021 21:59:04.086400986 CEST	61946	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:04.144201040 CEST	53	61946	8.8.8.8	192.168.2.3
May 17, 2021 21:59:04.601577997 CEST	64910	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:04.665016890 CEST	53	64910	8.8.8.8	192.168.2.3
May 17, 2021 21:59:04.961385012 CEST	52123	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:05.020519018 CEST	53	52123	8.8.8.8	192.168.2.3
May 17, 2021 21:59:05.096910954 CEST	61946	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:05.147785902 CEST	53	61946	8.8.8.8	192.168.2.3
May 17, 2021 21:59:05.971165895 CEST	52123	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:06.031369925 CEST	53	52123	8.8.8.8	192.168.2.3
May 17, 2021 21:59:06.100125074 CEST	61946	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:06.149431944 CEST	53	61946	8.8.8.8	192.168.2.3
May 17, 2021 21:59:06.291419029 CEST	56130	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:06.342885017 CEST	53	56130	8.8.8.8	192.168.2.3
May 17, 2021 21:59:07.092005014 CEST	52123	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:07.142632961 CEST	53	52123	8.8.8.8	192.168.2.3
May 17, 2021 21:59:08.329597950 CEST	61946	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:08.378945112 CEST	53	61946	8.8.8.8	192.168.2.3
May 17, 2021 21:59:09.095612049 CEST	52123	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:09.146245003 CEST	53	52123	8.8.8.8	192.168.2.3
May 17, 2021 21:59:09.418915033 CEST	56338	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:09.471299887 CEST	53	56338	8.8.8.8	192.168.2.3
May 17, 2021 21:59:11.295979023 CEST	59420	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:11.341767073 CEST	58784	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:11.348495007 CEST	53	59420	8.8.8.8	192.168.2.3
May 17, 2021 21:59:11.401473999 CEST	53	58784	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.330427885 CEST	61946	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.379834890 CEST	53	61946	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.437076092 CEST	63978	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.462042093 CEST	62938	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.499744892 CEST	53	63978	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.510617018 CEST	55708	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.525082111 CEST	56803	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.531388998 CEST	57145	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:12.545480967 CEST	53	62938	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.559814930 CEST	53	55708	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.590699911 CEST	53	57145	8.8.8.8	192.168.2.3
May 17, 2021 21:59:12.600414038 CEST	53	56803	8.8.8.8	192.168.2.3
May 17, 2021 21:59:13.097084999 CEST	52123	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:13.148071051 CEST	53	52123	8.8.8.8	192.168.2.3
May 17, 2021 21:59:13.915978909 CEST	55359	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:13.969846964 CEST	53	55359	8.8.8.8	192.168.2.3
May 17, 2021 21:59:15.269042969 CEST	58306	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:15.318717003 CEST	53	58306	8.8.8.8	192.168.2.3
May 17, 2021 21:59:22.649068117 CEST	64124	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:22.708547115 CEST	53	64124	8.8.8.8	192.168.2.3
May 17, 2021 21:59:22.813539028 CEST	49361	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:22.871336937 CEST	53	49361	8.8.8.8	192.168.2.3
May 17, 2021 21:59:23.234603882 CEST	63150	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:23.293776035 CEST	53	63150	8.8.8.8	192.168.2.3
May 17, 2021 21:59:23.464426994 CEST	53279	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:23.523847103 CEST	53	53279	8.8.8.8	192.168.2.3
May 17, 2021 21:59:24.284782887 CEST	56881	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:24.349694014 CEST	53	56881	8.8.8.8	192.168.2.3
May 17, 2021 21:59:25.053132057 CEST	53642	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:25.112571955 CEST	53	53642	8.8.8.8	192.168.2.3
May 17, 2021 21:59:28.508095026 CEST	55667	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:28.583545923 CEST	53	55667	8.8.8.8	192.168.2.3
May 17, 2021 21:59:29.051601887 CEST	54833	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:29.113519907 CEST	53	54833	8.8.8.8	192.168.2.3
May 17, 2021 21:59:29.337445021 CEST	62476	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:29.401089907 CEST	53	62476	8.8.8.8	192.168.2.3
May 17, 2021 21:59:29.424348116 CEST	49705	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:29.488990068 CEST	53	49705	8.8.8.8	192.168.2.3
May 17, 2021 21:59:29.504501104 CEST	61477	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:29.593328953 CEST	53	61477	8.8.8.8	192.168.2.3
May 17, 2021 21:59:30.186227083 CEST	61633	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:30.264017105 CEST	53	61633	8.8.8.8	192.168.2.3
May 17, 2021 21:59:30.509326935 CEST	55949	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:30.516741037 CEST	57601	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:30.579230070 CEST	53	57601	8.8.8.8	192.168.2.3
May 17, 2021 21:59:30.588408947 CEST	53	55949	8.8.8.8	192.168.2.3
May 17, 2021 21:59:30.666353941 CEST	49342	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:30.735801935 CEST	53	49342	8.8.8.8	192.168.2.3
May 17, 2021 21:59:30.941663027 CEST	56253	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:31.013575077 CEST	53	56253	8.8.8.8	192.168.2.3
May 17, 2021 21:59:40.840625048 CEST	49667	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:40.900388956 CEST	53	49667	8.8.8.8	192.168.2.3
May 17, 2021 21:59:40.911062002 CEST	55439	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:40.960314989 CEST	53	55439	8.8.8.8	192.168.2.3
May 17, 2021 21:59:41.309977055 CEST	57069	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:41.371242046 CEST	53	57069	8.8.8.8	192.168.2.3
May 17, 2021 21:59:41.589365959 CEST	57659	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:41.656961918 CEST	53	57659	8.8.8.8	192.168.2.3
May 17, 2021 21:59:41.957674026 CEST	55439	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:42.006977081 CEST	53	55439	8.8.8.8	192.168.2.3
May 17, 2021 21:59:43.604592085 CEST	55439	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:43.633244991 CEST	54717	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:43.654047966 CEST	53	55439	8.8.8.8	192.168.2.3
May 17, 2021 21:59:43.710876942 CEST	63975	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:43.759356976 CEST	53	54717	8.8.8.8	192.168.2.3
May 17, 2021 21:59:43.780539036 CEST	53	63975	8.8.8.8	192.168.2.3
May 17, 2021 21:59:45.612190008 CEST	55439	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:45.661375999 CEST	53	55439	8.8.8.8	192.168.2.3
May 17, 2021 21:59:47.291528940 CEST	56639	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:47.354373932 CEST	53	56639	8.8.8.8	192.168.2.3
May 17, 2021 21:59:48.071160078 CEST	51856	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:48.077943087 CEST	56546	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:48.130266905 CEST	53	51856	8.8.8.8	192.168.2.3
May 17, 2021 21:59:48.151308060 CEST	53	56546	8.8.8.8	192.168.2.3
May 17, 2021 21:59:48.643043041 CEST	62152	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:48.708782911 CEST	53	62152	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.078095913 CEST	53470	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.146840096 CEST	53	53470	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.269547939 CEST	56446	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.318717003 CEST	53	56446	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.549452066 CEST	59631	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.598681927 CEST	53	59631	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.642920971 CEST	55515	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.643389940 CEST	55439	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.692785978 CEST	53	55439	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.704643965 CEST	53	55515	8.8.8.8	192.168.2.3
May 17, 2021 21:59:49.902092934 CEST	64547	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:49.951606989 CEST	53	64547	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.007086992 CEST	51759	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.067580938 CEST	53	51759	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.106669903 CEST	59207	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.170222044 CEST	54269	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.175755978 CEST	53	59207	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.227855921 CEST	53	54269	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.365029097 CEST	54856	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.391920090 CEST	64140	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.394211054 CEST	62271	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.428488970 CEST	53	54856	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.443536997 CEST	53	62271	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.458765030 CEST	53	64140	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.479532957 CEST	57404	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.492260933 CEST	62997	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.550106049 CEST	53	57404	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.550211906 CEST	53	62997	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.579770088 CEST	57712	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.641581059 CEST	53	57712	8.8.8.8	192.168.2.3
May 17, 2021 21:59:50.687741041 CEST	60065	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:50.753379107 CEST	53	60065	8.8.8.8	192.168.2.3
May 17, 2021 21:59:51.060817957 CEST	55068	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:51.110115051 CEST	53	55068	8.8.8.8	192.168.2.3
May 17, 2021 21:59:51.156996965 CEST	64700	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:51.219238997 CEST	53	64700	8.8.8.8	192.168.2.3
May 17, 2021 21:59:51.236751080 CEST	61998	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:51.288866043 CEST	53	61998	8.8.8.8	192.168.2.3
May 17, 2021 21:59:51.614974022 CEST	53724	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:51.676801920 CEST	53	53724	8.8.8.8	192.168.2.3
May 17, 2021 21:59:51.865797043 CEST	52328	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:51.914994955 CEST	53	52328	8.8.8.8	192.168.2.3
May 17, 2021 21:59:52.149508953 CEST	58051	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:52.213738918 CEST	53	58051	8.8.8.8	192.168.2.3
May 17, 2021 21:59:52.871176958 CEST	64130	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:52.942323923 CEST	53	64130	8.8.8.8	192.168.2.3
May 17, 2021 21:59:53.228005886 CEST	50491	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:53.280653000 CEST	53	50491	8.8.8.8	192.168.2.3
May 17, 2021 21:59:53.391308069 CEST	53004	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:53.454824924 CEST	53	53004	8.8.8.8	192.168.2.3
May 17, 2021 21:59:53.536515951 CEST	52529	53	192.168.2.3	8.8.8.8
May 17, 2021 21:59:53.604981899 CEST	53	52529	8.8.8.8	192.168.2.3
May 17, 2021 22:00:02.430187941 CEST	53656	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:02.480710030 CEST	53	53656	8.8.8.8	192.168.2.3
May 17, 2021 22:00:05.128415108 CEST	62724	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:05.132808924 CEST	56059	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:05.135149002 CEST	63060	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:05.141405106 CEST	51498	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:05.150671005 CEST	59943	53	192.168.2.3	8.8.8.8
May 17, 2021 22:00:05.188317060 CEST	53	62724	8.8.8.8	192.168.2.3
May 17, 2021 22:00:05.201081038 CEST	53	51498	8.8.8.8	192.168.2.3
May 17, 2021 22:00:05.201343060 CEST	53	56059	8.8.8.8	192.168.2.3
May 17, 2021 22:00:05.208285093 CEST	53	59943	8.8.8.8	192.168.2.3
May 17, 2021 22:00:05.210508108 CEST	53	63060	8.8.8.8	192.168.2.3

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
May 17, 2021 21:58:35.284869909 CEST	192.168.2.3	8.8.8.8	0xbb78	Standard query (0)	rafihautogroup-my.sharepoint.com	A (IP address)	IN (0x0001)
May 17, 2021 21:58:36.793464899 CEST	192.168.2.3	8.8.8.8	0xc952	Standard query (0)	login.windows.net	A (IP address)	IN (0x0001)
May 17, 2021 21:58:37.527039051 CEST	192.168.2.3	8.8.8.8	0xee41	Standard query (0)	login.microsoftonline.com	A (IP address)	IN (0x0001)
May 17, 2021 21:58:38.297780037 CEST	192.168.2.3	8.8.8.8	0x70c7	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)
May 17, 2021 21:58:51.815512896 CEST	192.168.2.3	8.8.8.8	0x7d2d	Standard query (0)	aadcdn.msftauth.net	A (IP address)	IN (0x0001)
May 17, 2021 21:58:55.049062967 CEST	192.168.2.3	8.8.8.8	0x7910	Standard query (0)	clientconfig.passport.net	A (IP address)	IN (0x0001)
May 17, 2021 21:58:57.756345987 CEST	192.168.2.3	8.8.8.8	0x81a6	Standard query (0)	account.live.com	A (IP address)	IN (0x0001)
May 17, 2021 21:58:59.823039055 CEST	192.168.2.3	8.8.8.8	0x4238	Standard query (0)	acctcdn.msauth.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:12.510617018 CEST	192.168.2.3	8.8.8.8	0xe669	Standard query (0)	ajax.aspnetcdn.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:24.284782887 CEST	192.168.2.3	8.8.8.8	0x490d	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)
May 17, 2021 21:59:28.508095026 CEST	192.168.2.3	8.8.8.8	0xe495	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.051601887 CEST	192.168.2.3	8.8.8.8	0x7b8	Standard query (0)	publisher.liveperson.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.504501104 CEST	192.168.2.3	8.8.8.8	0xfccd	Standard query (0)	lptag.liveperson.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.509326935 CEST	192.168.2.3	8.8.8.8	0xb405	Standard query (0)	accdn.lpsnmedia.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.516741037 CEST	192.168.2.3	8.8.8.8	0x627	Standard query (0)	static-assets.fs.liveperson.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.666353941 CEST	192.168.2.3	8.8.8.8	0x91af	Standard query (0)	logincdn.msauth.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.941663027 CEST	192.168.2.3	8.8.8.8	0xc8f3	Standard query (0)	lpcdn.lpsnmedia.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:43.633244991 CEST	192.168.2.3	8.8.8.8	0xb542	Standard query (0)	bingexplore.azurewebsites.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:43.710876942 CEST	192.168.2.3	8.8.8.8	0xfeb0	Standard query (0)	consentreceiverfd-prod.azurefd.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.291528940 CEST	192.168.2.3	8.8.8.8	0x25b7	Standard query (0)	dpm.demdex.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.071160078 CEST	192.168.2.3	8.8.8.8	0x7fa5	Standard query (0)	mscom.demdex.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.077943087 CEST	192.168.2.3	8.8.8.8	0x2912	Standard query (0)	cm.everesttech.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.549452066 CEST	192.168.2.3	8.8.8.8	0xf348	Standard query (0)	sync.mathtag.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.902092934 CEST	192.168.2.3	8.8.8.8	0x21d2	Standard query (0)	ib.adnxs.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.007086992 CEST	192.168.2.3	8.8.8.8	0xaa7e	Standard query (0)	idsync.rlcdn.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.106669903 CEST	192.168.2.3	8.8.8.8	0xeb23	Standard query (0)	cm.g.doubleclick.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.170222044 CEST	192.168.2.3	8.8.8.8	0x1d3d	Standard query (0)	rtd.tubemogul.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.365029097 CEST	192.168.2.3	8.8.8.8	0x1561	Standard query (0)	amp.azure.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.391920090 CEST	192.168.2.3	8.8.8.8	0x63cf	Standard query (0)	idpix.media6degrees.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.394211054 CEST	192.168.2.3	8.8.8.8	0xd9b3	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.479532957 CEST	192.168.2.3	8.8.8.8	0x12f4	Standard query (0)	p.rfihub.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.492260933 CEST	192.168.2.3	8.8.8.8	0x741b	Standard query (0)	rtd-tm.everesttech.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.579770088 CEST	192.168.2.3	8.8.8.8	0x639	Standard query (0)	match.adsrvr.org	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.687741041 CEST	192.168.2.3	8.8.8.8	0x963a	Standard query (0)	pixel.quantserve.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.060817957 CEST	192.168.2.3	8.8.8.8	0xeefe	Standard query (0)	servedby.flashtalking.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.156996965 CEST	192.168.2.3	8.8.8.8	0xcc9d	Standard query (0)	a.tribalfusion.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.236751080 CEST	192.168.2.3	8.8.8.8	0x7d2f	Standard query (0)	cms.analytics.yahoo.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.614974022 CEST	192.168.2.3	8.8.8.8	0x9602	Standard query (0)	s.tribalfusion.com	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.865797043 CEST	192.168.2.3	8.8.8.8	0x9578	Standard query (0)	mboxedge37.tt.omtrdc.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:52.871176958 CEST	192.168.2.3	8.8.8.8	0x160b	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
May 17, 2021 21:59:53.536515951 CEST	192.168.2.3	8.8.8.8	0xa1c3	Standard query (0)	www.google.de	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.128415108 CEST	192.168.2.3	8.8.8.8	0xdda1	Standard query (0)	assets.onestore.ms	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.132808924 CEST	192.168.2.3	8.8.8.8	0x7d1f	Standard query (0)	mem.gfx.ms	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.150671005 CEST	192.168.2.3	8.8.8.8	0xda47	Standard query (0)	microsoftwindows.112.2o7.net	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
May 17, 2021 21:58:35.388839006 CEST	8.8.8.8	192.168.2.3	0xbb78	No error (0)	rafihautogroup-my.sharepoint.com	rafihautogroup.sharepoint.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:35.388839006 CEST	8.8.8.8	192.168.2.3	0xbb78	No error (0)	rafihautogroup.sharepoint.com	1430-ipv4e.clump.prod.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:35.388839006 CEST	8.8.8.8	192.168.2.3	0xbb78	No error (0)	1430-ipv4e.clump.prod.aa-rt.sharepoint.com	20221-ipv4e.farm.prod.aa-rt.sharepoint.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:35.388839006 CEST	8.8.8.8	192.168.2.3	0xbb78	No error (0)	20221-ipv4e.farm.prod.aa-rt.sharepoint.com	20221-ipv4e.farm.prod.sharepointonline.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:36.851726055 CEST	8.8.8.8	192.168.2.3	0xc952	No error (0)	login.windows.net	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:36.851726055 CEST	8.8.8.8	192.168.2.3	0xc952	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:36.851726055 CEST	8.8.8.8	192.168.2.3	0xc952	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:37.604625940 CEST	8.8.8.8	192.168.2.3	0xee41	No error (0)	login.microsoftonline.com	a.privatelink.msidentity.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:37.604625940 CEST	8.8.8.8	192.168.2.3	0xee41	No error (0)	a.privatelink.msidentity.com	prda.aadg.msidentity.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:37.604625940 CEST	8.8.8.8	192.168.2.3	0xee41	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:38.363020897 CEST	8.8.8.8	192.168.2.3	0x70c7	No error (0)	aadcdn.msftauth.net	aadcdnoriginneu.azureedge.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:38.363020897 CEST	8.8.8.8	192.168.2.3	0x70c7	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
May 17, 2021 21:58:42.067840099 CEST	8.8.8.8	192.168.2.3	0x643b	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:51.873389006 CEST	8.8.8.8	192.168.2.3	0x7d2d	No error (0)	aadcdn.msftauth.net	aadcdnoriginneu.azureedge.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:51.873389006 CEST	8.8.8.8	192.168.2.3	0x7d2d	No error (0)	cs1100.wpc.omegacdn.net		152.199.23.37	A (IP address)	IN (0x0001)
May 17, 2021 21:58:52.235275984 CEST	8.8.8.8	192.168.2.3	0x51a8	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:54.841346979 CEST	8.8.8.8	192.168.2.3	0xd0ff	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:55.111737013 CEST	8.8.8.8	192.168.2.3	0x7910	No error (0)	clientconfig.passport.net	authgfx.msa.akadns6.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:57.805865049 CEST	8.8.8.8	192.168.2.3	0x81a6	No error (0)	account.live.com	account.msa.msidentity.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:57.805865049 CEST	8.8.8.8	192.168.2.3	0x81a6	No error (0)	account.msa.msidentity.com	account.msa.akadns6.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:59.904544115 CEST	8.8.8.8	192.168.2.3	0x4238	No error (0)	acctcdn.msauth.net	acctcdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:59.904544115 CEST	8.8.8.8	192.168.2.3	0x4238	No error (0)	scdn1efff.wpc.9da5e.alphacdn.net	sni1gl.wpc.alphacdn.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:58:59.904544115 CEST	8.8.8.8	192.168.2.3	0x4238	No error (0)	sni1gl.wpc.alphacdn.net		152.199.21.175	A (IP address)	IN (0x0001)
May 17, 2021 21:59:12.559814930 CEST	8.8.8.8	192.168.2.3	0xe669	No error (0)	ajax.aspnetcdn.com	mscomajax.vo.msecnd.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:12.600414038 CEST	8.8.8.8	192.168.2.3	0x8a33	No error (0)	consentdeliveryfd.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:24.349694014 CEST	8.8.8.8	192.168.2.3	0x490d	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:28.583545923 CEST	8.8.8.8	192.168.2.3	0xe495	No error (0)	mem.gfx.ms	cdn.account.microsoft.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:29.113519907 CEST	8.8.8.8	192.168.2.3	0x7b8	No error (0)	publisher.liveperson.net	publisher.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:29.113519907 CEST	8.8.8.8	192.168.2.3	0x7b8	No error (0)	liveperson.map.fastly.net		151.101.1.192	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.113519907 CEST	8.8.8.8	192.168.2.3	0x7b8	No error (0)	liveperson.map.fastly.net		151.101.65.192	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.113519907 CEST	8.8.8.8	192.168.2.3	0x7b8	No error (0)	liveperson.map.fastly.net		151.101.129.192	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.113519907 CEST	8.8.8.8	192.168.2.3	0x7b8	No error (0)	liveperson.map.fastly.net		151.101.193.192	A (IP address)	IN (0x0001)
May 17, 2021 21:59:29.593328953 CEST	8.8.8.8	192.168.2.3	0xfccd	No error (0)	lptag.liveperson.net	lptag.liveperson.cotcdb.net.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:30.264017105 CEST	8.8.8.8	192.168.2.3	0x7703	No error (0)	prda.aadg.msidentity.com	www.tm.a.prd.aadg.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:30.579230070 CEST	8.8.8.8	192.168.2.3	0x627	No error (0)	static-assets.fs.liveperson.com	dh1y47vf5ttia.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:30.579230070 CEST	8.8.8.8	192.168.2.3	0x627	No error (0)	dh1y47vf5ttia.cloudfront.net		143.204.209.78	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.579230070 CEST	8.8.8.8	192.168.2.3	0x627	No error (0)	dh1y47vf5ttia.cloudfront.net		143.204.209.102	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.579230070 CEST	8.8.8.8	192.168.2.3	0x627	No error (0)	dh1y47vf5ttia.cloudfront.net		143.204.209.129	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.579230070 CEST	8.8.8.8	192.168.2.3	0x627	No error (0)	dh1y47vf5ttia.cloudfront.net		143.204.209.8	A (IP address)	IN (0x0001)
May 17, 2021 21:59:30.588408947 CEST	8.8.8.8	192.168.2.3	0xb405	No error (0)	accdn.lpsnmedia.net	geo.accdn.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:30.735801935 CEST	8.8.8.8	192.168.2.3	0x91af	No error (0)	logincdn.msauth.net	lgincdn.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:30.735801935 CEST	8.8.8.8	192.168.2.3	0x91af	No error (0)	cs1227.wpc.alphacdn.net		192.229.221.185	A (IP address)	IN (0x0001)
May 17, 2021 21:59:31.013575077 CEST	8.8.8.8	192.168.2.3	0xc8f3	No error (0)	lpcdn.lpsnmedia.net	geo.lpcdn.livepersonk.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:43.759356976 CEST	8.8.8.8	192.168.2.3	0xb542	No error (0)	bingexplore.azurewebsites.net	waws-prod-ch1-019.sip.azurewebsites.windows.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:43.759356976 CEST	8.8.8.8	192.168.2.3	0xb542	No error (0)	waws-prod-ch1-019.sip.azurewebsites.windows.net	waws-prod-ch1-019.cloudapp.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:43.780539036 CEST	8.8.8.8	192.168.2.3	0xfeb0	No error (0)	consentreceiverfd-prod.azurefd.net	firstparty-azurefd-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dpm.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	edge-irl1.demdex.net	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.31.176.223	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.17.54.18	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		18.203.106.177	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		54.194.220.26	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		54.170.210.188	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.30.135.179	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		63.33.31.50	A (IP address)	IN (0x0001)
May 17, 2021 21:59:47.354373932 CEST	8.8.8.8	192.168.2.3	0x25b7	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		54.154.123.210	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	mscom.demdex.net	gslb-2.demdex.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	gslb-2.demdex.net	edge-irl1.demdex.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	edge-irl1.demdex.net	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		54.171.219.200	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		18.200.157.96	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.17.54.18	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		63.33.31.50	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		54.195.203.160	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		18.200.233.208	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		34.250.160.147	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.130266905 CEST	8.8.8.8	192.168.2.3	0x7fa5	No error (0)	dcs-edge-irl1-876252164.eu-west-1.elb.amazonaws.com		52.51.173.153	A (IP address)	IN (0x0001)
May 17, 2021 21:59:48.151308060 CEST	8.8.8.8	192.168.2.3	0x2912	No error (0)	cm.everesttech.net	cm.everesttech.net.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:48.708782911 CEST	8.8.8.8	192.168.2.3	0xbad	No error (0)	c.msn.com	c-msn-com-nsatc.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		18.203.205.32	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		34.252.156.174	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		52.212.164.82	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		54.75.9.158	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		52.51.251.137	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		52.213.168.74	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		52.212.193.208	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.146840096 CEST	8.8.8.8	192.168.2.3	0x3fbd	No error (0)	microsoftmscompoc.tt.omtrdc.net		34.251.77.56	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.598681927 CEST	8.8.8.8	192.168.2.3	0xf348	No error (0)	sync.mathtag.com	pixel-origin.mathtag.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:49.598681927 CEST	8.8.8.8	192.168.2.3	0xf348	No error (0)	pixel-origin.mathtag.com		185.29.132.144	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.598681927 CEST	8.8.8.8	192.168.2.3	0xf348	No error (0)	pixel-origin.mathtag.com		185.29.135.226	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.598681927 CEST	8.8.8.8	192.168.2.3	0xf348	No error (0)	pixel-origin.mathtag.com		185.29.133.199	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.598681927 CEST	8.8.8.8	192.168.2.3	0xf348	No error (0)	pixel-origin.mathtag.com		185.29.133.52	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.adnxs.com	g.geogslb.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	g.geogslb.com	ib.anycast.adnxs.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.220.242	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.220.244	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.220.241	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.221.13	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.221.88	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.221.91	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.221.50	A (IP address)	IN (0x0001)
May 17, 2021 21:59:49.951606989 CEST	8.8.8.8	192.168.2.3	0x21d2	No error (0)	ib.anycast.adnxs.com		185.33.221.15	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.067580938 CEST	8.8.8.8	192.168.2.3	0xaa7e	No error (0)	idsync.rlcdn.com		35.244.174.68	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.175755978 CEST	8.8.8.8	192.168.2.3	0xeb23	No error (0)	cm.g.doubleclick.net		172.217.20.2	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.227855921 CEST	8.8.8.8	192.168.2.3	0x1d3d	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.428488970 CEST	8.8.8.8	192.168.2.3	0x1561	No error (0)	amp.azure.net	160c1.wpc.azureedge.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.443536997 CEST	8.8.8.8	192.168.2.3	0xd9b3	No error (0)	s.twitter.com		104.244.42.3	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.458765030 CEST	8.8.8.8	192.168.2.3	0x63cf	No error (0)	idpix.media6degrees.com	idpix.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.458765030 CEST	8.8.8.8	192.168.2.3	0x63cf	No error (0)	map.media6degrees.com	map.media6degrees.com.cdn.cloudflare.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.550106049 CEST	8.8.8.8	192.168.2.3	0x12f4	No error (0)	p.rfihub.com	a.rfihub.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.550106049 CEST	8.8.8.8	192.168.2.3	0x12f4	No error (0)	a.rfihub.com	a.rfihub.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.550211906 CEST	8.8.8.8	192.168.2.3	0x741b	No error (0)	rtd-tm.everesttech.net	rtd.tubemogul.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.550211906 CEST	8.8.8.8	192.168.2.3	0x741b	No error (0)	rtd.tubemogul.com	h2.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.641581059 CEST	8.8.8.8	192.168.2.3	0x639	No error (0)	match.adsrvr.org	match-aga.adsrvr.org		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.641581059 CEST	8.8.8.8	192.168.2.3	0x639	No error (0)	match-aga.adsrvr.org	a97adde81b00f2ca4.awsglobalaccelerator.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.641581059 CEST	8.8.8.8	192.168.2.3	0x639	No error (0)	a97adde81b00f2ca4.awsglobalaccelerator.com		76.223.111.131	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.641581059 CEST	8.8.8.8	192.168.2.3	0x639	No error (0)	a97adde81b00f2ca4.awsglobalaccelerator.com		13.248.242.197	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	pixel.quantserve.com	global.px.quantserve.com		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	global.px.quantserve.com		91.228.74.189	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	global.px.quantserve.com		91.228.74.198	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	global.px.quantserve.com		91.228.74.133	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	global.px.quantserve.com		91.228.74.226	A (IP address)	IN (0x0001)
May 17, 2021 21:59:50.753379107 CEST	8.8.8.8	192.168.2.3	0x963a	No error (0)	global.px.quantserve.com		91.228.74.134	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.110115051 CEST	8.8.8.8	192.168.2.3	0xeefe	No error (0)	servedby.flashtalking.com	cds.f7f2q8c3.hwcdn.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:51.219238997 CEST	8.8.8.8	192.168.2.3	0xcc9d	No error (0)	a.tribalfusion.com		104.18.12.5	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.219238997 CEST	8.8.8.8	192.168.2.3	0xcc9d	No error (0)	a.tribalfusion.com		104.18.13.5	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.288866043 CEST	8.8.8.8	192.168.2.3	0x7d2f	No error (0)	cms.analytics.yahoo.com	spcms-global.pbp.gysm.yahoodns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 21:59:51.288866043 CEST	8.8.8.8	192.168.2.3	0x7d2f	No error (0)	spcms-global.pbp.gysm.yahoodns.net		212.82.100.182	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.676801920 CEST	8.8.8.8	192.168.2.3	0x9602	No error (0)	s.tribalfusion.com		104.18.13.5	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.676801920 CEST	8.8.8.8	192.168.2.3	0x9602	No error (0)	s.tribalfusion.com		104.18.12.5	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		52.213.168.74	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		54.75.9.158	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		52.212.164.82	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		34.251.77.56	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		52.212.193.208	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		52.18.150.20	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		34.252.156.174	A (IP address)	IN (0x0001)
May 17, 2021 21:59:51.914994955 CEST	8.8.8.8	192.168.2.3	0x9578	No error (0)	mboxedge37.tt.omtrdc.net		34.252.166.160	A (IP address)	IN (0x0001)
May 17, 2021 21:59:52.942323923 CEST	8.8.8.8	192.168.2.3	0x160b	No error (0)	googleads.g.doubleclick.net		172.217.19.98	A (IP address)	IN (0x0001)
May 17, 2021 21:59:53.604981899 CEST	8.8.8.8	192.168.2.3	0xa1c3	No error (0)	www.google.de		172.217.16.99	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.188317060 CEST	8.8.8.8	192.168.2.3	0xdda1	No error (0)	assets.onestore.ms	assets.onestore.ms.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 22:00:05.201343060 CEST	8.8.8.8	192.168.2.3	0x7d1f	No error (0)	mem.gfx.ms	cdn.account.microsoft.com.akadns.net		CNAME (Canonical name)	IN (0x0001)
May 17, 2021 22:00:05.208285093 CEST	8.8.8.8	192.168.2.3	0xda47	No error (0)	microsoftwindows.112.2o7.net		15.237.76.117	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.208285093 CEST	8.8.8.8	192.168.2.3	0xda47	No error (0)	microsoftwindows.112.2o7.net		15.237.136.106	A (IP address)	IN (0x0001)
May 17, 2021 22:00:05.208285093 CEST	8.8.8.8	192.168.2.3	0xda47	No error (0)	microsoftwindows.112.2o7.net		35.181.18.61	A (IP address)	IN (0x0001)

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
May 17, 2021 21:58:38.449650049 CEST	152.199.23.37	443	192.168.2.3	49710	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:58:38.450723886 CEST	152.199.23.37	443	192.168.2.3	49711	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:58:51.962922096 CEST	152.199.23.37	443	192.168.2.3	49720	CN=aadcdn.msftauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Jul 09 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013 Fri Nov 10 01:00:00 CET 2006	Fri Jul 09 14:00:00 CEST 2021 Wed Mar 08 13:00:00 CET 2023 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:00.151580095 CEST	152.199.21.175	443	192.168.2.3	49738	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.151580095 CEST	152.199.21.175	443	192.168.2.3	49738	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152538061 CEST	152.199.21.175	443	192.168.2.3	49740	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152538061 CEST	152.199.21.175	443	192.168.2.3	49740	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152642965 CEST	152.199.21.175	443	192.168.2.3	49741	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152642965 CEST	152.199.21.175	443	192.168.2.3	49741	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152726889 CEST	152.199.21.175	443	192.168.2.3	49739	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152726889 CEST	152.199.21.175	443	192.168.2.3	49739	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152843952 CEST	152.199.21.175	443	192.168.2.3	49742	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.152843952 CEST	152.199.21.175	443	192.168.2.3	49742	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.153022051 CEST	152.199.21.175	443	192.168.2.3	49737	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=WA, C=US CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Apr 13 20:52:18 CEST 2021 Wed Jul 29 14:30:00 CEST 2020	Fri Apr 08 20:52:18 CEST 2022 Fri Jun 28 01:59:59 CEST 2024	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:00.153022051 CEST	152.199.21.175	443	192.168.2.3	49737	CN=Microsoft Azure TLS Issuing CA 06, O=Microsoft Corporation, C=US	CN=DigiCert Global Root G2, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jul 29 14:30:00 CEST 2020	Fri Jun 28 01:59:59 CEST 2024		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:29.223372936 CEST	151.101.1.192	443	192.168.2.3	49784	CN=liveperson.net CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed May 12 00:55:43 CEST 2021 Tue Jul 28 02:00:00 CEST 2020	Mon Jun 13 00:55:42 CEST 2022 Sun Mar 18 01:00:00 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:29.223372936 CEST	151.101.1.192	443	192.168.2.3	49784	CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Tue Jul 28 02:00:00 CEST 2020	Sun Mar 18 01:00:00 CET 2029		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:29.229106903 CEST	151.101.1.192	443	192.168.2.3	49783	CN=liveperson.net CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed May 12 00:55:43 CEST 2021 Tue Jul 28 02:00:00 CEST 2020	Mon Jun 13 00:55:42 CEST 2022 Sun Mar 18 01:00:00 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:29.229106903 CEST	151.101.1.192	443	192.168.2.3	49783	CN=GlobalSign Atlas R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Tue Jul 28 02:00:00 CEST 2020	Sun Mar 18 01:00:00 CET 2029		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:30.678527117 CEST	143.204.209.78	443	192.168.2.3	49794	CN=fs.liveperson.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sun Aug 23 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Thu Sep 23 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
May 17, 2021 21:59:30.680799961 CEST	143.204.209.78	443	192.168.2.3	49795	CN=fs.liveperson.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sun Aug 23 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Thu Sep 23 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
May 17, 2021 21:59:30.836292028 CEST	192.229.221.185	443	192.168.2.3	49798	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu May 13 02:00:00 CEST 2021 Wed Sep 23 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Sat May 14 01:59:59 CEST 2022 Mon Sep 23 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:30.836325884 CEST	192.229.221.185	443	192.168.2.3	49799	CN=identitycdn.msauth.net, O=Microsoft Corporation, L=Redmond, ST=Washington, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu May 13 02:00:00 CEST 2021 Wed Sep 23 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Sat May 14 01:59:59 CEST 2022 Mon Sep 23 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:47.503808022 CEST	52.31.176.223	443	192.168.2.3	49816	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:47.504899979 CEST	52.31.176.223	443	192.168.2.3	49815	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:48.660096884 CEST	54.171.219.200	443	192.168.2.3	49817	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:48.787719011 CEST	54.171.219.200	443	192.168.2.3	49819	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:48.831829071 CEST	54.171.219.200	443	192.168.2.3	49821	CN=*.demdex.net, OU=Digital Marketing, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Dec 02 01:00:00 CET 2020 Thu Sep 24 02:00:00 CEST 2020 Fri Nov 10 01:00:00 CET 2006	Mon Jan 03 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030
					CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:49.405354977 CEST	18.203.205.32	443	192.168.2.3	49824	CN=target.microsoft.com, O=Adobe Systems Incorporated, L=San Jose, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Feb 05 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013 Fri Nov 10 01:00:00 CET 2006	Wed Feb 09 13:00:00 CET 2022 Sun Oct 22 14:00:00 CEST 2028 Mon Nov 10 01:00:00 CET 2031	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028
					CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Nov 10 01:00:00 CET 2006	Mon Nov 10 01:00:00 CET 2031
May 17, 2021 21:59:49.948787928 CEST	185.29.132.144	443	192.168.2.3	49827	CN=*.mathtag.com, O="MediaMath, Inc.", L=New York, ST=New York, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 15 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Apr 22 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:49.948787928 CEST	185.29.132.144	443	192.168.2.3	49827	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.010310888 CEST	185.29.132.144	443	192.168.2.3	49828	CN=*.mathtag.com, O="MediaMath, Inc.", L=New York, ST=New York, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Apr 15 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Fri Apr 22 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.010310888 CEST	185.29.132.144	443	192.168.2.3	49828	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.074167967 CEST	185.33.220.242	443	192.168.2.3	49832	CN=*.adnxs.com, O=Xandr Inc., L=New York, ST=New York, C=US CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 05 01:00:00 CET 2021 Mon Nov 06 13:24:09 CET 2017	Sun Feb 20 00:59:59 CET 2022 Sat Nov 06 13:24:09 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.074167967 CEST	185.33.220.242	443	192.168.2.3	49832	CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:24:09 CET 2017	Sat Nov 06 13:24:09 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.099653959 CEST	185.33.220.242	443	192.168.2.3	49831	CN=*.adnxs.com, O=Xandr Inc., L=New York, ST=New York, C=US CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 05 01:00:00 CET 2021 Mon Nov 06 13:24:09 CET 2017	Sun Feb 20 00:59:59 CET 2022 Sat Nov 06 13:24:09 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.099653959 CEST	185.33.220.242	443	192.168.2.3	49831	CN=GeoTrust ECC CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:24:09 CET 2017	Sat Nov 06 13:24:09 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.171533108 CEST	35.244.174.68	443	192.168.2.3	49834	CN=*.rlcdn.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Feb 25 01:00:00 CET 2021 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019 Thu Jan 01 01:00:00 CET 2004	Tue Mar 29 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
					CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
May 17, 2021 21:59:50.175614119 CEST	35.244.174.68	443	192.168.2.3	49833	CN=*.rlcdn.com CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Feb 25 01:00:00 CET 2021 Fri Nov 02 01:00:00 CET 2018 Tue Mar 12 01:00:00 CET 2019 Thu Jan 01 01:00:00 CET 2004	Tue Mar 29 01:59:59 CEST 2022 Wed Jan 01 00:59:59 CET 2031 Mon Jan 01 00:59:59 CET 2029 Mon Jan 01 00:59:59 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Sectigo RSA Domain Validation Secure Server CA, O=Sectigo Limited, L=Salford, ST=Greater Manchester, C=GB	CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	Fri Nov 02 01:00:00 CET 2018	Wed Jan 01 00:59:59 CET 2031
					CN=USERTrust RSA Certification Authority, O=The USERTRUST Network, L=Jersey City, ST=New Jersey, C=US	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Tue Mar 12 01:00:00 CET 2019	Mon Jan 01 00:59:59 CET 2029
					CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	CN=AAA Certificate Services, O=Comodo CA Limited, L=Salford, ST=Greater Manchester, C=GB	Thu Jan 01 01:00:00 CET 2004	Mon Jan 01 00:59:59 CET 2029
May 17, 2021 21:59:50.424809933 CEST	172.217.20.2	443	192.168.2.3	49836	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:11:12 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:11:11 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.424809933 CEST	172.217.20.2	443	192.168.2.3	49836	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.428947926 CEST	172.217.20.2	443	192.168.2.3	49835	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:11:12 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:11:11 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.428947926 CEST	172.217.20.2	443	192.168.2.3	49835	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.559509993 CEST	104.244.42.195	443	192.168.2.3	49842	CN=*.twitter.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Feb 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020	Sat Feb 05 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.559509993 CEST	104.244.42.195	443	192.168.2.3	49842	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.567291021 CEST	104.244.42.195	443	192.168.2.3	49841	CN=*.twitter.com, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Feb 05 01:00:00 CET 2021 Thu Sep 24 02:00:00 CEST 2020	Sat Feb 05 00:59:59 CET 2022 Tue Sep 24 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.567291021 CEST	104.244.42.195	443	192.168.2.3	49841	CN=DigiCert TLS RSA SHA256 2020 CA1, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Sep 24 02:00:00 CEST 2020	Tue Sep 24 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.782504082 CEST	76.223.111.131	443	192.168.2.3	49850	CN=*.adsrvr.org CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3 CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Thu Mar 18 23:45:32 CET 2021 Tue Jul 28 02:00:00 CEST 2020 Wed Mar 18 11:00:00 CET 2009	Wed Apr 20 00:45:32 CEST 2022 Sun Mar 18 01:00:00 CET 2029 Sun Mar 18 11:00:00 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Tue Jul 28 02:00:00 CEST 2020	Sun Mar 18 01:00:00 CET 2029
					CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Mar 18 11:00:00 CET 2009	Sun Mar 18 11:00:00 CET 2029
May 17, 2021 21:59:50.783425093 CEST	76.223.111.131	443	192.168.2.3	49849	CN=*.adsrvr.org CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3 CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Thu Mar 18 23:45:32 CET 2021 Tue Jul 28 02:00:00 CEST 2020 Wed Mar 18 11:00:00 CET 2009	Wed Apr 20 00:45:32 CEST 2022 Sun Mar 18 01:00:00 CET 2029 Sun Mar 18 11:00:00 CET 2029	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=GlobalSign GCC R3 DV TLS CA 2020, O=GlobalSign nv-sa, C=BE	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Tue Jul 28 02:00:00 CEST 2020	Sun Mar 18 01:00:00 CET 2029
					CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R3	Wed Mar 18 11:00:00 CET 2009	Sun Mar 18 11:00:00 CET 2029
May 17, 2021 21:59:50.862102985 CEST	91.228.74.189	443	192.168.2.3	49852	CN=*.quantserve.com, O=Quantcast Corporation, L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 02 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Oct 07 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.862102985 CEST	91.228.74.189	443	192.168.2.3	49852	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.863317966 CEST	91.228.74.189	443	192.168.2.3	49851	CN=*.quantserve.com, O=Quantcast Corporation, L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Oct 02 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Oct 07 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:50.863317966 CEST	91.228.74.189	443	192.168.2.3	49851	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.357285023 CEST	104.18.12.5	443	192.168.2.3	49855	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Aug 08 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sun Aug 08 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.357285023 CEST	104.18.12.5	443	192.168.2.3	49855	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.357964993 CEST	104.18.12.5	443	192.168.2.3	49856	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Aug 08 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sun Aug 08 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.357964993 CEST	104.18.12.5	443	192.168.2.3	49856	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.507319927 CEST	212.82.100.182	443	192.168.2.3	49857	CN=.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 29 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013 Tue Dec 29 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Jun 23 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028 Wed Jun 23 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028
					CN=*.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 29 01:00:00 CET 2020	Wed Jun 23 01:59:59 CEST 2021
					CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028
May 17, 2021 21:59:51.516659021 CEST	212.82.100.182	443	192.168.2.3	49858	CN=.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 29 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013 Tue Dec 29 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Wed Jun 23 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028 Wed Jun 23 01:59:59 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028
					CN=*.analytics.yahoo.com, O=Oath Inc, L=Sunnyvale, ST=California, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 29 01:00:00 CET 2020	Wed Jun 23 01:59:59 CEST 2021
					CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028
May 17, 2021 21:59:51.769107103 CEST	104.18.13.5	443	192.168.2.3	49860	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Aug 08 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sun Aug 08 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.769107103 CEST	104.18.13.5	443	192.168.2.3	49860	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.770590067 CEST	104.18.13.5	443	192.168.2.3	49859	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Sat Aug 08 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Sun Aug 08 14:00:00 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:51.770590067 CEST	104.18.13.5	443	192.168.2.3	49859	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:52.082145929 CEST	52.213.168.74	443	192.168.2.3	49861	CN=*.tt.omtrdc.net, O=Adobe Inc., L=SAN JOSE, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 02 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Wed Nov 10 00:59:59 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:52.082145929 CEST	52.213.168.74	443	192.168.2.3	49861	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.074100018 CEST	172.217.19.98	443	192.168.2.3	49867	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:11:12 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:11:11 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.074100018 CEST	172.217.19.98	443	192.168.2.3	49867	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.108753920 CEST	172.217.19.98	443	192.168.2.3	49868	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:11:12 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:11:11 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.108753920 CEST	172.217.19.98	443	192.168.2.3	49868	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.744031906 CEST	172.217.16.99	443	192.168.2.3	49872	CN=www.google.de, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:16:15 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:16:14 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.744031906 CEST	172.217.16.99	443	192.168.2.3	49872	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.744132996 CEST	172.217.16.99	443	192.168.2.3	49873	CN=www.google.de, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Apr 13 12:16:15 CEST 2021 Thu Jun 15 02:00:42 CEST 2017	Tue Jul 06 12:16:14 CEST 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
May 17, 2021 21:59:53.744132996 CEST	172.217.16.99	443	192.168.2.3	49873	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c

Code Manipulations

Statistics

Behavior

• iexplore.exe
• iexplore.exe
• TokenBrokerCookies.exe
• dllhost.exe
• explorer.exe
• iexplore.exe

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 256 Parent PID: 792

General

Start time:	21:58:33
Start date:	17/05/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff7cf580000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Analysis Process: iexplore.exe PID: 3488 Parent PID: 256

General

Start time:	21:58:34
Start date:	17/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:17410 /prefetch:2
Imagebase:	0xda0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Analysis Process: TokenBrokerCookies.exe PID: 1932 Parent PID: 256

General

Start time:	21:58:40
Start date:	17/05/2021
Path:	C:\Windows\System32\TokenBrokerCookies.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\TokenBrokerCookies.exe <no_string> https://login.microsoftonline.com/ 0 tbauth://login.windows.net/?context=https%3A%2F%2Flogin.microsoftonline.com&request_nonce=AwABAAAAAAACAOz_BAD0_9vjtAoycknOl_r9lWFD_7-6SBczLtZfkpOsuXPwU3VmrwCIxgM0P7A0fyllxEldWSW1X6qaRhD4IZKXmhIvB14gAA&rid=124ce03e-75bf-4b04-b647-d2d0edd90300 ESTSUSERLIST %7b%22users%22%3a%5b%5d%7d login.microsoftonline.com / 0 -904534258 30889634 1
Imagebase:	0x7ff6994f0000
File size:	35840 bytes
MD5 hash:	17F27A76AC8E9869C8F1BE286D88570A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Analysis Process: dllhost.exe PID: 4092 Parent PID: 792

General

Start time:	21:58:51
Start date:	17/05/2021
Path:	C:\Windows\System32\dllhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\DllHost.exe /Processid:{49F171DD-B51A-40D3-9A6C-52D674CC729D}
Imagebase:	0x7ff7bc440000
File size:	20888 bytes
MD5 hash:	2528137C6745C4EADD87817A1909677E
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Analysis Process: explorer.exe PID: 3388 Parent PID: 4092

General

Start time:	21:58:53
Start date:	17/05/2021
Path:	C:\Windows\explorer.exe
Wow64 process (32bit):	false
Commandline:
Imagebase:	0x7ff714890000
File size:	3933184 bytes
MD5 hash:	AD5296B280E8F522A8A897C96BAB0E1D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 6148 Parent PID: 256

General

Start time:	21:59:10
Start date:	17/05/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:256 CREDAT:82962 /prefetch:2
Imagebase:	0xda0000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Disassembly

Code Analysis

Description:	Adversaries may abuse command and script interpreters to execute commands, scripts, or binaries. These interfaces and languages provide ways of interacting with computer systems and are a common feature across many different platforms. Most systems come with some built-in command-line interface and scripting capabilities, for example, macOS and Linux distributions include some flavor of Unix Shell while Windows installations include the Windows Command Shell and PowerShell .
Tactics:	Execution
Data Sources:	PowerShell logs, Process command-line parameters, Process monitoring, Windows event logs
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in client applications to execute code. Vulnerabilities can exist in software due to unsecure coding practices that can lead to unanticipated behavior. Adversaries can take advantage of certain vulnerabilities through targeted exploitation for the purpose of arbitrary code execution. Oftentimes the most valuable exploits to an offensive toolkit are those that can be used to obtain code execution on a remote system because they can be used to gain access to that system. Users will expect to see files related to the applications they commonly used to do work, so they are a useful target for exploit research and development because of their high utility.
Tactics:	Execution
Data Sources:	Anti-virus, Process monitoring, System calls
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Process command-line parameters, Process monitoring, Windows Registry
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, File monitoring, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, Azure AD, GCP, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	API monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	AWS CloudTrail logs, Azure activity logs, Process command-line parameters, Process monitoring, Stackdriver logs
Platforms:	AWS, Azure, GCP, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://rafihautogroup-my.sharepoint.com/:b:/g/personal/james_lexusofwindsor_com/ERPTqVCeYsJAmi6ORMQhkb0BOr8sKUhKX8e8Vw1tCjHieA?e=4%3aaHfkN7&at=9

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

AV Detection:

Phishing:

Compliance:

Software Vulnerabilities:

Networking:

System Summary:

Hooking and other Techniques for Hiding and Protection:

Malware Analysis System Evasion:

HIPS / PFW / Operating System Protection Evasion:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 256 Parent PID: 792

General

File Activities

File Created

File Written

File Read

Registry Activities

Key Created

Key Value Created

Key Value Modified

Analysis Process: iexplore.exe PID: 3488 Parent PID: 256

General

File Activities

File Created