21:I[7638,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js","/_next/static/chunks/2wvg5zqmbil4p.js","/_next/static/chunks/4109t72175nm8.js","/_next/static/chunks/04k_7k5p4krw4.js","/_next/static/chunks/30r--1re9i9ly.js"],"SampleDetailWrapper"] 26:I[27201,["/_next/static/chunks/1nkjstpmp978x.js","/_next/static/chunks/2ysmnrb0knc4n.js","/_next/static/chunks/0i2jherxtxs7l.js"],"IconMark"] 20:T42f,{"@context":"https://schema.org","@type":"TechArticle","headline":"Sample 3024ce3117b7… — Score 0/100 — Hybrid Analysis","description":"Threat analysis for sample 3024ce3117b7…. Threat score 0/100. 0/3 AV engines flagged this file. 0 malicious and 1 suspicious behavioral indicators. View antivirus detections, behavioral indicators, and sandbox reports.","url":"/sample/3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb","keywords":["malware analysis","sandbox report","threat intelligence","3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb"],"about":{"@type":"SoftwareApplication","name":"https://engsci.utoronto.ca/forums/topic/123movies-watch-demon-slayer-the-movie-2020-online-full-hd-download/","applicationCategory":["url"],"identifier":"3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb"},"threatScore":0,"antivirusDetections":{"malicious":0,"total":3},"behavioralIndicators":{"malicious":0,"suspicious":1},"publisher":{"@type":"Organization","name":"Hybrid Analysis","url":"https://www.hybrid-analysis.com"}}22:T564,iVBORw0KGgoAAAANSUhEUgAAACAAAAAgCAYAAABzenr0AAAD0klEQVR42u2XS2hTWRjHg7Nw4TADYqcdxFbFMqtZjjOzUgdFRWtbEjuPMgu3wygoCqXooKIoVGiNaZuWLtsunIdTmG4GN4VQZmBaLPRlKK0P0iZ9JJmYx03u4+/3nZs0zTX39jZx2Q/+5EHO+f++75zznRuHYzu2wxBTU1NYWlrC8vIygsGgTem/DwQCGB0dRX19PUoGmJ6ehqZpKCVkWQaPZwin04mSAdLptJiQQTRNhaqaSYGi5MUxNzcHv9+PyclJNDY2okwAc2OjeQ7gxYsFLC4uis8TExNobm5GyQB2ss5LFmM4+/n5efE+EonA5/PB5XJhSwCSJJkCmJnnAGZmZjA42E8axMDAAIaGhjA8PPy+AMzNeQOychEKhQTM2NiYgCgTQDE1zxnnlUEmkyk4SbOzs+UAbJ71RvMcgC6eR0MikSgVoBzztBADRKPRrQKkRAk3L7nRNG/MJ4nF80Sjka0BpFJGALkk83RaEr3EEuCni5dx9eq1kuT2dL1jngeQ7AHwRG9opVaokYUyQJIno+z5QBWXJsTBY63McwDckCwBlsn8ZQxYSgB3+v/BruMPUHXOjUPf9qD2O++6Pm3woJa+U8QdoWUBjGXPA/Bm5pMUiYStAVZUYCGi4jVBxGnQn6MLONDUhap6N6qd3ah2dZK6sOdMB2oa3JDVQgCjcc5cB1A2B1glgJcE8CoKBGJpQX2bKrH7dDtqzndjf1YVBHDI2VFQAStzPk22AV5R9lyBJA18OhHAgfNe1Ljy5vubvPhEADwsAiAZAFLrsgUQhm4ep9fxuVV89kMv9jk7ydgrzPc1erC34RFVoB21BLBxCcwy3wgQDm8CEOHLIwW8oUqcvfYbKurcONjULcpfVdeBytNttPYd2HXsHg42tBsqUNyYxf2E+0c4vGYN8D8B0AHAyFQIlXUPaQN61813fHUTv4/M4L/nQTi+/AWVJ+8XAJgZ60raA+A+QMnD8+QZPj7VLgC45B98fRPux/9mH800DPme46MjtwuWwGiuAyTXZQsgnr023X88w4cnHtDm68LOI3fR0vlUGEmsrOlfPr+hAsWy3yJAItvl/h4PYOc3bbQMblTRuq/EJGEUl1XqkCokRTc2AzCa2wbgyzdKbZj2IY7+3A/H56344kKvMJFJSQJIkSRSWlENS5BEMslKFFUmI2N1dcUagG/ttZRehWA4ju+v/wrH4Rv48dYTjPlDIDZQAQgGlL2+X3J3gd2wBOBQsj+MxWKIx+PiKcZKXG4e29vbU1Q9Pbr6+vrg8XjMAS5eulLyddzS2opy/wq+BTgoCRlpZOGDAAAAAElFTkSuQmCC23:Teab,Pattern match: "https://engsci.utoronto.ca/forums/topic/123movies-watch-demon-slayer-the-movie-2020-online-full-hd-download/" Pattern match: "https://engsci.utoronto.ca" Heuristic match: "ocsp.sectigo.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEDCqPfqnxkvIu%2BJF%2BfBVjt0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEH4vIG4DrNAf2Cc44XSk9h0%3D HTTP/1.1 Connection: Keep-Alive Accept: */* User-Agent: Microsoft-CryptoAPI/6.1 Host: ocsp.sectigo.com" Heuristic match: "engsci.utoronto.ca" Heuristic match: "fonts.googleapis.com" Heuristic match: "fonts.gstatic.com" Heuristic match: "s.w.org" Heuristic match: "secure.gravatar.com" Heuristic match: "staging.engsci.utoronto.ca" Heuristic match: "stats.g.doubleclick.net" Pattern match: "https://engsci.utoronto.ca/wp-content/themes/uoft_fase_theme_2020-master/library/images/apple-touch-icon.png" Pattern match: "https://engsci.utoronto.ca/wp-json/" Pattern match: "jquery.org/license" Pattern match: "http://getbootstrap.com" Pattern match: "http://fontawesome.io" Pattern match: "https://engsci.utoronto.ca/wp-content/plugins/modern-events-calendar-lite/assets/packages/lity/lity.min.css" Pattern match: "https://engsci.utoronto.ca/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fengsci.utoronto.ca%2Fforums%2Ftopic%2F123movies-watch-demon-slayer-the-movie-2020-online-full-hd-download%2F&format=xml" Pattern match: "https://engsci.utoronto.ca/sample-page/directory/" Pattern match: "https://watch123movies4k.co/movie/635302/demon-slayer-the-movie-mugen-train.html" Pattern match: "'https://engsci.utoronto.ca/wp-includes/css/dashicons.min.cs" Pattern match: "to.ca/news-events/calendar/" Pattern match: "https://engsci.utoronto.ca/wp-includes/js/quicktags.min.js" Pattern match: "http://noelboss.github.io/featherlight/" Pattern match: "http://daneden.me/animate" Pattern match: "staging.engsci.utoronto.ca/wp-content/plugins/all-in-one-event-calendar/cache/80aa96d0_ai1ec_parsed_css.css" Pattern match: "https://engsci.utoronto.ca/research-and-work/career-resources/on-campus-resources/" Pattern match: "http://sorgalla.com/lity/" Pattern match: "http://stackoverflow.com/questions/1599660/which-html-elements-can-receive-focus" Pattern match: "github.com/dennyferra/TypeWatch" Pattern match: "https://github.com/select2/select2/blob/master/LICENSE.md" Pattern match: "https://www.youtube.com/watch?v=:id" Pattern match: "http://+e" Pattern match: "https://twemoji.maxcdn.com/v/13.0.1/,ext:.png,size:72x72,className:emoji,convert:{fromCodePoint:function(d){var" Pattern match: "https://github.com/OwlCarousel2/OwlCarousel2/blob/master/LICENSE" Pattern match: "http://jqueryui.com" Pattern match: "http://www.w3.org/2000/svg" Pattern match: "http://jamiebrittain.com" Pattern match: "http://,!1===this.isOpen(n)?(a=prompt(quicktagsL10n.enterURL,o))&&" Pattern match: "http://a/c%20d?a=1&c=3!==e.href||3!==t.get(c)||a=1!==String" Pattern match: "staging.engsci.utoronto.ca/wp-content/plugins/all-in-one-event-calendar/public/themes-ai1ec/vortex/font/ai1ec-icons.eot" Pattern match: "staging.engsci.utoronto.ca/wp-content/plugins/all-in-one-event-calendar/public/themes-ai1ec/vortex/img/select2.png" Pattern match: "staging.engsci.utoronto.ca/wp-content/plugins/all-in-one-event-calendar/public/themes-ai1ec/vortex/img/ajax-loader.gif" Pattern match: ".ci.ut0r0nt0.ca/rorun__./topic_z23n_o_._ie_.-watch-den_on-_._a_,_er-the-n_o_._ie-2a2a-on_ine-r" Pattern match: "Jwatch123movies4k.co/mavie/635302/demon-sla"24:T7ed,"iexplore.exe" wrote bytes "b033146f" to virtual address "0x76401100" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "60d2176f" to virtual address "0x767C1D7C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x763A11B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "60d2176f" to virtual address "0x763A13B8" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "c03a146f" to virtual address "0x767C1FB0" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x774117CC" (part of module "ADVAPI32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x77DE1210" (part of module "IMM32.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x767C202C" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x74841250" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x7798B0CC" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "c0bf156f" to virtual address "0x767C1F68" (part of module "SHELL32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x6E36F6A0" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x7484139C" (part of module "UXTHEME.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x77DC1144" (part of module "LPK.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x76401298" (part of module "MSCTF.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x776011BC" (part of module "GDI32.DLL") "iexplore.exe" wrote bytes "b033146f" to virtual address "0x7798917C" (part of module "IERTUTIL.DLL") "iexplore.exe" wrote bytes "a035146f" to virtual address "0x763A131C" (part of module "SHLWAPI.DLL") "iexplore.exe" wrote bytes "3030146f" to virtual address "0x6E36FE90" (part of module "IEFRAME.DLL") "iexplore.exe" wrote bytes "60cd176f" to virtual address "0x767C1E14" (part of module "SHELL32.DLL")25:T627,"1f642_1_.svg" has type "ASCII text with very long lines with no line terminators" "urlblockindex_1_.bin" has type "data" "1f534_1_.svg" has type "ASCII text with no line terminators" "Sig_Dept_EngSci_Standard_White_1_.svg" has type "SVG Scalable Vector Graphics image" "uoft_fase_wordmark_2020_1_.svg" has type "SVG Scalable Vector Graphics image" "dashicons.min_1_.css" has type "ASCII text with very long lines" "CC197601BE0898B7B0FCC91FA15D8A69_8712D49A882F47F256339120DED5786E" has type "data" "6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442" has type "data" "menu.min_1_.js" has type "ASCII text with very long lines" "frontend.min_1_.css" has type "ASCII text with very long lines with no line terminators" "6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04" has type "data" "07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B" has type "data" "select2.min_1_.css" has type "ASCII text with very long lines with CRLF line terminators" "W5KGGJGC.txt" has type "ASCII text" "07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D" has type "data" "mem5YaGs126MiZpBA-UN_r8OUuhv_1_.woff" has type "Web Open Font Format flavor 65536 length 18668 version 1.1" "buttons.min_1_.css" has type "ASCII text with very long lines" "_CB40E532-4950-11EB-9522-08002773B4B1_.dat" has type "Composite Document File V2 Document Cannot read section info" "~DF13A49B3ED327A3AF.TMP" has type "data" "memnYaGs126MiZpBA-UFUKW-U9hrIqU_1_.woff" has type "Web Open Font Format flavor 65536 length 17788 version 1.1"18:["$","$L2",null,{"children":[["$","script",null,{"type":"application/ld+json","dangerouslySetInnerHTML":{"__html":"$20"}}],["$","$L21",null,{"initialData":{"activity":{"behavior_tags":null,"file_activity":{"dropped_files":[],"extracted_files":[{"name":"menu.min_1_.js","sha256":"d3f7bcf7b6e2ddb8cbf4e200d1af6250f2b4b1185b5e83be09e5ae4f1a19cf71","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"mem5YaGs126MiZpBA-UN_r8OUuhv_1_.woff","sha256":"6e8a28a0638c920e5b76177e5f03ba94fcdedd3e3ecd347c333d82876b51c9c0","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"wp-emoji-release.min_1_.js","sha256":"3685c3818240f5f390073c7d04f944a5cb5d848093224f3a7888034e8c050eb4","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sha256":"e37642ec4e87922ed6b0206a56bb9089f2d581957f53f7343327f4a670fe6d67","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"Sig_Dept_EngSci_Standard_White_1_.svg","sha256":"9650770024f9a6d75c184792e0ac656ed8a066424e5c4e9017d2dd77673981ca","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"buttons.min_1_.css","sha256":"665f5f2c765eed93c95aaf220169810c5e262e7a39664b876e813c1695d81152","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"animate.min_1_.css","sha256":"8fe3fa119255adb5e0c12479331f9e092e85bcff56ab6ecc0510bfa2056b898d","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"mem5YaGs126MiZpBA-UNirkOUuhv_1_.woff","sha256":"57c79375b1419ee1d984f443cda77c04b9b38c0be5330b2d41d65103115ffd72","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"urlblockindex_1_.bin","sha256":"775853600060162c4b4e5f883f9fd5a278e61c471b3ee1826396b6d129499aa7","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"1f534_1_.svg","sha256":"93f28a18a1df638b539f6bde99c048a50ad7b8a5643c6966a0546a0c50f7cace","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sha256":"1e9bf1c72091437d8e04887c16e130df00732c6cafaf13aff9d605fc76dd1717","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sha256":"8ba91b47832e7c92ce4aec0255ae6511d12f7f92201d8d1db21d37f81a190030","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"~DFA1BE62C2399E1532.TMP","sha256":"6910ab076bda112985b7f15500506cd9772d11d8c8ed4bb814409f9a739693e2","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"uoft_fase_wordmark_2020_1_.svg","sha256":"e0ccafa0b3e8f87172f8b9ed67069e87087ef92ac4c762213db0404a3671de79","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"select2.min_1_.css","sha256":"c2a282dd6dac10a3fbf469b4e67f489608777854e6d157bf11233dfbaa16851e","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"default.min_1_.css","sha256":"97ce1e1f5dbfda35ac979b593e79e1673a3e725790339d767e4a6ca6e94a4828","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"80237EE4964FC9C409AAF55BF996A292_C0427F5F77D9B3A439FC620EDAAB6177","sha256":"479d8045cdef7cae914b204f1f184d70af3de1b54263ccb09cab4680b9352d97","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"1f642_1_.svg","sha256":"943c44a0f3dc1aba84f5fbe8465baadbb90af66cd7be9f37ca07a39260357ad2","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"068K7C8H.txt","sha256":"7a6f1835cc20510f9cb80c30c2af51b37f5c166a88fdca122dc6398afaf4b444","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"JT35WUYN.txt","sha256":"69c997417f75dbfafd0097fcd62063e95fcfada890328b6df7907e7c2ff9cc89","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"wp-polyfill-dom-rect.min_1_.js","sha256":"12a5a706370d4e3ce10a6b07e935206f4faad834e0c9459f81af8dce7ceadc81","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_8712D49A882F47F256339120DED5786E","sha256":"9b1675e07a5b3707107f270f78bbc69126300fa254acc401b89a055be9062b52","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"361OEDTE.txt","sha256":"3a765384732843d7eaf672a708eb0833cd2682d943d4c78b72b03daa060abd5f","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"W5KGGJGC.txt","sha256":"e44c255fd35b246631372e2a48ae182f8f94eb1e5c50b90ded31408a64a59e37","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"imagestore.dat","sha256":"979e4052b14cd48956911978be62dfcd079ed531fd5c4c17b15673259d1c56a8","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sha256":"03c19f29db64c261a046ed226d9f69bbf9b060162994a5d7f980a43492fc7c2b","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"72BA427A91F50409B9EAC87F2B59B951_892C46A2B4F6E377CCE8E53BBE9258C3","sha256":"8951fd8e14062287b17553c3c3f19d51ffe4f960bfb39efe6882486785379c05","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"dashicons.min_1_.css","sha256":"8273f0538929ede9599e3cfea8142a252a7d0cb6dbacb230bf188490dde79d4b","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"_CB40E532-4950-11EB-9522-08002773B4B1_.dat","sha256":"36ff2fc0dddaaf04ae17ebefacb8f1abeaf626646267a220f5f6aa331444f0cf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sha256":"a73dcf73b78aa64c481137705e7185f6640b12b5da18d1f73481db67892ab3d1","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776","sha256":"fbdfcb95e92ebb77b174a0553a3c05edfb65cbea274bb9a6dfe40c8a8759bb8b","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"72BA427A91F50409B9EAC87F2B59B951_5A146D210BF5CD52F59877423ED72DDC","sha256":"79b81047a422650f0619c6deb9180ad38e4d0e90378cacd6faae6babbe1d3c3f","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"~DF13A49B3ED327A3AF.TMP","sha256":"563ecd4a19ac80c2f03ecbef5e18bf826170b7c093aa620d73278c6d4a9ab712","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"frontend.min_1_.css","sha256":"90368b5a3711b1777dc287f535cfc1be62b69a362a1af847558cb7c44c7f3974","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"TQ3B6J6Y.txt","sha256":"51e912814cca041183692de107338201dd3ce18bb1e4078747b7b5e43f934f60","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"~DF17B662ACCA820CDD.TMP","sha256":"8b3d34d9b7073913fb742d7ccc90376d6e573d1dcf5a0b13b4babeae4886e426","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"~DF4E01B2EA321E33A7.TMP","sha256":"96f9beec0232c34ee82526f2a8661426fdd6c8e34ffa2314b68dd42351747808","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"editor.min_1_.js","sha256":"df92bde186580a41df772f82ec6f18fd310f31f0eb410ef54b15c8fc96064df6","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"wp-polyfill-element-closest.min_1_.js","sha256":"1d1cc2b1811b4ebeda7be9b00999aa3330c7d16d1ea4debd33d3dedf3a956ae0","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"EVIWP33P.txt","sha256":"606f2266926bbcc2b1c6b9943c6a44bb17b541e464645d5eed0d4a6863e2ac41","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"OMNR76VQ.txt","sha256":"e44c255fd35b246631372e2a48ae182f8f94eb1e5c50b90ded31408a64a59e37","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"en-US.3","sha256":"c6a5377cbc07eece33790cfc70572e12c7a48ad8296be25c0cc805a1f384dbad","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_0DF38F99411D9712ABA58A5A8BCEA52E","sha256":"018b4025b78ec8666c8a2c3c240d73b398dc42518a996392515d843652476cba","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sha256":"d94397a59427076a92fe60ce95699b23062dd1832efa2720c5fc5b31a98c8829","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"memnYaGs126MiZpBA-UFUKW-U9hrIqU_1_.woff","sha256":"49b6274bccb5c6b31e20cebb213d96197b522b1fb9c95b8649a0626edb5bd9d8","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_E74A20D33873D54F8A31F1672E74B3D6","sha256":"ea707893714bdb7319651e51fee585f2852c1729c405c52b98830f5e687c4b01","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"8H3YOUYOINV8EVXC7R7A.temp","sha256":"458fb8b9879da548ceae8076e4f033982cc1b22d359bdce08649f9b12df7b97c","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CC197601BE0898B7B0FCC91FA15D8A69_29022263B141B834888A4915008D196C","sha256":"0878b52b74351634ae2cb508437d00fb77f0b9f26883733b29651124a5a0e862","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sha256":"de6fc37b2c495d89e445874529ce7b8a82f7d3d926182d685dcc8df4d0e62353","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"},{"name":"JavaDeployReg.log","sha256":"edf66ee4242b648cec54d08b4bdf0b1d2410166fc8d226996068a64b02fcc493","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"verdict":"undetected"}],"files_deleted":[],"files_written":[{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[3].ico","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\HGEILYKK.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_5A146D210BF5CD52F59877423ED72DDC","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\bootstrap.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\rundll32.exe","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\MICROS~3\\Office14\\URLREDIR.DLL","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\iconfonts[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\featherlight[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\mem5YaGs126MiZpBA-UN_r8OUuhv[1].woff","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\69C6F6EC64E114822DF688DC12CDD86C","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_5F74A11739B1C16E9F3CFEC90BB0A058","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\datepicker.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\wplink.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\ieframe.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\analytics[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[3].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_6F8900FF5837CB8DFA61275648785329","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\dyncss[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\tooltip[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\search[1].json","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\~DF13A49B3ED327A3AF.TMP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\dom-ready.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\counters.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Adobe\\Flash Player\\NativeCache","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Feeds","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\572BF21E454637C9F000BE1AF9B1E1A9","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_49FC544F04082FD9F64F9EFB226AF8B5","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[7].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[1].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\7423F88C7F265F0DEFC08EA88C3BDE45_137095CCA1922136C4B9E18EE962B463","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\VG8BU31O.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\Favorites\\desktop.ini","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\user32.dll.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Virtualized","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\a11y.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\quicktags.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\123movies-watch-demon-slayer-the-movie-2020-online-full-hd-download[1].htm","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\featherlight[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\consola.ttf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[6].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[1].ico","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[2].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[6].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_95936C747BFEA808795D4BAC846CDBC0","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\msxml6r.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN8rsOUuhv[1].woff","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\css[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{F5E5586C-DA91-47DA-AEAC-0A88CD2FFB01}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\404HCFVH.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\wp-polyfill.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\common-skeleton.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\KernelBase.dll.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"\\DEVICE\\NETBT_TCPIP_{E29AC6C2-7037-11DE-816D-806E6F6E6963}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\wp-polyfill-element-closest.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\28c8b86deab549a1.customDestinations-ms~RF120f69.TMP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\82CB34DD3343FE727DF8890D352E0D8F","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\Adobe\\Director\\SwDir_1231201.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[8].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\lity.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\bbpress.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v4.0.30319\\clr.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[2].ico","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_29022263B141B834888A4915008D196C","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\select2.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\frontend.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\desktop.ini","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\Desktop\\desktop.ini","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\AEB3247079FFA7BF2B5622D101414A7E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"C:\\Program Files","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\Macromed\\Flash\\Flash32_27_0_0_187.ocx","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\memnYaGs126MiZpBA-UFUKW-U9hrIqU[1].woff","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\~DF4E01B2EA321E33A7.TMP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Recent\\CustomDestinations\\8H3YOUYOINV8EVXC7R7A.temp","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\~DFA1BE62C2399E1532.TMP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\CI1NEHIQ.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\90f5b0fdc1cbe9584ad608d3c46dab6b[1].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\core.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\mem5YaGs126MiZpBA-UN7rgOUuhv[1].woff","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\imagestore\\3mt7jhv\\imagestore.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\UrlBlockManager\\urlblocklist.bin","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC4FEA46495CA161D470CD085EDBAADE","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"C:\\share","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\mscorwks.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\font-awesome.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\Internet Explorer\\Services\\search_{0633EE93-D776-472f-A0FF-E1416B8B2E3A}.ico","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\wp-emoji-release.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.2","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\Favorites","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\RecoveryStore.{C179800F-4950-11EB-9522-08002773B4B1}.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_29022263B141B834888A4915008D196C","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\wshqos.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\mscorwks.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatCache\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\lib\\plugin.jar","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Internet Explorer\\UserData\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\PlayReady","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\72BA427A91F50409B9EAC87F2B59B951_892C46A2B4F6E377CCE8E53BBE9258C3","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\lity.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[2].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[5].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\animate.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\clr.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\AppPatch\\AcLayers.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_8FB29C35032AE1827A2754ED35D7F2E8","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\menu.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\3S9Q96YC.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\85B3F147E3624A14E6A20DB4F6C2C5D9","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\urlblockindex[1].bin","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.0.3705\\mscorwks.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\~DF4888BD6848BE3EB1.TMP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Tracking Protection","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\6BADA8974A10C4BD62CC921D13E43B18_1DC6D7385EA816C957BA2B715AC5C442","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\i18n.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_E74A20D33873D54F8A31F1672E74B3D6","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\shell32.dll.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6DB145CFEEC544B1582FED1ADA3370DD","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\frontend.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v1.1.4322\\clr.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\tooltip.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Java\\jre1.8.0_151\\bin\\javaws.exe","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\UofT-Engineering-main[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\owl.carousel.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\CC197601BE0898B7B0FCC91FA15D8A69_0DF38F99411D9712ABA58A5A8BCEA52E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_8712D49A882F47F256339120DED5786E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[5].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\suggestions[1].en-US","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\StaticCache.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\editor.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\frontend[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_481F8A39663A9CAB91F20F2006514951","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\people-BKG-tile[1].jpg","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_649D3C9717A1D0B02735FC14F09C533D","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_0DF38F99411D9712ABA58A5A8BCEA52E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Microsoft.NET\\Framework\\v2.0.50727\\clr.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\6BADA8974A10C4BD62CC921D13E43B18_BEB37ABADF39714871232B4792417E04","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\TabRoaming","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\msctf.dll.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CC197601BE0898B7B0FCC91FA15D8A69_AAFDC9223C8D151DE1536A697A335D36","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"C:\\3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb.url","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\PrivacIE\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\IECompatUACache","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\57C8EDB95DF3F0AD4EE2DC2B8CFD4157","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe.config","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\AppPatch\\sysmain.sdb","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\Sig_Dept_EngSci_Standard_White[1].svg","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[3].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{CB40E532-4950-11EB-9522-08002773B4B1}.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\arial.ttf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_126DADAD2E2E6B3E0E1F406FCFB9682F","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\DomainSuggestions\\en-US.3","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\arialbd.ttf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\favicon[4].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\bootstrap.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[2].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\~sldvxrs.tmp","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\select2.full.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\oleaccrc.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\reply.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\seguisym.ttf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\timesbd.ttf","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%USERPROFILE%\\AppData\\Roaming","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%TEMP%\\JavaDeployReg.log","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\72BA427A91F50409B9EAC87F2B59B951_892C46A2B4F6E377CCE8E53BBE9258C3","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\wp-polyfill-fetch.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Fonts\\simsun.ttc","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Internet Explorer","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\stdole2.tlb","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_46766FC45507C0B9E264E4C18BC7288B","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\MSIMGSIZ.DAT","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"C:","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\rsaenh.dll","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_BACC6CD2B29F18349081C9FD2343833B","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\CFE86DBBE02D859DC92F1E17E0574EE8_5FA8E5E800867BF860DF5E533E701BAF","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\engagements.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\uoft_fase_wordmark_2020[1].svg","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\tooltipster-sideTip-shadow.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\UofT-Engineering[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\background-shadow[1].jpg","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\mem5YaGs126MiZpBA-UNirkOUuhv[1].woff","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\System32\\en-US\\rundll32.exe.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\default.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\buttons.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\History\\Low","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%PROGRAMFILES%\\Internet Explorer\\en\\iexplore.exe.mui","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Internet Explorer\\Recovery\\High\\Active\\{C1798011-4950-11EB-9522-08002773B4B1}.dat","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\Cookies\\361OEDTE.txt","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%APPDATA%\\Microsoft\\Windows\\DNTException","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\3538626A1FCCCA43C7E18F220BDD9B02","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\jquery.typewatch[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\frontend.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\PI95A64D\\analytics[2].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%WINDIR%\\Globalization\\Sorting\\SortDefault.nls","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\dashicons.min[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\wp-embed.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\jquery-migrate.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\favicon[4].png","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\colorbrightness.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\CKDNCXYS\\80aa96d0_ai1ec_parsed_css[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\autocomplete.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\1f642[1].svg","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\tooltip[1].css","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\72BA427A91F50409B9EAC87F2B59B951_5A146D210BF5CD52F59877423ED72DDC","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\2UXTWTJR\\jquery.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\QQW0X29Y\\events[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\MetaData\\07CEF2F654E3ED6050FFC9B6EB844250_7615FEE94EC76D87B786C0D82C9D525A","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\ow\\Microsoft\\CryptnetUrlCache\\Content\\07CEF2F654E3ED6050FFC9B6EB844250_3431D4C539FB2CFCB781821E9902850D","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"path":"%LOCALAPPDATA%\\Microsoft\\Windows\\Temporary Internet Files\\Content.IE5\\37NU00GP\\editor.min[1].js","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]}]},"mutex_activity":{"mutex_created":[{"name":"Local\\MSIMGSIZECacheMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\ZonesCacheCounterMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\VERMGMTBlockListFileMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\!BrowserEmulation!SharedMemory!Mutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_ConnHashTable<3672>_HashTable_Mutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\MSIMGSIZECacheMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"_!SHMSFTHISTORY!_","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\InternetShortcutMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\URLBLOCK_HASHFILESWITCH_MUTEX","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\VERMGMTBlockListFileMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_IE_EarlyTabStart_0xd20_Mutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e58_IESQMMUTEX_0_519","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_IESQMMUTEX_0_331","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\URLBLOCK_DOWNLOAD_MUTEX","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"UpdatingNewTabPageData","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_IESQMMUTEX_0_519","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_IESQMMUTEX_0_303","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3672","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"\\Sessions\\1\\BaseNamedObjects\\{5312EE61-79E3-4A24-BFE1-132B85B23C3A}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"name":"IsoScope_e58_IESQMMUTEX_0_274","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]}]},"network_activity":{"contacted_hosts":[{"address":"192.0.73.2","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"172.217.0.14","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"108.177.111.156","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"172.217.4.195","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"192.0.77.48","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"142.1.176.180","country":"Canada","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"216.58.192.234","country":"United States","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"172.217.6.3","country":"United States","port":80,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"address":"142.1.176.100","country":"Canada","port":443,"protocol":"TCP","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]}],"dns_resolutions":[{"address":"142.1.176.180","country":"Canada","domain":"engsci.utoronto.ca","registrar_creation_date":"2000-09-28T00:00:00+00:00","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":599},{"address":"142.250.68.170","country":"United States","domain":"fonts.googleapis.com","registrar_creation_date":"2005-01-25T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":299},{"address":"142.250.68.163","country":"United States","domain":"fonts.gstatic.com","registrar_creation_date":"2008-02-11T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":125},{"address":"151.139.128.14","country":"United States","domain":"ocsp.sectigo.com","registrar_creation_date":"2018-08-16T17:53:22+00:00","registrar_name":"CSC CORPORATE DOMAINS, INC.","registrar_name_servers":"NS1.AS48447.NET","registrar_organization":"Sectigo Limited","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":3425},{"address":"192.0.77.48","country":"United States","domain":"s.w.org","registrar_creation_date":"1993-12-01T05:00:00+00:00","registrar_name":"GoDaddy.com, LLC","registrar_name_servers":"NS1.WORDPRESS.ORG","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":260},{"address":"192.0.73.2","country":"United States","domain":"secure.gravatar.com","registrar_creation_date":"2004-07-15T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.AUTOMATTIC.COM","registrar_organization":"Automattic, Inc.","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":134},{"address":"142.1.176.100","country":"Canada","domain":"staging.engsci.utoronto.ca","registrar_creation_date":"2000-09-28T00:00:00+00:00","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":21599},{"address":"172.217.6.3","country":"United States","domain":"ocsp.pki.goog","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":119},{"address":"64.233.179.156","country":"United States","domain":"stats.g.doubleclick.net","registrar_creation_date":"1996-01-16T00:00:00+00:00","registrar_name":"MarkMonitor, Inc.","registrar_name_servers":"NS1.GOOGLE.COM","registrar_organization":"Google Inc.","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"ttl":8486}],"http_requests":[{"header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEH4vIG4DrNAf2Cc44XSk9h0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","host":"ocsp.sectigo.com","host_ip":"151.139.128.14:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEH4vIG4DrNAf2Cc44XSk9h0%3D"},{"header":"GET /gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","host":"ocsp.pki.goog","host_ip":"172.217.6.3:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/gsr2/ME4wTDBKMEgwRjAJBgUrDgMCGgUABBTgXIsxbvr2lBkPpoIEVRE6gHlCnAQUm%2BIHV2ccHsBqBt5ZtJot39wZhi4CDQHjtJqhjYqpgSVpULg%3D"},{"header":"GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDYLJWXOOilPwUAAAAAfozF HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","host":"ocsp.pki.goog","host_ip":"172.217.6.3:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDYLJWXOOilPwUAAAAAfozF"},{"header":"GET /gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB6CSjN0CZFqBQAAAAB%2BjGs%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","host":"ocsp.pki.goog","host_ip":"172.217.6.3:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/gts1o1core/MFEwTzBNMEswSTAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEB6CSjN0CZFqBQAAAAB%2BjGs%3D"},{"header":"GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDCM7HfIeUYqwUAAAAAfoxq HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","host":"ocsp.pki.goog","host_ip":"172.217.6.3:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDCM7HfIeUYqwUAAAAAfoxq"},{"header":"GET /gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDcESu58tA7KQMAAAAAutv8 HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.pki.goog","host":"ocsp.pki.goog","host_ip":"172.217.6.3:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/gts1o1core/MFIwUDBOMEwwSjAJBgUrDgMCGgUABBRCRjDCJxnb3nDwj%2Fxz5aZfZjgXvAQUmNH4bhDrz5vsYJ8YkBug630J%2FSsCEQDcESu58tA7KQMAAAAAutv8"},{"header":"GET /MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEDCqPfqnxkvIu%2BJF%2BfBVjt0%3D HTTP/1.1\nConnection: Keep-Alive\nAccept: */*\nUser-Agent: Microsoft-CryptoAPI/6.1\nHost: ocsp.sectigo.com","host":"ocsp.sectigo.com","host_ip":"151.139.128.14:80","method":"GET","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"url":"/MFEwTzBNMEswSTAJBgUrDgMCGgUABBQh80WaEMqmyEvaHjlisSfVM4p8SAQUF9nWJSdn%2BTHCSUPZMDZEjGypT%2BsCEDCqPfqnxkvIu%2BJF%2BfBVjt0%3D"}]},"process_activity":{"all_imported_dlls":["dxgi.dll","UIAnimation.dll","d2d1.dll","mlang.dll","winnsi.dll","mshtml.dll","schannel.dll","powrprof.dll","comdlg32.dll","shlwapi.dll","cryptsp.dll","nsi.dll","secur32.dll","ntmarta.dll","iertutil.dll","winmm.dll","d3d11.dll","jscript9.dll","api-ms-win-downlevel-normaliz-l1-1-0.dll","deploy.dll","linkinfo.dll","sechost.dll","MSOHEV.DLL","ieframe.dll","netutils.dll","wininet.dll","api-ms-win-downlevel-advapi32-l2-1-0.dll","ole32.dll","dhcpcsvc.dll","lpk.dll","ntshrui.dll","URLREDIR.DLL","cryptnet.dll","IEShims.dll","comctl32.dll","rsaenh.dll","WSHTCPIP.DLL","sxs.dll","IPHLPAPI.DLL","RpcRtRemote.dll","usp10.dll","SensApi.dll","advapi32.dll","webio.dll","wkscli.dll","WindowsCodecsExt.dll","api-ms-win-downlevel-version-l1-1-0.dll","msxml6r.dll","wship6.dll","imagehlp.dll","propsys.dll","uxtheme.dll","ieui.dll","setupapi.dll","imm32.dll","mswsock.dll","ws2_32.dll","msxml6.dll","oleacc.dll","msimtf.dll","wshqos.dll","apphelp.dll","sspicli.dll","api-ms-win-core-synch-l1-2-0.dll","wintrust.dll","sqmapi.dll","samlib.dll","FWPUCLNT.DLL","devobj.dll","api-ms-win-downlevel-advapi32-l1-1-0.dll","winhttp.dll","Wldap32.dll","dnsapi.dll","jp2ssv.dll","srvcli.dll","user32.dll","rpcss.dll","dui70.dll","netprofm.dll","cscapi.dll","msctf.dll","mscoree.dll","SwDir_1231201.dll","cryptbase.dll","shell32.dll","oleaut32.dll","d3d10warp.dll","rpcrt4.dll","api-ms-win-downlevel-ole32-l1-1-0.dll","slc.dll","userenv.dll","gpapi.dll","bcryptprimitives.dll","WindowsCodecs.dll","normaliz.dll","msvcr100.dll","msasn1.dll","msimg32.dll","mscoreei.dll","gdi32.dll","DWrite.dll","netapi32.dll","dwmapi.dll","t2embed.dll","mscorwks.dll","KernelBase.dll","profapi.dll","rasadhlp.dll","ssv.dll","Wpc.dll","xmllite.dll","ncrypt.dll","ExplorerFrame.dll","duser.dll","npmproxy.dll","npctrl.dll","api-ms-win-downlevel-shlwapi-l1-1-0.dll","urlmon.dll","oleaccrc.dll","wevtapi.dll","samcli.dll","msvcr90.dll","kernel32.dll","api-ms-win-downlevel-shlwapi-l2-1-0.dll","version.dll","clbcatq.dll","ieproxy.dll","api-ms-win-downlevel-user32-l1-1-0.dll","dhcpcsvc6.dll","nlaapi.dll","bcrypt.dll","cfgmgr32.dll","msvcrt.dll","credssp.dll","crypt32.dll","api-ms-win-downlevel-shell32-l1-1-0.dll"],"processes":[{"command_line":"\"%WINDIR%\\System32\\ieframe.dll\",OpenURL C:\\3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb.url","icon":"$22","name":"rundll32.exe","normalized_path":"%WINDIR%\\System32\\rundll32.exe","pid":3592,"ppid":0,"sha256":"3fa4912eb43fc304652d7b01f118589259861e2d628fa7c86193e54d5f987670","uid":"00064122-00003592"},{"command_line":"https://engsci.utoronto.ca/forums/topic/123movies-watch-demon-slayer-the-movie-2020-online-full-hd-download/","name":"iexplore.exe","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00064122-00003592","pid":3672,"ppid":3592,"sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","uid":"00064278-00003672"},{"command_line":"SCODEF:3672 CREDAT:275457 /prefetch:2","name":"iexplore.exe","normalized_path":"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe","parent_uid":"00064278-00003672","pid":3816,"ppid":3672,"sha256":"8abc7daa81c8a20bfd88b6a60ecc9ed1292fbb6cedbd6f872f36512d9a194bba","uid":"00064304-00003816"}],"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},"registry_activity":{"keys_created":[],"keys_deleted":[{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\{0C70BB6D-CFA8-4734-A158-28619E142726}\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\TABBEDBROWSING\\NEWTABPAGE\\MFV\\MFV","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFAVORITESINITIALSELECTION\\ADDTOFAVORITESINITIALSELECTION","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYOVERRIDE\\PROXYOVERRIDE","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTOCONFIGURL\\AUTOCONFIGURL","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\AUTODETECT\\AUTODETECT","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\RECOVERY\\ADMINACTIVE\\{00000000-0000-0000-0000-000000000000}\\{00000000-0000-0000-0000-000000000000}","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\WPAD\\AC-1F-6B-0D-DB-84\\WPADDETECTEDURL\\WPADDETECTEDURL","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\PROXYBYPASS\\PROXYBYPASS","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\D1EB23A46D17D68FD92564C2F1F1601764D8E349\\D1EB23A46D17D68FD92564C2F1F1601764D8E349","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\PROXYSERVER\\PROXYSERVER","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\WINDOWS\\CURRENTVERSION\\INTERNET SETTINGS\\ZONEMAP\\INTRANETNAME\\INTRANETNAME","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKLM\\SOFTWARE\\MICROSOFT\\SYSTEMCERTIFICATES\\AUTHROOT\\CERTIFICATES\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4\\DF3C24F9BFD666761B268073FE06D1CC8D4F82A4","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"key":"HKCU\\SOFTWARE\\MICROSOFT\\INTERNET EXPLORER\\LOWREGISTRY\\ADDTOFEEDSINITIALSELECTION\\ADDTOFEEDSINITIALSELECTION","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]}],"keys_modified":[]},"sample_flags":["User Comment","Decrypted SSL traffic","Network Traffic","Extracted Files"],"sandbox_reports":[{"analysis_start_time":"2020-12-28T22:06:13+00:00","contacted_countries":["CAN","USA"],"environment_description":"Windows 7 32 bit","environment_id":100,"id":"5fea56ce9919da515a693b7f","indicators_count":{"informative":14,"malicious":0,"suspicious":1},"is_in_unified_schema":true,"state":"SUCCESS","submit_name":"3024ce3117b756f9ef04179b1144b8818b0e58b5f1ef3ced6cb72673b0a944eb.url","tags":["Network Traffic","Extracted Files","User Comment","Decrypted SSL traffic"],"verdict":"no specific threat"}],"stats":{"contacted_hosts_count":9,"contacted_urls_count":7,"dns_resolutions_count":9,"dropped_files_count":0,"embedded_domains_count":0,"embedded_ips_count":0,"embedded_urls_count":0,"extracted_files_count":50,"files_deleted_count":0,"files_written_count":227,"http_requests_count":7,"imported_dlls_count":136,"injected_processes_count":0,"mutex_created_count":27,"process_count":3,"registry_keys_created_count":0,"registry_keys_deleted_count":16,"registry_keys_modified_count":0,"registry_keys_opened_count":0,"registry_keys_queried_count":0,"registry_operations_count":16,"script_calls_count":0,"spawned_processes_count":3}},"all_analysis_status":{"fastscan_status":"SUCCESS","qsp_status":"NOT_AVAILABLE","sandbox_status":"SUCCESS"},"detections":{"attributions":{},"av_detections":{"engines":{"cleandns":{"data_source":"CleanDNS","extra_fields":[{"name":"domain","value":"engsci.utoronto.ca"},{"name":"percent","value":0},{"name":"reports_count","value":0}],"name":"CleanDNS","permalink":"https://www.cleandns.com/","progress":100,"status":"no-result","success":true,"verdict":"undetected"},"scamadviser":{"data_source":"ScamAdviser","extra_fields":[{"name":"domain","value":"engsci.utoronto.ca"},{"name":"percent","value":0}],"name":"ScamAdviser","permalink":"https://www.scamadviser.com/?utm_source=hybridanalysis","progress":100,"report_link":"https://www.scamadviser.com/check-website/engsci.utoronto.ca?utm_source=hybridanalysis","status":"clean","success":true,"verdict":"clean"},"urlscanio":{"data_source":"urlscan.io","name":"urlscan.io","permalink":"https://urlscan.io/","progress":100,"status":"no-result","success":true,"verdict":"undetected"}}},"incidents":[{"details":[{"detail":"Contacts 9 domains and 9 hosts"}],"details_count":1,"name":"Network Behavior","sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]}],"mitre_attacks":[{"attack_id":"T1179","attack_id_wiki":"https://attack.mitre.org/techniques/T1179","identifiers":[{"type":"informative","value":"Installs hooks/patches the running process"}],"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"tactic":"Persistence","technique":"Hooking"},{"attack_id":"T1043","attack_id_wiki":"https://attack.mitre.org/techniques/T1043","identifiers":[{"type":"suspicious","value":"Sends traffic on typical HTTP outbound port, but without HTTP header"}],"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}],"tactic":"Command and Control","technique":"Commonly Used Port"}],"rule_matches":{},"sandbox_signatures":[{"category":"General","description":"\"142.1.176.180:443\"\n \"142.1.176.100:443\"\n \"216.58.192.234:443\"\n \"192.0.73.2:443\"\n \"172.217.6.3:80\"\n \"172.217.0.14:443\"\n \"108.177.111.156:443\"\n \"172.217.4.195:443\"\n \"192.0.77.48:443\"","id":"network-1","level":"informative","name":"Contacts server","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"External Systems","description":"Detected alert \"ET USER_AGENTS Microsoft Device Metadata Retrieval Client User-Agent\" (SID: 2027390, Rev: 3, Severity: 3) categorized as \"Unknown Traffic\"\n Detected alert \"ET INFO Windows OS Submitting USB Metadata to Microsoft\" (SID: 2025275, Rev: 3, Severity: 3) categorized as \"Misc activity\"","id":"suricata-0","level":"informative","name":"Detected Suricata Alert","origin":"Suricata Alerts","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"Process \"iexplore.exe\" (UID: 00064278-00003672) was launched with new environment variables: \"PATH=\"%PROGRAMFILES%\\Internet Explorer;\"\"","id":"target-67","level":"informative","name":"Process launched with changed environment","origin":"Monitored Target","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"iexplore.exe\" with commandline \"https://engsci.utoronto.ca/forums/topic/123movies-watch-demon-sl ...\" (UID: 00064278-00003672)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3672 CREDAT:275457 /prefetch:2\" (UID: 00064304-00003816)","id":"target-103","level":"informative","name":"Spawns new processes that are not known child processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"\"iexplore.exe\" is creating a new process (Name: \"%PROGRAMFILES%\\Internet Explorer\\iexplore.exe\", Handle: 896)","id":"api-2","level":"informative","name":"Creates new processes","origin":"API Call","relevance":8,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Network Related","description":"$23","id":"string-3","level":"informative","name":"Found potential URL in binary/memory","origin":"File/Memory","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"$24","id":"hooks-8","level":"informative","mitre_attack_id":"T1179","name":"Installs hooks/patches the running process","origin":"Hook Detection","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"\"ocsp.sectigo.com\"\n \"ocsp.pki.goog\"\n \"engsci.utoronto.ca\"\n \"fonts.googleapis.com\"\n \"fonts.gstatic.com\"\n \"s.w.org\"\n \"secure.gravatar.com\"\n \"staging.engsci.utoronto.ca\"\n \"stats.g.doubleclick.net\"","id":"network-0","level":"informative","name":"Contacts domains","origin":"Network Traffic","relevance":1,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"Antivirus vendors marked dropped file \"1f642_1_.svg\" as clean (type is \"ASCII text with very long lines with no line terminators\")\n Antivirus vendors marked dropped file \"urlblockindex_1_.bin\" as clean (type is \"data\")\n Antivirus vendors marked dropped file \"1f534_1_.svg\" as clean (type is \"ASCII text with no line terminators\")","id":"binary-16","level":"informative","name":"Drops files marked as clean","origin":"Binary File","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Installation/Persistence","description":"$25","id":"binary-0","level":"informative","name":"Dropped files","origin":"Binary File","relevance":3,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Unusual Characteristics","description":"\"57C8EDB95DF3F0AD4EE2DC2B8CFD4157\" has type \"Microsoft Cabinet archive data 4795 bytes 1 file\"","id":"binary-5","level":"informative","name":"Drops cabinet archive files","origin":"Binary File","relevance":10,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"\"\\Sessions\\1\\BaseNamedObjects\\IsoScope_e58_IESQMMUTEX_0_519\"\n \"Local\\InternetShortcutMutex\"\n \"IsoScope_e58_IESQMMUTEX_0_519\"\n \"IsoScope_e58_IESQMMUTEX_0_331\"\n \"Local\\VERMGMTBlockListFileMutex\"\n \"Local\\URLBLOCK_DOWNLOAD_MUTEX\"\n \"Local\\!BrowserEmulation!SharedMemory!Mutex\"\n \"IsoScope_e58_IESQMMUTEX_0_303\"\n \"{5312EE61-79E3-4A24-BFE1-132B85B23C3A}\"\n \"UpdatingNewTabPageData\"\n \"IsoScope_e58_ConnHashTable<3672>_HashTable_Mutex\"\n \"IsoScope_e58_IE_EarlyTabStart_0xd20_Mutex\"\n \"Local\\ZonesCacheCounterMutex\"\n \"Local\\URLBLOCK_FILEMAPSWITCH_MUTEX_3672\"\n \"Local\\ZonesLockedCacheCounterMutex\"\n \"Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"{66D0969A-1E86-44CF-B4EC-3806DDDA3B5D}\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\URLBLOCK_HASHFILESWITCH_MUTEX\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesCacheCounterMutex\"\n \"\\Sessions\\1\\BaseNamedObjects\\Local\\ZonesLockedCacheCounterMutex\"","id":"mutant-0","level":"informative","name":"Creates mutants","origin":"Created Mutant","relevance":3,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"General","description":"Spawned process \"iexplore.exe\" with commandline \"https://engsci.utoronto.ca/forums/topic/123movies-watch-demon-sl ...\" (UID: 00064278-00003672)\n Spawned process \"iexplore.exe\" with commandline \"SCODEF:3672 CREDAT:275457 /prefetch:2\" (UID: 00064304-00003816)","id":"target-25","level":"informative","name":"Spawns new processes","origin":"Monitored Target","relevance":3,"sources":[{"report_id":"5fea56ce9919da515a693b7f","report_type":"sandbox"}]},{"category":"Spyware/Information Retrieval","description":"\"to.ca/news-events/calendar/\">Events\n\n\n

Division of Engineering Science
\nUniversity of Toronto
\nRoom 2110\n 40 St. George Street Toronto\n Ontario M5S 2E4 Canada

.col-xs-12 .col-sm-6 -->\n\n .row -->\n .col-sm-6 -->\n\n