Play interactive tour

Edit tour

Analysis Report https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157

Overview

General Information

Sample URL:	https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157
Analysis ID:	336936
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	80%

Signatures

Found iframes

HTML body contains low number of good links

Classification

Startup

System is w10x64

iexplore.exe (PID: 6788 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 6844 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&co=aHR0cHM6Ly93d3cuZWNvcm5lbGwuY29tOjQ0Mw..&hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&size=invisible&cb=u2bgs6aek2zb
Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: //www.ecornell.com/hidden-pages/header-only/
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&co=aHR0cHM6Ly93d3cuZWNvcm5lbGwuY29tOjQ0Mw..&hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&size=invisible&cb=2ismcxjdh4gh
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Iframe src: //www.ecornell.com/hidden-pages/header-only/
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html
Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&co=aHR0cHM6Ly93d3cuZWNvcm5lbGwuY29tOjQ0Mw..&hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&size=invisible&cb=u2bgs6aek2zb
Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: //www.ecornell.com/hidden-pages/header-only/
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Iframe src: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&co=aHR0cHM6Ly93d3cuZWNvcm5lbGwuY29tOjQ0Mw..&hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B&size=invisible&cb=2ismcxjdh4gh
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Iframe src: //www.ecornell.com/hidden-pages/header-only/
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Iframe src: https://js.driftt.com/deploy/assets/index.html

Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Number of links: 1
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Number of links: 0
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: Number of links: 1
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: Number of links: 0

Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: No <meta name="author".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: No <meta name="author".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: No <meta name="author".. found
Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: No <meta name="author".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: No <meta name="author".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: No <meta name="author".. found

Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: No <meta name="copyright".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: No <meta name="copyright".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: No <meta name="copyright".. found
Source: https://www.ecornell.com/about-ecornell/help/	HTTP Parser: No <meta name="copyright".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	HTTP Parser: No <meta name="copyright".. found
Source: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	HTTP Parser: No <meta name="copyright".. found

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Source: unknown	HTTPS traffic detected: 18.235.114.243:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.235.114.243:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.2.32:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.2.32:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.136.157:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.136.157:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.2:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.2:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.23.202.249:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.23.202.249:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.130:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.130:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.63.145.5:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.63.145.5:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.5:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.5:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.219.88:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.219.88:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.162:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.162:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.133:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.133:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.99:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.99:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.202.69.186:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.202.69.186:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.91:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.91:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.174.151.106:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.174.151.106:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49820 version: TLS 1.2

Source: global traffic

HTTP traffic detected: GET /about-ecornell/help/ HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.ecornell.comConnection: Keep-AliveCookie: __utmc=97568779; __utmz=97568779.1610016408.1.1.utmcsr=(direct)|utmccn=(direct)|utmcmd=(none); __utma=97568779.232816534.1610016408.1610016408.1610016408.1; __utmb=97568779.1.10.1610016408; login-checked=%7B%22isStudentLogon%22%3A%22no%22%2C%22studentLogonUrl%22%3A%22%2Fportal%2Flogon.do%3Fmethod%3Dload%22%2C%22studentLogoutUrl%22%3A%22%2Fportal%2Flogon.do%3Fmethod%3Dload%22%2C%22currentActiveShoppingPathPage%22%3A%22%22%2C%22currentActiveStudentPortalPage%22%3A%22%22%2C%22currentActiveAdminPortalPage%22%3A%22%22%2C%22studentName%22%3A%22%22%2C%22numCartItems%22%3A%220%22%2C%22personId%22%3A%22%22%7D; __utmt=1; driftt_aid=3ab2b37c-632e-425d-a48a-9ef0eb27d4ff

Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"1564543307137132\");fbq(\"track\",\"PageView\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=1564543307137132\u0026amp;ev=PageView\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E", equals www.facebook.com (Facebook)
Source: gtm[1].js.2.dr	String found in binary or memory: "vtp_html":"\u003Cscript type=\"text\/gtmscript\"\u003E!function(b,e,f,g,a,c,d){b.fbq\|\|(a=b.fbq=function(){a.callMethod?a.callMethod.apply(a,arguments):a.queue.push(arguments)},b._fbq\|\|(b._fbq=a),a.push=a,a.loaded=!0,a.version=\"2.0\",a.queue=[],c=e.createElement(f),c.async=!0,c.src=g,d=e.getElementsByTagName(f)[0],d.parentNode.insertBefore(c,d))}(window,document,\"script\",\"https:\/\/connect.facebook.net\/en_US\/fbevents.js\");fbq(\"init\",\"1564543307137132\");fbq(\"track\",\"PageView\");fbq(\"track\",\"Lead\");\u003C\/script\u003E\n\u003Cnoscript\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=1564543307137132\u0026amp;ev=PageView\u0026amp;noscript=1\"\u003E\u003Cimg height=\"1\" width=\"1\" style=\"display:none\" src=\"https:\/\/www.facebook.com\/tr?id=1564543307137132\u0026amp;ev=Lead\u0026amp;noscript=1\"\u003E\u003C\/noscript\u003E\n", equals www.facebook.com (Facebook)
Source: help[1].htm0.2.dr	String found in binary or memory: })();</script> <!-- All in One SEO Pack 3.3.5 by Michael Torbert of Semper Fi Web Designob_start_detected [-1,-1] --><meta name="description" content="eCornell takes pride in the level of help and support we offer our students and partners. New to eCornell? Check out our FAQ. Find answers to general questions" /> <script type="application/ld+json" class="aioseop-schema">{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.ecornell.com/#organization","url":"https://www.ecornell.com/","name":"eCornell","sameAs":[]},{"@type":"WebSite","@id":"https://www.ecornell.com/#website","url":"https://www.ecornell.com/","name":"eCornell","publisher":{"@id":"https://www.ecornell.com/#organization"}},{"@type":"WebPage","@id":"https://www.ecornell.com/about-ecornell/help/#webpage","url":"https://www.ecornell.com/about-ecornell/help/","inLanguage":"en-US","name":"Help","isPartOf":{"@id":"https://www.ecornell.com/#website"},"datePublished":"2013-05-01T13:26:54+00:00","dateModified":"2020-02-12T19:04:05+00:00"}]}</script> <!-- All in One SEO Pack --><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//www.youtube.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="eCornell » Help Comments Feed" href="https://www.ecornell.com/about-ecornell/help/feed/" /><link rel='stylesheet' id='lc-switch-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/lc_switch.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='bs3-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/bootstrap.min.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='animate-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/animate.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='ecornell-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/style.css?ver=1608654674' type='text/css' media='all' /><link rel='stylesheet' id='acf-fonticonpicker-icons-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css?ver=5.5.3' type='text/css' media='all' /> <script type='text/javascript' src='https://www.ecornell.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp' id='jquery-core-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp' id='jquery-migrate-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery-cookie.min.js' id='jquery-cookie-js-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/ecustom-embed/js/ecustom-embed.min.js?v=2' id='ecustom-embed-js'></script> <script type='text/javascript' src='https://www.youtube.com/iframe_api' id='yt-api-js'></script> <script type='text/javascript' id='ajax-t
Source: header-only[1].htm.2.dr	String found in binary or memory: })();</script> <!-- All in One SEO Pack 3.3.5 by Michael Torbert of Semper Fi Web Designob_start_detected [-1,-1] --><meta name="robots" content="noindex,nofollow" /> <script type="application/ld+json" class="aioseop-schema">{"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://www.ecornell.com/#organization","url":"https://www.ecornell.com/","name":"eCornell","sameAs":[]},{"@type":"WebSite","@id":"https://www.ecornell.com/#website","url":"https://www.ecornell.com/","name":"eCornell","publisher":{"@id":"https://www.ecornell.com/#organization"}},{"@type":"WebPage","@id":"https://www.ecornell.com/hidden-pages/header-only/#webpage","url":"https://www.ecornell.com/hidden-pages/header-only/","inLanguage":"en-US","name":"Header Only","isPartOf":{"@id":"https://www.ecornell.com/#website"},"datePublished":"2013-12-07T01:03:30+00:00","dateModified":"2016-10-21T21:35:38+00:00"}]}</script> <!-- All in One SEO Pack --><link rel='dns-prefetch' href='//www.google.com' /><link rel='dns-prefetch' href='//www.youtube.com' /><link rel='dns-prefetch' href='//s.w.org' /><link rel="alternate" type="application/rss+xml" title="eCornell » Header Only Comments Feed" href="https://www.ecornell.com/hidden-pages/header-only/feed/" /><link rel='stylesheet' id='lc-switch-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/lc_switch.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='bs3-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/bootstrap.min.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='animate-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/css/animate.css?ver=1539886788' type='text/css' media='all' /><link rel='stylesheet' id='ecornell-style-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/style.css?ver=1608654674' type='text/css' media='all' /><link rel='stylesheet' id='acf-fonticonpicker-icons-css' href='https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css?ver=5.5.3' type='text/css' media='all' /> <script type='text/javascript' src='https://www.ecornell.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp' id='jquery-core-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp' id='jquery-migrate-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery-cookie.min.js' id='jquery-cookie-js-js'></script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/ecustom-embed/js/ecustom-embed.min.js?v=2' id='ecustom-embed-js'></script> <script type='text/javascript' src='https://www.youtube.com/iframe_api' id='yt-api-js'></script> <script type='text/javascript' id='ajax-test-js-extra'>/* <![CDATA[ */ equals www.youtube.com (Youtube)
Source: 1564543307137132[1].js.2.dr	String found in binary or memory: (function(a,b,c,d){var e={exports:{}};e.exports;(function(){var f=a.fbq;f.execStart=a.performance&&a.performance.now&&a.performance.now();if(!function(){var b=a.postMessage\|\|function(){};if(!f){b({action:"FB_LOG",logType:"Facebook Pixel Error",logMessage:"Pixel code is not installed correctly on this page"},"");"error"in console&&console.error("Facebook Pixel Error: Pixel code is not installed correctly on this page");return!1}return!0}())return;f.__fbeventsModules\|\|(f.__fbeventsModules={},f.__fbeventsResolvedModules={},f.getFbeventsModules=function(a){f.__fbeventsResolvedModules[a]\|\|(f.__fbeventsResolvedModules[a]=f.__fbeventsModules[a]());return f.__fbeventsResolvedModules[a]},f.fbIsModuleLoaded=function(a){return!!f.__fbeventsModules[a]},f.ensureModuleRegistered=function(b,a){f.fbIsModuleLoaded(b)\|\|(f.__fbeventsModules[b]=a)});f.ensureModuleRegistered("signalsFBEventsGetIwlUrl",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=f.getFbeventsModules("signalsFBEventsGetTier");e.exports=function(b,c){c=a(c);c=c==null?"www.facebook.com":"www."+c+".facebook.com";return"https://"+c+"/signals/iwl.js?pixel_id="+b}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("signalsFBEventsGetTier",function(){return function(f,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var a=/^https:\/\/www\.([A-Za-z0-9\.]+)\.facebook\.com\/tr\/?$/,b=["https://www.facebook.com/tr","https://www.facebook.com/tr/"];e.exports=function(c){if(b.indexOf(c)!==-1)return null;var d=a.exec(c);if(d==null)throw new Error("Malformed tier: "+c);return d[1]}})();return e.exports}(a,b,c,d)});f.ensureModuleRegistered("SignalsFBEvents.plugins.iwlbootstrapper",function(){return function(a,b,c,d){var e={exports:{}};e.exports;(function(){"use strict";var c=f.getFbeventsModules("SignalsFBEventsIWLBootStrapEvent"),d=f.getFbeventsModules("SignalsFBEventsLogging"),g=f.getFbeventsModules("SignalsFBEventsNetworkConfig"),h=f.getFbeventsModules("SignalsFBEventsPlugin"),i=f.getFbeventsModules("signalsFBEventsGetIwlUrl"),j=f.getFbeventsModules("signalsFBEventsGetTier"),k=d.logUserError,l=/^https:\/\/.\.facebook\.com$/i,m="FACEBOOK_IWL_CONFIG_STORAGE_KEY",n=a.sessionStorage?a.sessionStorage:{getItem:function(a){return null},removeItem:function(a){},setItem:function(a,b){}};e.exports=new h(function(d,e){function h(c,d){var e=b.createElement("script");e.async=!0;e.onload=function(){if(!a.FacebookIWL\|\|!a.FacebookIWL.init)return;var b=j(g.ENDPOINT);b!=null&&a.FacebookIWL.set&&a.FacebookIWL.set("tier",b);d()};a.FacebookIWLSessionEnd=function(){n.removeItem(m),a.close()};e.src=i(c,g.ENDPOINT);b.body&&b.body.appendChild(e)}var o=!1,p=function(a){return!!(e&&e.pixelsByID&&Object.prototype.hasOwnProperty.call(e.pixelsByID,a))};function q(){if(o)return;var b=n.getItem(m);if(!b)return;b=JSON.parse(b);var c=b.pixelID,d=b.graphToken,e=b.sessionStartTime;o=!0;h(c,function(){var b=p(c)?c:null;a.FacebookIWL.init(b,d,e)})}function r(b){if(o)return;h(b,func
Source: header-only[1].htm.2.dr	String found in binary or memory: /* ]]> */</script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js?ver=5.5.3' id='ajax-test-js'></script> <link rel="https://api.w.org/" href="https://www.ecornell.com/wp-json/" /><link rel="alternate" type="application/json" href="https://www.ecornell.com/wp-json/wp/v2/pages/3592" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.ecornell.com/xmlrpc.php?rsd" /><link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://www.ecornell.com/wp-includes/wlwmanifest.xml" /><link rel="canonical" href="https://www.ecornell.com/hidden-pages/header-only/" /><link rel='shortlink' href='https://www.ecornell.com/?p=3592' /><link rel="alternate" type="application/json+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%2Fheader-only%2F" /><link rel="alternate" type="text/xml+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%2Fheader-only%2F&format=xml" /> <!-- Facebook Open Graph Tags --><meta property="og:type" content="website" /><meta property="og:title" content="Header Only" /><meta property="og:url" content="https://www.ecornell.com/hidden-pages/header-only/" /><meta property="og:description" content="" /><meta property="og:site_name" content="eCornell" /> <!-- Twitter Card --><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="Header Only" /><meta name="twitter:site" content="@webadmin" /><meta name="twitter:description" content="" /><!-- equals www.facebook.com (Facebook)
Source: header-only[1].htm.2.dr	String found in binary or memory: /* ]]> */</script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js?ver=5.5.3' id='ajax-test-js'></script> <link rel="https://api.w.org/" href="https://www.ecornell.com/wp-json/" /><link rel="alternate" type="application/json" href="https://www.ecornell.com/wp-json/wp/v2/pages/3592" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.ecornell.com/xmlrpc.php?rsd" /><link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://www.ecornell.com/wp-includes/wlwmanifest.xml" /><link rel="canonical" href="https://www.ecornell.com/hidden-pages/header-only/" /><link rel='shortlink' href='https://www.ecornell.com/?p=3592' /><link rel="alternate" type="application/json+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%2Fheader-only%2F" /><link rel="alternate" type="text/xml+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%2Fheader-only%2F&format=xml" /> <!-- Facebook Open Graph Tags --><meta property="og:type" content="website" /><meta property="og:title" content="Header Only" /><meta property="og:url" content="https://www.ecornell.com/hidden-pages/header-only/" /><meta property="og:description" content="" /><meta property="og:site_name" content="eCornell" /> <!-- Twitter Card --><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="Header Only" /><meta name="twitter:site" content="@webadmin" /><meta name="twitter:description" content="" /><!-- equals www.twitter.com (Twitter)
Source: help[1].htm0.2.dr	String found in binary or memory: /* ]]> */</script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js?ver=5.5.3' id='ajax-test-js'></script> <link rel="https://api.w.org/" href="https://www.ecornell.com/wp-json/" /><link rel="alternate" type="application/json" href="https://www.ecornell.com/wp-json/wp/v2/pages/957" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.ecornell.com/xmlrpc.php?rsd" /><link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://www.ecornell.com/wp-includes/wlwmanifest.xml" /><link rel="canonical" href="https://www.ecornell.com/about-ecornell/help/" /><link rel='shortlink' href='https://www.ecornell.com/?p=957' /><link rel="alternate" type="application/json+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornell%2Fhelp%2F" /><link rel="alternate" type="text/xml+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornell%2Fhelp%2F&format=xml" /> <!-- Facebook Open Graph Tags --><meta property="og:type" content="website" /><meta property="og:title" content="Help" /><meta property="og:url" content="https://www.ecornell.com/about-ecornell/help/" /><meta property="og:description" content="" /><meta property="og:site_name" content="eCornell" /> <!-- Twitter Card --><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="Help" /><meta name="twitter:site" content="@webadmin" /><meta name="twitter:description" content="" /> <!-- Start of Async Drift Code --> <script>"use strict"; equals www.facebook.com (Facebook)
Source: help[1].htm0.2.dr	String found in binary or memory: /* ]]> */</script> <script type='text/javascript' src='https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js?ver=5.5.3' id='ajax-test-js'></script> <link rel="https://api.w.org/" href="https://www.ecornell.com/wp-json/" /><link rel="alternate" type="application/json" href="https://www.ecornell.com/wp-json/wp/v2/pages/957" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://www.ecornell.com/xmlrpc.php?rsd" /><link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://www.ecornell.com/wp-includes/wlwmanifest.xml" /><link rel="canonical" href="https://www.ecornell.com/about-ecornell/help/" /><link rel='shortlink' href='https://www.ecornell.com/?p=957' /><link rel="alternate" type="application/json+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornell%2Fhelp%2F" /><link rel="alternate" type="text/xml+oembed" href="https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornell%2Fhelp%2F&format=xml" /> <!-- Facebook Open Graph Tags --><meta property="og:type" content="website" /><meta property="og:title" content="Help" /><meta property="og:url" content="https://www.ecornell.com/about-ecornell/help/" /><meta property="og:description" content="" /><meta property="og:site_name" content="eCornell" /> <!-- Twitter Card --><meta name="twitter:card" content="summary" /><meta name="twitter:title" content="Help" /><meta name="twitter:site" content="@webadmin" /><meta name="twitter:description" content="" /> <!-- Start of Async Drift Code --> <script>"use strict"; equals www.twitter.com (Twitter)
Source: www-widgetapi[1].js.2.dr	String found in binary or memory: ;var ph=new Set,qh=0,rh=0,sh=["PhantomJS","Googlebot","TO STOP THIS SECURITY SCAN go/scan"];function Y(a,b,c){this.o=this.h=this.i=null;this.m=Ba(this);this.j=0;this.u=!1;this.s=[];this.l=null;this.F=c;this.H={};c=document;if(a="string"===typeof a?c.getElementById(a):a)if(c="iframe"==a.tagName.toLowerCase(),b.host\|\|(b.host=c?Ub(a.src):"https://www.youtube.com"),this.i=new Xe(b),c\|\|(b=th(this,a),this.o=a,(c=a.parentNode)&&c.replaceChild(b,a),a=b),this.h=a,this.h.id\|\|(this.h.id="widget"+Ba(this.h)),Re[this.h.id]=this,window.postMessage){this.l=new P;uh(this);b=R(this.i,"events");for(var d in b)b.hasOwnProperty(d)&& equals www.youtube.com (Youtube)
Source: login[1].htm.2.dr	String found in binary or memory: <script type='text/javascript' src='https://www.youtube.com/iframe_api'></script> equals www.youtube.com (Youtube)
Source: header-only[1].htm.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template page-template-header-only page-template-header-only-php page page-id-3592 page-child parent-pageid-1724 header-only ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.facebook.com (Facebook)
Source: header-only[1].htm.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template page-template-header-only page-template-header-only-php page page-id-3592 page-child parent-pageid-1724 header-only ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.linkedin.com (Linkedin)
Source: header-only[1].htm.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template page-template-header-only page-template-header-only-php page page-id-3592 page-child parent-pageid-1724 header-only ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.twitter.com (Twitter)
Source: header-only[1].htm.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template page-template-header-only page-template-header-only-php page page-id-3592 page-child parent-pageid-1724 header-only ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.youtube.com (Youtube)
Source: help[1].htm0.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template-default page page-id-957 page-parent page-child parent-pageid-660 ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.facebook.com (Facebook)
Source: help[1].htm0.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template-default page page-id-957 page-parent page-child parent-pageid-660 ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.linkedin.com (Linkedin)
Source: help[1].htm0.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template-default page page-id-957 page-parent page-child parent-pageid-660 ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.twitter.com (Twitter)
Source: help[1].htm0.2.dr	String found in binary or memory: Tracking Code. --><meta name="google-site-verification" content="P4JUXqGB58gHckPVuGBJUvCFkJZQyTwJ1iKppEfwGBk"/><link rel="shortcut icon" href="https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png" /></head><body class="page-template-default page page-id-957 page-parent page-child parent-pageid-660 ecornell-www"> <!--<div class="loader"></div>--> <script>var catalogDown = '';</script> <script type="application/ld+json">{"@context": "http://schema.org","@type" : ["WebSite", "EducationalOrganization"],"logo": "https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg", "name": "eCornell","url": "https://www.ecornell.com", "sameAs": [ "https://www.facebook.com/ecornell", "https://twitter.com/ecornell_online", "https://www.youtube.com/user/eCornellOnline", "https://www.linkedin.com/company/ecornell/"],"contactPoint": [{"@type": "ContactPoint","telephone": "+1-866-326-7635", "contactOption" : "TollFree","contactType": "customer support"}]}</script> <!-- Header Navigation Section --> <a class="skip-link sr-only" href="#mainContent">Skip to content</a><div class="visible-print-block" aria-hidden="true"><img alt="eCornell logo" class="center-block" src="https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png" style="width:150px !important; margin-bottom:30px;" /></div><header role="banner" id="navHeader" data-destiny-pv="https://portal.ecornell.com" class="hidden-print"> <script>var promoBanners = []; equals www.youtube.com (Youtube)
Source: iframe_api[1].js.2.dr	String found in binary or memory: var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/5dd3f3b2\/www-widgetapi.vflset\/www-widgetapi.js';if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"}; equals www.youtube.com (Youtube)

Source: unknown

DNS traffic detected: queries for: lms.ecornell.com

Source: rhfnkn45i93k[1].js.2.dr	String found in binary or memory: http://allyoucanleet.com/
Source: jquery.hoverIntent[1].js.2.dr	String found in binary or memory: http://briancherne.github.io/jquery-hoverIntent/
Source: jquery-migrate-1.4.1-wp[1].js.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/11820
Source: jquery-migrate-1.4.1-wp[1].js.2.dr	String found in binary or memory: http://bugs.jquery.com/ticket/13335
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://code.google.com/apis/ajaxsearch/faq.html
Source: animate[1].css.2.dr	String found in binary or memory: http://daneden.me/animate
Source: style[1].css.2.dr	String found in binary or memory: http://freire-design.com
Source: bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: http://gmpg.org/xfn/11
Source: vendors-widget-8f96283c571fdb07659e[1].js.2.dr	String found in binary or memory: http://jedwatson.github.io/classnames
Source: qevents[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/BSD-2-Clause
Source: qevents[1].js.2.dr	String found in binary or memory: http://opensource.org/licenses/GPL-2.0
Source: animate[1].css.2.dr	String found in binary or memory: http://opensource.org/licenses/MIT
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: http://schema.org
Source: KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr, KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: style[1].css.2.dr	String found in binary or memory: http://www.ecornell.com
Source: login[1].htm.2.dr	String found in binary or memory: http://www.ecornell.com/about-ecornell/help/
Source: ga[1].js.2.dr	String found in binary or memory: http://www.google-analytics.com
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://www.google.com
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://www.google.com/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: http://www.google.com/support/websearch/bin/answer.py?hl=
Source: js[1].js.2.dr	String found in binary or memory: https://ade.googlesyndication.com/ddm/activity
Source: js[1].js0.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: async-ads[1].js.2.dr	String found in binary or memory: https://ajax.googleapis.com/ajax
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://api.w.org/
Source: rhfnkn45i93k[1].json.2.dr	String found in binary or memory: https://app.drift.com
Source: {A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://auth-ex.ecorne
Source: imagestore.dat.2.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/favicon.ico~
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactP
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas2
Source: {A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2FcasRoot
Source: {A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcasll.com/ca
Source: f[2].txt.2.dr	String found in binary or memory: https://bid.g.doubleclick.net/xbbe/pixel?d=KAE
Source: rhfnkn45i93k[1].js.2.dr	String found in binary or memory: https://bnjmnt4n.now.sh/
Source: index[1].htm.2.dr	String found in binary or memory: https://cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/normalize.min.css
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/?ref=b&hl=en
Source: header-only[1].htm.2.dr	String found in binary or memory: https://cse.google.com/cse.js?cx=
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/cse/element/v1
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://cse.google.com/cse?cx=
Source: async-ads[1].js.2.dr	String found in binary or memory: https://cse.google.com/uds
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://csqr-autopush.corp.google.com/cse/element/v1
Source: header-only[1].htm.2.dr	String found in binary or memory: https://cuttlefish.ecornell.com/api/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/custom-search/docs/element.
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#are-there-any-qps-or-daily-limits-on-my-use-of-reca
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#localhost_support
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://developers.google.com/recaptcha/docs/faq#my-computer-or-network-may-be-sending-automated-que
Source: www-widgetapi[1].js.2.dr	String found in binary or memory: https://developers.google.com/youtube/iframe_api_reference#Events
Source: rhfnkn45i93k[1].json.2.dr	String found in binary or memory: https://file2.api.drift.com/download/drift-prod-file-uploads/dcac%2Fdcac67bafb3b60352cfef7b1f8877d9c
Source: async-ads[1].js.2.dr	String found in binary or memory: https://fonts.googleapis.com/css
Source: widget-61635a1beb663755fac0[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Lato);
Source: widget-61635a1beb663755fac0[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Open
Source: widget-61635a1beb663755fac0[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Overpass);
Source: style[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Raleway:300
Source: widget-61635a1beb663755fac0[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto
Source: widget-61635a1beb663755fac0[1].css.2.dr	String found in binary or memory: https://fonts.googleapis.com/css?family=Roboto);
Source: css[3].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wWA.woff)
Source: css[2].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff)
Source: css[1].css0.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/overpass/v5/qFdH35WCmI96Ajtm81GlU90.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4TbMDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4VrMDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4WjMDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4Y_LDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4bbLDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4ejLDrMfJg.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVs9pbCIPrc.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVsEpbCIPrc.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVtapbCIPrc.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVuEorCIPrc.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrc.woff)
Source: css[1].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvoorCIPrc.woff)
Source: css[5].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff)
Source: css[4].css.2.dr	String found in binary or memory: https://fonts.gstatic.com/s/robotoslab/v12/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rl.woff)
Source: jquery.animateNumber.min[1].js.2.dr	String found in binary or memory: https://github.com/aishek/jquery-animateNumber
Source: js[1].js0.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: login[1].htm.2.dr	String found in binary or memory: https://go.pardot.com/l/44232/2014-06-19/3pfh
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://goo.gl/Gs1KIc.
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://js.driftt.com/deploy/assets/index.html
Source: rhfnkn45i93k[1].json.2.dr	String found in binary or memory: https://js.driftt.com/embeds/rhfnkn45i93k.json
Source: login[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://js.driftt.com/include/
Source: rhfnkn45i93k[1].json.2.dr	String found in binary or memory: https://js.driftt.com/include/53666519/rhfnkn45i93k.js
Source: header-only[1].htm.2.dr	String found in binary or memory: https://keynotes.ecornell.com/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://lms.ecornell.com/
Source: rhfnkn45i93k[1].js.2.dr	String found in binary or memory: https://mths.be/mit
Source: rhfnkn45i93k[1].js.2.dr	String found in binary or memory: https://mths.be/platform
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://oss.maxcdn.com/libs/html5shiv/3.7.2/html5shiv.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js
Source: js[1].js0.2.dr, gtm[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: gtm[1].js.2.dr, js[1].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://play.google.com/log?format=json&hasfast=true
Source: help[1].htm0.2.dr	String found in binary or memory: https://policies.google.com/privacy
Source: help[1].htm0.2.dr	String found in binary or memory: https://policies.google.com/terms
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://portal.ecornell.com/coursebasket/publicCourseBasket.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/logon.do?method=load&logoff=true
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/logon.do?method=logonExisting
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/applicationInstanceSearch.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentAcademicHistory.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentAccountInfo.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentCertificates.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentHome.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentNews.do?method=load
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentProfile.do?method=edit
Source: header-only[1].htm.2.dr	String found in binary or memory: https://portal.ecornell.com/portal/student/studentViewHelp.do?method=load
Source: insight.min[1].js.2.dr	String found in binary or memory: https://px.ads.linkedin.com/collect?
Source: insight.min[1].js.2.dr	String found in binary or memory: https://px.ads.linkedin.com/insight_tag_errors.gif?
Source: vendors-widget-8f96283c571fdb07659e[1].js.2.dr	String found in binary or memory: https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://schema.org
Source: gtm[1].js.2.dr	String found in binary or memory: https://snap.licdn.com/li.lms-analytics/insight.min.js
Source: ga[1].js.2.dr	String found in binary or memory: https://ssl.google-analytics.com
Source: ga[1].js.2.dr	String found in binary or memory: https://ssl.google-analytics.com/j/__utm.gif
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: ga[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect?
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha#6262736
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/#6175971
Source: recaptcha__en[1].js.2.dr	String found in binary or memory: https://support.google.com/recaptcha/?hl=en#6223828
Source: {A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	String found in binary or memory: https://www.ecornell.c
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/#organization
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/#website
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/?p=3592
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/?p=957
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/about-ecornell/help/
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/about-ecornell/help/#webpage
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://www.ecornell.com/about-ecornell/help/=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPh
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/about-ecornell/help/feed/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/certificates/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/corporate-programs/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/hidden-pages/header-only/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/hidden-pages/header-only/#webpage
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/hidden-pages/header-only/feed/
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/keynotes/
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/plugins/ecustom-embed/js/ecustom-embed.min.js?v=2
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate-1.4.1-wp.
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/css/animate.css?ver=1539886788
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/css/bootstrap.min.css?ver=1539886788
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/css/lc_switch.css?ver=1539886788
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css?ver=5.5.3
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg
Source: imagestore.dat.2.dr, header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18-form.min.js?ver=1607007271
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18-header.min.js?ver=1590674122
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18.min.js?ver=1607023636
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/iframeResizer.min.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery-cookie.min.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.animateNumber.min.js?ver=1539886789
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.resizestop.min.js?ver=1539886789
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/lc_switch.min.js?ver=1539886789
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/unpacked/bootstrap.min.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/js/unpacked/jquery.hoverIntent.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-content/themes/ecustom18/style.css?ver=1608654674
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-includes/wlwmanifest.xml
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-json/
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornel
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%
Source: header-only[1].htm.2.dr	String found in binary or memory: https://www.ecornell.com/wp-json/wp/v2/pages/3592
Source: help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/wp-json/wp/v2/pages/957
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/xmlrpc.php
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.ecornell.com/xmlrpc.php?rsd
Source: js[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/analytics.js
Source: js[1].js0.2.dr	String found in binary or memory: https://www.google-analytics.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: ga[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences?
Source: js[1].js0.2.dr, cse_element__en[1].js.2.dr, gtm[1].js.2.dr, js[1].js.2.dr	String found in binary or memory: https://www.google.com
Source: ga[1].js.2.dr	String found in binary or memory: https://www.google.com/analytics/web/inpage/pub/inpage.js?
Source: f[1].txt0.2.dr	String found in binary or memory: https://www.google.com/cse/static/element/%
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/cse/static/images/1x/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/cse/static/images/2x/
Source: f[1].txt0.2.dr	String found in binary or memory: https://www.google.com/cse/static/style/look/%
Source: recaptcha__en[1].js.2.dr, cse_element__en[1].js.2.dr	String found in binary or memory: https://www.google.com/log?format=json&hasfast=true
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.google.com/pagead/conversion_async.js
Source: header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api.js?render=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&ver=3
Source: recaptcha__en[1].js.2.dr, anchor[1].htm.2.dr, api[1].js.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/
Source: ~DF304FF6C681FB6925.TMP.1.dr	String found in binary or memory: https://www.google.com/recaptcha/api2/anchor?ar=1&k=6LcovgEVAAAAAATgFNyHRpgy3OJ8d_HIFENbjGls&co=aHR0
Source: js[1].js.2.dr	String found in binary or memory: https://www.google.com/travel/flights/click/conversion/
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/customsearch/v1element?key=AIzaSyCVAXiUzRYsML1Pv6RwSG1gunmMikTzQqY&rsz=
Source: cse_element__en[1].js.2.dr	String found in binary or memory: https://www.googleapis.com/generate_204
Source: gtm[1].js.2.dr, js[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: js[1].js.2.dr	String found in binary or memory: https://www.googletraveladservices.com/travel/clk/pagead/conversion/
Source: async-ads[1].js.2.dr	String found in binary or memory: https://www.gstatic.com/images/icons/material/system/1x/location_on_white_18dp.png
Source: webworker[1].js.2.dr, anchor[1].htm.2.dr, api[1].js.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js
Source: anchor[1].htm.2.dr, anchor[1].htm0.2.dr	String found in binary or memory: https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/styles__ltr.css
Source: gtm[1].js.2.dr	String found in binary or memory: https://www.redditstatic.com/ads/pixel.js
Source: iframe_api[1].js.2.dr, www-widgetapi[1].js.2.dr	String found in binary or memory: https://www.youtube.com
Source: login[1].htm.2.dr, header-only[1].htm.2.dr, help[1].htm0.2.dr	String found in binary or memory: https://www.youtube.com/iframe_api

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49800 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49826 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49734
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49732
Source: unknown	Network traffic detected: HTTP traffic on port 49732 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 49820 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49812 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49798 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49727
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49787 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 49734 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49798
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49826
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49825
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49787
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49820
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49786
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49785
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 49727 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49785 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49799 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49810 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49791 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49812
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49811
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49810
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49775
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49802 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49809
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 49773 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49802
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49801
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49800
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49809 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49786 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49775 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443

Source: unknown	HTTPS traffic detected: 18.235.114.243:443 -> 192.168.2.4:49727 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 18.235.114.243:443 -> 192.168.2.4:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49734 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49733 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49732 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.227.175.178:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.2.32:443 -> 192.168.2.4:49752 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 143.204.2.32:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.136.157:443 -> 192.168.2.4:49775 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.4:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.136.157:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 31.13.92.14:443 -> 192.168.2.4:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.2:443 -> 192.168.2.4:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.2:443 -> 192.168.2.4:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.23.202.249:443 -> 192.168.2.4:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 23.23.202.249:443 -> 192.168.2.4:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.130:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.130:443 -> 192.168.2.4:49783 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49786 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.63.145.5:443 -> 192.168.2.4:49785 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.63.145.5:443 -> 192.168.2.4:49784 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 151.101.1.140:443 -> 192.168.2.4:49787 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.4:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.131:443 -> 192.168.2.4:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.5:443 -> 192.168.2.4:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.244.42.5:443 -> 192.168.2.4:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49794 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.154:443 -> 192.168.2.4:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.219.88:443 -> 192.168.2.4:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.219.88:443 -> 192.168.2.4:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.162:443 -> 192.168.2.4:49798 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.162:443 -> 192.168.2.4:49799 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.133:443 -> 192.168.2.4:49801 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 199.232.138.133:443 -> 192.168.2.4:49800 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.99:443 -> 192.168.2.4:49803 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.180.99:443 -> 192.168.2.4:49802 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.202.69.186:443 -> 192.168.2.4:49804 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 52.202.69.186:443 -> 192.168.2.4:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.16.19.94:443 -> 192.168.2.4:49807 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.91:443 -> 192.168.2.4:49809 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.226.169.91:443 -> 192.168.2.4:49810 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.174.151.106:443 -> 192.168.2.4:49811 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 35.174.151.106:443 -> 192.168.2.4:49812 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 3.217.57.115:443 -> 192.168.2.4:49820 version: TLS 1.2

Source: classification engine

Classification label: clean1.win@3/129@27/22

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A055815D-50D5-11EB-90EB-ECF4BBEA1588}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DF482F7CAE3B5C0CF4.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	File and Directory Discovery1	Remote Services	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Default Accounts	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	Application Window Discovery	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157	0%	Virustotal		Browse
https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
platform.twitter.map.fastly.net	0%	Virustotal	Browse
embeds.driftcdn.com	0%	Virustotal	Browse
reddit.map.fastly.net	0%	Virustotal	Browse
www.google.co.uk	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
https://bnjmnt4n.now.sh/	0%	Avira URL Cloud	safe
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
https://www.ecornell.c	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://auth-ex.ecorne	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences?	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
http://daneden.me/animate	0%	URL Reputation	safe
https://mths.be/mit	0%	URL Reputation	safe
https://mths.be/mit	0%	URL Reputation	safe
https://mths.be/mit	0%	URL Reputation	safe
https://mths.be/platform	0%	URL Reputation	safe
https://mths.be/platform	0%	URL Reputation	safe
https://mths.be/platform	0%	URL Reputation	safe
http://jedwatson.github.io/classnames	0%	Avira URL Cloud	safe
http://freire-design.com	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
pi-ue1-lba1.pardot.com	52.202.69.186	true	false		high
pagead46.l.doubleclick.net	142.250.180.162	true	false		high
s.twitter.com	104.244.42.131	true	false		high
stats.l.doubleclick.net	108.177.15.154	true	false		high
ec-cas-prod.us-east-1.elasticbeanstalk.com	3.217.57.115	true	false		high
canvas-vanity-ecornell-290976688.us-east-1.elb.amazonaws.com	18.235.114.243	true	false		high
portal.ecornell.com	23.23.202.249	true	false		high
platform.twitter.map.fastly.net	199.232.136.157	true	false	0%, Virustotal, Browse	unknown
embeds.driftcdn.com	13.226.169.91	true	false	0%, Virustotal, Browse	unknown
dl7g9llrghqi1.cloudfront.net	143.204.2.32	true	false		high
www.ecornell.com	35.227.175.178	true	false		high
scontent.xx.fbcdn.net	31.13.92.14	true	false		high
t.co	104.244.42.5	true	false		high
reddit.map.fastly.net	151.101.1.140	true	false	0%, Virustotal, Browse	unknown
pagead.l.doubleclick.net	142.250.180.130	true	false		high
cdnjs.cloudflare.com	104.16.19.94	true	false		high
www.google.co.uk	142.250.180.99	true	false	0%, Virustotal, Browse	unknown
pi-ue1-lba4.pardot.com	35.174.151.106	true	false		high
bytedance.map.fastly.net	199.232.138.133	true	false		unknown
pop-efr5.mix.linkedin.com	185.63.145.5	true	false		high
q.quora.com	3.217.219.88	true	false		high
quora.map.fastly.net	151.101.1.2	true	false		unknown
alb.reddit.com	unknown	unknown	false		high
static.ads-twitter.com	unknown	unknown	false		unknown
lms.ecornell.com	unknown	unknown	false		high
a.quora.com	unknown	unknown	false		high
auth-ex.ecornell.com	unknown	unknown	false		high
stats.g.doubleclick.net	unknown	unknown	false		high
js.driftt.com	unknown	unknown	false		high
www.youtube.com	unknown	unknown	false		high
start.ecornell.com	unknown	unknown	false		high
pi.pardot.com	unknown	unknown	false		high
www.redditstatic.com	unknown	unknown	false		high
www.linkedin.com	unknown	unknown	false		high
connect.facebook.net	unknown	unknown	false		high
px.ads.linkedin.com	unknown	unknown	false		high
analytics.twitter.com	unknown	unknown	false		high
googleads.g.doubleclick.net	unknown	unknown	false		high
snap.licdn.com	unknown	unknown	false		high
sf19-scmcdn-va.ibytedtos.com	unknown	unknown	false		unknown
analytics.tiktok.com	unknown	unknown	false		unknown

Contacted URLs

Name	Malicious	Reputation
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal	false	high
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	false	high
http://www.ecornell.com/about-ecornell/help/	false	high
https://www.ecornell.com/about-ecornell/help/	false	high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png	imagestore.dat.2.dr, header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-json/wp/v2/pages/3592	header-only[1].htm.2.dr	false		high
https://www.redditstatic.com/ads/pixel.js	gtm[1].js.2.dr	false		high
https://www.ecornell.com/#organization	help[1].htm0.2.dr	false		high
https://bnjmnt4n.now.sh/	rhfnkn45i93k[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://cdnjs.cloudflare.com/ajax/libs/normalize/3.0.3/normalize.min.css	index[1].htm.2.dr	false		high
https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://px.ads.linkedin.com/collect?	insight.min[1].js.2.dr	false		high
https://www.youtube.com	iframe_api[1].js.2.dr, www-widgetapi[1].js.2.dr	false		high
https://www.youtube.com/iframe_api	login[1].htm.2.dr, header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://keynotes.ecornell.com/	header-only[1].htm.2.dr	false		high
https://raw.githubusercontent.com/stefanpenner/es6-promise/master/LICENSE	vendors-widget-8f96283c571fdb07659e[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://js.driftt.com/include/53666519/rhfnkn45i93k.js	rhfnkn45i93k[1].json.2.dr	false		high
https://www.ecornell.com/about-ecornell/help/	help[1].htm0.2.dr	false		high
https://goo.gl/Gs1KIc.	cse_element__en[1].js.2.dr	false		high
http://getbootstrap.com)	bootstrap.min[1].js.2.dr, bootstrap.min[1].css.2.dr	false	Avira URL Cloud: safe	low
https://github.com/krux/postscribe/blob/master/LICENSE.	js[1].js0.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
http://www.ecornell.com	style[1].css.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/style.css?ver=1608654674	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactP	~DF304FF6C681FB6925.TMP.1.dr	false		high
https://portal.ecornell.com/portal/student/studentHome.do?method=load	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18-header.min.js?ver=1590674122	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornel	help[1].htm0.2.dr	false		high
https://portal.ecornell.com/coursebasket/publicCourseBasket.do?method=load	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/hidden-pages/header-only/#webpage	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
http://bugs.jquery.com/ticket/11820	jquery-migrate-1.4.1-wp[1].js.2.dr	false		high
https://www.ecornell.com	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18.min.js?ver=1607023636	header-only[1].htm.2.dr	false		high
https://portal.ecornell.com/portal/student/studentNews.do?method=load	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/?p=957	help[1].htm0.2.dr	false		high
https://www.ecornell.com/certificates/	header-only[1].htm.2.dr	false		high
https://portal.ecornell.com/portal/student/studentProfile.do?method=edit	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/wp-content/plugins/ecustom-embed/js/ecustom-embed.min.js?v=2	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/#website	help[1].htm0.2.dr	false		high
https://schema.org	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/hidden-pages/header-only/	header-only[1].htm.2.dr	false		high
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas2	~DF304FF6C681FB6925.TMP.1.dr	false		high
http://opensource.org/licenses/GPL-2.0	qevents[1].js.2.dr	false		high
http://gmpg.org/xfn/11	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
http://bugs.jquery.com/ticket/13335	jquery-migrate-1.4.1-wp[1].js.2.dr	false		high
https://js.driftt.com/include/	login[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://oss.maxcdn.com/libs/html5shiv/3.7.2/html5shiv.js	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://stats.g.doubleclick.net/j/collect?	ga[1].js.2.dr	false		high
https://www.ecornell.c	{A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.ecornell.com/wp-content/themes/ecustom18/css/bootstrap.min.css?ver=1539886788	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://js.driftt.com/embeds/rhfnkn45i93k.json	rhfnkn45i93k[1].json.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/css/lc_switch.css?ver=1539886788	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[1].js.2.dr	false		high
https://github.com/aishek/jquery-animateNumber	jquery.animateNumber.min[1].js.2.dr	false		high
https://www.ecornell.com/xmlrpc.php?rsd	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://auth-ex.ecornell.com/cas/favicon.ico~	imagestore.dat.2.dr	false		high
https://portal.ecornell.com/portal/student/studentViewHelp.do?method=load	header-only[1].htm.2.dr	false		high
https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery-cookie.min.js	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/lc_switch.min.js?ver=1539886789	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/about-ecornell/help/#webpage	help[1].htm0.2.dr	false		high
https://portal.ecornell.com	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.resizestop.min.js?ver=1539886789	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://auth-ex.ecorne	{A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://cuttlefish.ecornell.com/api/	header-only[1].htm.2.dr	false		high
https://go.pardot.com/l/44232/2014-06-19/3pfh	login[1].htm.2.dr	false		high
https://www.ecornell.com/about-ecornell/help/feed/	help[1].htm0.2.dr	false		high
http://opensource.org/licenses/BSD-2-Clause	qevents[1].js.2.dr	false		high
https://file2.api.drift.com/download/drift-prod-file-uploads/dcac%2Fdcac67bafb3b60352cfef7b1f8877d9c	rhfnkn45i93k[1].json.2.dr	false		high
https://www.ecornell.com/about-ecornell/help/=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPh	~DF304FF6C681FB6925.TMP.1.dr	false		high
https://portal.ecornell.com/portal/student/applicationInstanceSearch.do?method=load	header-only[1].htm.2.dr	false		high
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcasll.com/ca	{A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat.1.dr	false		high
https://www.ecornell.com/wp-json/wp/v2/pages/957	help[1].htm0.2.dr	false		high
https://www.google.%/ads/ga-audiences?	ga[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
http://schema.org	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
http://daneden.me/animate	animate[1].css.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.ecornell.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fwww.ecornell.com%2Fhidden-pages%	header-only[1].htm.2.dr	false		high
https://mths.be/mit	rhfnkn45i93k[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://js.driftt.com/deploy/assets/index.html	~DF304FF6C681FB6925.TMP.1.dr	false		high
https://lms.ecornell.com/	header-only[1].htm.2.dr	false		high
https://app.drift.com	rhfnkn45i93k[1].json.2.dr	false		high
https://mths.be/platform	rhfnkn45i93k[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://www.ecornell.com/keynotes/	header-only[1].htm.2.dr	false		high
https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas	~DF304FF6C681FB6925.TMP.1.dr	false		high
https://portal.ecornell.com/portal/logon.do?method=load&logoff=true	header-only[1].htm.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/unpacked/jquery.hoverIntent.js	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css?ver=5.5.3	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
http://jedwatson.github.io/classnames	vendors-widget-8f96283c571fdb07659e[1].js.2.dr	false	Avira URL Cloud: safe	unknown
http://freire-design.com	style[1].css.2.dr	false	Avira URL Cloud: safe	unknown
http://www.apache.org/licenses/LICENSE-2.0	KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf.2.dr, KFOmCnqEu92Fr1Mu4mxP[1].ttf.2.dr, KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf.2.dr	false		high
https://px.ads.linkedin.com/insight_tag_errors.gif?	insight.min[1].js.2.dr	false		high
https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.animateNumber.min.js?ver=1539886789	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://www.googletraveladservices.com/travel/clk/pagead/conversion/	js[1].js.2.dr	false		high
https://api.w.org/	header-only[1].htm.2.dr, help[1].htm0.2.dr	false		high
https://portal.ecornell.com/portal/student/studentAcademicHistory.do?method=load	header-only[1].htm.2.dr	false		high
http://opensource.org/licenses/MIT	animate[1].css.2.dr	false		high
https://portal.ecornell.com/portal/student/studentCertificates.do?method=load	header-only[1].htm.2.dr	false		high
https://portal.ecornell.com/portal/logon.do?method=logonExisting	header-only[1].htm.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
3.217.57.115	unknown	United States	14618	AMAZON-AESUS	false
108.177.15.154	unknown	United States	15169	GOOGLEUS	false
13.226.169.91	unknown	United States	16509	AMAZON-02US	false
35.174.151.106	unknown	United States	14618	AMAZON-AESUS	false
31.13.92.14	unknown	Ireland	32934	FACEBOOKUS	false
3.217.219.88	unknown	United States	14618	AMAZON-AESUS	false
151.101.1.2	unknown	United States	54113	FASTLYUS	false
142.250.180.99	unknown	United States	15169	GOOGLEUS	false
142.250.180.162	unknown	United States	15169	GOOGLEUS	false
52.202.69.186	unknown	United States	14618	AMAZON-AESUS	false
18.235.114.243	unknown	United States	14618	AMAZON-AESUS	false
199.232.138.133	unknown	United States	54113	FASTLYUS	false
35.227.175.178	unknown	United States	15169	GOOGLEUS	false
23.23.202.249	unknown	United States	14618	AMAZON-AESUS	false
185.63.145.5	unknown	United States	14413	LINKEDINUS	false
104.244.42.131	unknown	United States	13414	TWITTERUS	false
151.101.1.140	unknown	United States	54113	FASTLYUS	false
104.244.42.5	unknown	United States	13414	TWITTERUS	false
143.204.2.32	unknown	United States	16509	AMAZON-02US	false
142.250.180.130	unknown	United States	15169	GOOGLEUS	false
104.16.19.94	unknown	United States	13335	CLOUDFLARENETUS	false
199.232.136.157	unknown	United States	54113	FASTLYUS	false

General Information

Joe Sandbox Version:	31.0.0 Red Diamond
Analysis ID:	336936
Start date:	07.01.2021
Start time:	11:45:54
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 3m 56s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	9
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@3/129@27/22
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: https://auth-ex.ecornell.com/cas/login?service=https%3A%2F%2Flms.ecornell.com%2Flogin%2Fcas#contactPhoneModal Browsing link: http://www.ecornell.com/about-ecornell/help/
Warnings:	Show All Exclude process from analysis (whitelisted): taskhostw.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, svchost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 168.61.161.212, 104.43.139.144, 88.221.62.148, 142.250.180.78, 142.250.180.110, 142.250.180.142, 142.250.180.174, 216.58.206.78, 216.58.208.142, 216.58.209.46, 216.58.198.46, 216.58.205.78, 172.217.21.74, 142.250.180.163, 142.250.180.136, 216.58.205.68, 142.250.180.67, 172.217.18.110, 23.210.249.242, 95.101.20.72, 95.101.20.18, 95.101.20.57, 95.101.20.74, 95.101.20.56, 95.101.20.9, 95.101.20.75, 95.101.20.51, 13.107.42.14, 51.104.146.109, 92.122.213.247, 92.122.213.194, 152.199.19.161, 52.155.217.156, 20.54.26.129 Excluded domains from analysis (whitelisted): gstaticadssl.l.google.com, www.googleadservices.com, arc.msn.com.nsatc.net, a1449.dscg2.akamai.net, arc.msn.com, e11290.dspg.akamaiedge.net, e9706.dscg.akamaiedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, l-0005.l-msedge.net, go.microsoft.com, www.googletagmanager.com, cse.google.com, ssl-google-analytics.l.google.com, www.google.com, analytics.tiktok.com.edgekey.net, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, www.gstatic.com, img-prod-cms-rt-microsoft-com.akamaized.net, www.google-analytics.com, clients1.google.com, www-linkedin-com.l-0005.l-msedge.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, fonts.googleapis.com, www-google-analytics.l.google.com, fonts.gstatic.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, displaycatalog.md.mp.microsoft.com.akadns.net, ris-prod.trafficmanager.net, e35058.a.akamaiedge.net, skypedataprdcolcus17.cloudapp.net, skypedataprdcolcus16.cloudapp.net, ssl.google-analytics.com, ris.api.iris.microsoft.com, youtube-ui.l.google.com, wildcard.licdn.com.edgekey.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, clients.l.google.com, cs9.wpc.v0cdn.net Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\BC6XF3KU\www.google[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	823
Entropy (8bit):	5.340756185729531
Encrypted:	false
SSDEEP:	12:JUdF7a/JzXxylOJQKM37J08kJYC2JGR5JWMJIQ6G9ryEqt/MIX04Eysepb2J3:yaBXIIaH71kSJyMMm7GRHqlRXQepb2B
MD5:	F7FF986FB9444CD853638571085F7D7B
SHA1:	C7921813CB6BECB3114EA5C06D8474BD0CFD3FC6
SHA-256:	9C900A83A398771BFEA0EDCE311CF79C0A2DE991D161A3DFD45A535AAF1EACB3
SHA-512:	892DF5BBDE4D152DCB2234805682C689AA55AE15587BF3B5BA6D5071B10C67FDBE5D452D0E30A33A407B45A8BEA1C2554D74792EE288B9EFF5172BDB34DBBC12
Malicious:	false
Reputation:	low
Preview:	<root><item name="sb_wiz.qc" value="1" ltime="2811281280" htime="30840570" /><item name="sb_wiz.zpc." value="[[["news UK",0,[362,308,154,357],{"zl":40009}],["dinner recipes",0,[362,308,154,357],{"zl":40009}],["24hr supermarket near me",0,[362,308,154,357],{"zl":40009}],["last minute holidays",0,[362,308,154,357],{"zl":40009}],["weather tomorrow",0,[362,308,154,357],{"zl":40009}],["cities in UK",0,[362,308,154,357],{"zl":40009}]],{"ag":{"a":{"40009":"Try searching for"}},"q":"m-8sCxwNVqraaMzd_0n2ExiMRbc"}]" ltime="2829291280" htime="30840570" /><item name="rc::a" value="ZXloNWV1MTFpZWFsOQ==" ltime="1738019856" htime="30860514" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\E5F0NRSV\auth-ex.ecornell[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	10020
Entropy (8bit):	4.9390185418432155
Encrypted:	false
SSDEEP:	96:OzOzVzAzvzOzVzQvzOzVzvzOzVz3vzOzVz3vzOzVz3JvzOzVz3JI4vzOzVz3JI4L:c
MD5:	3A5B720C9D02B8CFEA901162170C81E1
SHA1:	38D9DEA7079B2E3A9A6C99FF6B475F643623D0D4
SHA-256:	5B3D205329ED759781C9D6DFE3B06AB16B149ABDFAFFA772B891EA0489CAC11C
SHA-512:	63BDBB2A6F07BF2964EA9FD58826A587927FD277D219AE464BEF119DD8B4068311DD789016ED2ED4661044FD7A3C8256295444C828272C5D5089E146D8F74918
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="Drift.Targeting.firstVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item name="Drift.Targeting.currentPageViewStarted" value="1610016411" ltime="1749839856" htime="30860514" /><item name="testKey" value="testKey" ltime="1749839856" htime="30860514" /></root><root><item name="Drift.Targeting.firstVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item name="Drift.Targeting.currentPageViewStarted" value="1610016411" ltime="1749839856" htime="30860514" /><item name="testKey" value="testKey" ltime="1750149856" htime="30860514" /></root><root><item name="Drift.Targeting.firstVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016411" ltime="1749839856" htime="30860514" /><item na

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\URW0GA4Q\www.ecornell[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	modified
Size (bytes):	12609
Entropy (8bit):	4.958103196370695
Encrypted:	false
SSDEEP:	96:JelelVelVhelVhuelVhLelVhuFelVhuFXFelVhuFXFZelVhuFXFZelVhuFXFZNeD:JL1L1515131+1I1I1u1I1I1e
MD5:	4692A76D4DBDCAE5B414126D3CED8267
SHA1:	4E3AD0C171A266E74917E4D966561AFE4070065B
SHA-256:	90B0AB5376DE945EAE528B96E9EE8180D81CEB0F68A42C25798A3ACFFCC6EB50
SHA-512:	CE5C870DD8C3961F1D71C868948A594DEEFCC81561FA0D1351E55BECFEEDB466BE00C4DD3FC238D865B1C2072D6B1D2B9962FFE610B20BAB46055B6D3F406001
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="Drift.Targeting.firstVisit" value="1610016428" ltime="1917549856" htime="30860514" /></root><root><item name="Drift.Targeting.firstVisit" value="1610016428" ltime="1917549856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016428" ltime="1917589856" htime="30860514" /></root><root><item name="Drift.Targeting.firstVisit" value="1610016428" ltime="1917549856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016428" ltime="1917589856" htime="30860514" /><item name="Drift.Targeting.currentPageViewStarted" value="1610016428" ltime="1917629856" htime="30860514" /></root><root><item name="Drift.Targeting.firstVisit" value="1610016428" ltime="1917549856" htime="30860514" /><item name="Drift.Targeting.lastVisit" value="1610016428" ltime="1917589856" htime="30860514" /><item name="Drift.Targeting.currentPageViewStarted" value="1610016428" ltime="1917629856" htime="30860514" /><item name="Drift.Targeting.numberOfVisits" valu

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{A055815D-50D5-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.8551684092685656
Encrypted:	false
SSDEEP:	192:rIZDZz2u9Wb7tbdifbsJnzMdvBnyVDnKsfnVJWjX:rIFKuUb5bib9r+Za
MD5:	6F2BB9FE2A973E4BD1916B313DEB7764
SHA1:	A493ACFC9946A429AE81755941982934E8926765
SHA-256:	1A814C9DAD6345941DF5A0BEB071EDB644A380C3C109F87AB460D203E57EB98B
SHA-512:	DE3BC643568A92DD990CFA863E42D56C6ABE1995EBE181E58A0F5C37E72B6D23A182A14930040EB91C972485A16D53CDA5C6A52AB1E5A1F4E8098D1ECF19EFCE
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A055815F-50D5-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	85606
Entropy (8bit):	3.277445281482928
Encrypted:	false
SSDEEP:	768:m4D+51zfR32IlrvzD+51zfR32IQXk4PGk3JCAUpj3OWD2dHc:m4D+5xfl2IlrvzD+5xfl2IQzUt33D21c
MD5:	3C83A6615F99D1E0C7CB38611FF2C059
SHA1:	A986473EB5F6D6FD4F5232D01CC43FED68FFB8D2
SHA-256:	11370807DF0178671F325B77F4FDEB86F9C5D3BB28CB1D1082527D94165BB3CE
SHA-512:	744B33FBDBFA2250A73A82824DBCF17F9EBBF37C5BA85338CFE7EE1FE3C1DB2F7AF6E5F63C0CF87C05766C667948FD9E2CD0669D5FA757D2CE81FC8979D0C3C0
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{A860F638-50D5-11EB-90EB-ECF4BBEA1588}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.564710494808749
Encrypted:	false
SSDEEP:	48:Iw/GcprYGwpatG4pQbhGrapbSwrGQpKpHWG7HpRUsTGIpG:rVZAQP61BSwFAphTU4A
MD5:	21AEEBE4C2B8B2695AAB9147EAB57A74
SHA1:	80404B952A3992FD3A21724C9A3789B168B062CC
SHA-256:	9DFCEDFB32F22CEEC7EC93C616806CB10B1F6FC5265ED71A1B85D2FFD80C5B84
SHA-512:	E3AC6AC201E7A1305AAF6C324D3A3384FB354AD075078C246DE3AB2A8D9D682F541AF6CE8362A2BDBBBD4FFDF42A2F855F752338E933839B9FCBA954B6A02767
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\gee00pr\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	1464
Entropy (8bit):	5.026559331758856
Encrypted:	false
SSDEEP:	24:/GlSuZttttttttttttttttttttttttttttttttttt62tttttttFttttNtttNtpgl:/ySwPPPP0HbLgMlWHJA
MD5:	1E1EFC77BB137E2FCBAFC8235DFB732B
SHA1:	B5A61F8ECF17FAEA8DCDB564F2E5B3C7CEF37228
SHA-256:	6D514F028A6BE65107B52B23FE35EF72323111D3A6A148E4C31CF1F8E41249B6
SHA-512:	F69047537DF9E120C7C611986EC41A788E0B7FC36470302C652A0C9FD36E04BD4A4FE2ADFCF9101B53C801FD3279D202706ECD19C5AF95600B84ABED41B3979E
Malicious:	false
Reputation:	low
Preview:	,.h.t.t.p.s.:././.a.u.t.h.-.e.x...e.c.o.r.n.e.l.l...c.o.m./.c.a.s./.f.a.v.i.c.o.n...i.c.o.~.................h.......(....... ...........@...................'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.b_.......b_.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.:7.................:7.'#.'#.'#.'#.'#.'#.'#.KG..........,(.,(........JF.'#.'#.'#.'#.'#.'#.......QM.'#.'#.'#.'#.QM.......'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#.......'#.'#.'#.'#.'#.'#.....'#.'#.'#.'#.'#.'#...................'#.'#.'#.'#.'#.'#...............................'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#.'#....q...................................................p......4.............

C:\Users\user\AppData\Local\Microsoft\Windows\History\History.IE5\mms\EITFZ01D\52284660f7abf8538f64d3f7b857f505[1].dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	196608
Entropy (8bit):	0.4169828839481698
Encrypted:	false
SSDEEP:	192:rRQJ5G7RsKIUBde7QgCVUJAXv9hmz2wf:ryjG99naCVUJAXTmH
MD5:	4131F7592D7A56F6B0FB1CD230A72FDD
SHA1:	47ABCEC34E24014E2284C5BA6105029EC54ADD3E
SHA-256:	C2A0FC254BA404D549FA1AF561A4D54C58F2F1D2D09260F8EEB543E3B3FFC162
SHA-512:	E2F5903B288D6F779DE9D98158EAA51A63FF07768BA5624A2EDEE2BADDA9F83270AFB71A9BC60F3F7DA28534794DB4D4E02002534E6BBE7FE7731388866F60D5
Malicious:	false
Reputation:	low
Preview:	........."..............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1564543307137132[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	246678
Entropy (8bit):	5.467444335736789
Encrypted:	false
SSDEEP:	6144:Rk1HWCSntDV/H4K3V/H486EPjQHWuH3HpsG9:f6Ey
MD5:	2E0FE846DF7FA152B26F4D03C80B8219
SHA1:	19DFE71DE36B0ACD74CB159E2C03486B0839622D
SHA-256:	F00F72C7AAD3718FBB2411B881D3AB1BB36031EE2FA0778D5854C4818697C22B
SHA-512:	B9CC8CC1FBAE1A7CD7556CE87C4287B4C74AC9FC5EC0CF693E6ADEB36CE2E4BB7890815CDB6E34C2699E59D92598262CBB75B6134AF0F3DEB431465770A43134
Malicious:	false
Reputation:	low
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4TbMDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26124, version 1.1
Category:	downloaded
Size (bytes):	26124
Entropy (8bit):	7.980168433890079
Encrypted:	false
SSDEEP:	384:Dxv2LC0drKSPpL+VHxyHsUGB52uPGnNRPd6XgAObIrRrillsqI9D9yYSzsLhZPxF:92DlPMxFzCNttbWRGnYkYvNZEYbz
MD5:	0C97AAB740AAC0DA269B1EC86CE478AE
SHA1:	5B44E95377B3A607C837FF4AA8AF7E8E4519EA41
SHA-256:	D799862EBD2E266FE353E940FD73215E8C095842603CE07DE316695FE26E9BF7
SHA-512:	90F7B8DF2FF9E3FA15FBD137C85072FA78291F2D323D4A8420E0C9745D9D69F820B1159743A06AB5294B8AA514A757C36B8ADC0FAC47B44287A578C08765714F
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4TbMDrMfJg.woff
Preview:	wOFF......f.................................GDEF.......m.......PGPOS..........6..!.GSUB.......C........OS/2...P...R...``..2STAT.......6...@.A.$cmap............Kd.lcvt .......g........fpgm...............Zgasp..%.............glyf..%...8...Z.. i.head..^\|...6...6..._hhea..^....#...$...1hmtx..^....f.....e#.loca..a@.........).vmaxp..cH... ... ....name..ch...9....G.h.post..d........ ...2prep..d....M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T..leQ....l...m.m...m..i.........J.Dq.W....N#....w..}a....RV.zu...r ...s.XN..=...-x.......!k/j/..N.PR[Z5..#7^.T.=mdi...e.W...V.{.V.W...X.V.[3V3Vk.....v.;.....N/......a.n.ECi{.p...^.L11Cq...)...i.......u.u.me...\|^.F.o:.;.:.;{:.;....v...^..Wzf{.z6{Nz.{>.......o.p.a.x.l..........s.C.C..y..5...}..s.#U#..}!...4.....=..0.+.d.fS...1....3....N6....sp.-.....p..q...=....w...l.7......DD.....T...@?..c4..........L.&...n..z:..t.........$\..........._..t...)~..T..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4VrMDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25500, version 1.1
Category:	downloaded
Size (bytes):	25500
Entropy (8bit):	7.979144897884829
Encrypted:	false
SSDEEP:	384:paM7QjWHCtYGTiHsaHxxyxyHsUGB5cxtcTR5zeFXhWoP3+0VAOq0i3YaNZ9Z1:p7QacaqxFztnyFXdxAoYYkh1
MD5:	5B707C01C8C5EF129BB996624544C72C
SHA1:	BB8E9FEB474CEF6DD89B4D215E5E51C8342408ED
SHA-256:	4129E638303DB7E1F06AC3975C2E203DC5B3CEF4C13FA25D26A4B9E9815E9701
SHA-512:	7932F5E32F61D36569F479CD37444C66E99A657E63C6838597DFC97F3E5A633888E0A6457BB3F1CD28A2BF4669846526EA7ED75DCD07CE02675D99558D022112
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4VrMDrMfJg.woff
Preview:	wOFF......c.................................GDEF.......m.......PGPOS..........6...=GSUB.......C........OS/2.......R...`aU.2STAT... ...6...@...&cmap...X........Kd.lcvt .......g........fpgm...t...........Zgasp..%L............glyf..%T..6...Y..Ahead..\....6...6..._hhea..\<...#...$...1hmtx..\`...s........loca..^............smaxp..`.... ... ....name..`....=....H.j~post..b4....... ...2prep..bL...M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T..l%P....m...m.m...m.m.;......@.@..(.Q......nH..0wo.'....Q./A..}{B.$..M.9.e.4...I....f$=/....Z.ZK...T.VL&i.c.d..s...4.y..~...o..Vh.q..4.U+..5#5#.fm.L...jg......R}m.H{...o.5....'......$c...q........4....bLS.:..4.q.C.W0i.._uLvlt.wvu.v~u.wmu.w=u.v/.L............gO}...@.@.`.`...........L.{C.C/...U......K...#.#}..!........x..I..%l<...X......)..a+............C.....V..[..x......._..nh.......4*.7.......t.#..F.'..~...O.1..`".[M....a.....a..h...S...xC....C.gv..W...x

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4WjMDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26116, version 1.1
Category:	downloaded
Size (bytes):	26116
Entropy (8bit):	7.978522051132669
Encrypted:	false
SSDEEP:	384:x2vHXiYm3fhcjCho82zCxyHsUGB5dcOuIKPx0RadYfwsT22QU7bY8CPGJ46HqYm8:SXizRv9xFzixZxdxkr41cMudd1R
MD5:	641594C699246F132341AE18D7C9D149
SHA1:	8DFDEE56434A8DFBB7432FDD1DB14946C6905292
SHA-256:	B8F7722F18FD11B2D58C1B68C9F41A8F8362BD356CDEB0909A36E9AC6D514D79
SHA-512:	FAF50E140C1E7B703838FD7AE8394C4BB2C5F95DB3431CBEA710B5D109B59134E26BBDE10FF60642B550AA5E7ED52E3943FC845AD7637756624CDE49B5026DBD
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4WjMDrMfJg.woff
Preview:	wOFF......f.................................GDEF.......m.......PGPOS..........6...GSUB.......C........OS/2...P...R...``..2STAT.......;...D.e.)cmap............Kd.lcvt .......g........fpgm...............Zgasp..%.............glyf..%...8...Z.K3..head..^....6...6..._hhea..^....#...$...1hmtx..^....f.....C!oloca..aP............maxp..cT... ... ....name..ct...&...b:8X,post..d........ ...2prep..d....M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T..l%@....m...F..m.m#X.m...8.W.9.<..@....^..C?l.....2}"....c.....1u".@aD5..t....p.R....,K........>/..*h/lYH0..b.NArQfg..t...E...h.R..\-.]vP^Y.P.P.WV-..6S...W~T}....;....f........y..n....XZ.>...Lm.....n..>.-Q..x...}.O.W...7......\|...^..........{.......w.......+.....t...6-2.;2...zwzg....{...o...._........N..Zp..@..w!Va.....OV.0.b%.....4Y..d=..26....d.n.%..59.O....7MG#........... ....!Z.t.a).."1.......Y...XJg9K.....t...8.#.T........qJ.F]q....814.$......{..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4bbLDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26452, version 1.1
Category:	downloaded
Size (bytes):	26452
Entropy (8bit):	7.981896271467095
Encrypted:	false
SSDEEP:	768:Q1y4WgOTZuAxFzpHfw3F1oZQAy5+oNvMDo:bZDHpHo11oZfPsp
MD5:	00DA60E520CCA3C6E89F3C6BAF033242
SHA1:	700F2C03AAA1E39A53C5375A07577E6C23049DAE
SHA-256:	70E6DF0C3FFCD74D2A53EDC825B90119BDDB73EE3CD6E22804D82CD008A61CFF
SHA-512:	255F5C827A3D97FA202B248D84C54D70B2AC6006D3EC3D467B1BC8FDC85F70CE6E7BAA1857368127D41F0E352265D7C8A9B859469211E652168477D295F7EC5C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4bbLDrMfJg.woff
Preview:	wOFF......gT.......$........................GDEF.......m.......PGPOS.......;..6..H..GSUB...@...C........OS/2.......R...`a..2STAT.......6...@.m.'cmap............Kd.lcvt .......g........fpgm...,...........Zgasp..'.............glyf..'...8...Y....Ihead.._....6...6..._hhea.._....#...$...1hmtx..`....r........loca..b............Smaxp..d.... ... ....name..d....;....KSl.post..e........ ...2prep..f....M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T..t#@....6..dm.m..m.m..._......2. xe.W..].A..B.U......%..ti.;D@R.\|p!. .....9.....'.Uy.IK^K...I....I..)D....$.LKU..../.U.'b.8$..t.,.<\...).g.P.W.#....WR.....p.!.!...1uQ.]Q.2U...MIU..9-...v.N.....T......k.]2.1.7UL..L...{.,C-...[.X_Y?X.......w./...8O..._.......z{.&.Q.}...Nx.y......z.F.......U.....4p...u....J.1..1..b....,C<V`%Fb...ud.6`..b;...d2v.....Y..d)n......b5^.-...9...{......h.>.'{........go.I{........w.S.%l?..]XOu[h.{.d.8.......4..v./).b{...[j

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVuEorCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25704, version 1.1
Category:	downloaded
Size (bytes):	25704
Entropy (8bit):	7.979766114663522
Encrypted:	false
SSDEEP:	768:qUJFgxZKzGyOrzepRzHLilLFn1mqB2o1w:quWZgLO/MzHLuLF1mC2o1w
MD5:	6BFD4AFA64B5ABC77C0AEE4CAEC7FC98
SHA1:	957A9E51A1F20D0A3A61A76D688625A0252690F5
SHA-256:	7B413AB9A41C5FD486D2118CAF1C47BF5CB18BE22B776228630D35DCE99EAC03
SHA-512:	AC50109E7F7DB0D0F13749364C06EF4A6FDFDAF0046BE02DAF6FA3F2BF973B2AE28CBB90C888700BC87ED34528B88A40D6448FF5139A70C88B53AB5A22410835
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVuEorCIPrc.woff
Preview:	wOFF......dh.......X........................GDEF.......m.......PGPOS..........7:.8.-GSUB.......R.....s.qOS/2.......O...``..GSTAT...H...8...D.T."cmap............MD..cvt ...8...N........fpgm...............Zgasp..&`............glyf..&h..6z..[.R..head..\....6...6.a..hhea..].... ...$....hmtx..]<...`...@..21loca.._........"33.amaxp..a.... ... ....name..a....<....A.f.post..c........ ...2prep..c$...A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L....A...7...w.m. .m.(.m.m....[......Q......E......ggx...EI.Ruh.3.@.bj.i..;P.................!.S..Eu..).....t..)toh...o.j,o.b<d\|c.j....89c....;l.....\.R8f8n9~....9...y.g..+...*.hK....i...^.>...M..}%}..-.../.~_.V s`.cfr2..%.#V`..w8=..k...&q3..\|....._.s.]......R.....=..;.h,c.....+."6".....>),e..J....`i..I: s....\|.jx.B...0.......C.c..c.&.QXLFc...u.....m.I.}...d....8.+..kd...>....Q.;..V\|.wl..Yy.....W>....]....\. ...sf..UU...Wz...;]....Az.wM.".T.R.]...{

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25804, version 1.1
Category:	downloaded
Size (bytes):	25804
Entropy (8bit):	7.980671704795917
Encrypted:	false
SSDEEP:	768:iULQ96VHcotzJzoeNzfjSGSSHEpxW9Cn+mE:iSu6VZZoozLhYrdE
MD5:	CE22119EC5A34EF3D200892F0B1C3C0C
SHA1:	B8A7EA7AB06D9FAA8196949EE273DA5B5E949FD1
SHA-256:	A02462A6C8721B680A2BC724BB2BD7E65A38C4F845269493B8DCDF015B8C47BA
SHA-512:	9D74DAFC5FA415A00809FF9A0827A63BBF191BF909F1601DE6AE5EFC9DF4FE00757905F0BD074B16358803A727B1A6953D59063172107614641F9C700B08C76C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvaorCIPrc.woff
Preview:	wOFF......d........D........................GDEF.......m.......PGPOS..........7:...[GSUB.......R.....s.qOS/2.......O...``..GSTAT...d...<...H.x.'cmap............MD..cvt ...X...N........fpgm...............Zgasp..&.............glyf..&...6...[.^..head..]T...6...6.a..hhea..].... ...$....hmtx..]....]...@.w0.loca..`........"1<.jmaxp..b ... ... ....name..b@...4...~>._.post..ct....... ...2prep..c....A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L....A...7...w.m. .m.(.m.m....[......Q......E......ggx...EI.Ruh.3.@.bj.i..;P.................!.S..Eu..).....t..)toh...o.j,o.b<d\|c.j....89c....;l.....\.R8f8n9~....9...y.g..+....hK....i...^.>...M..}%}..-.../.~_.V s`.cfr2..%.#V`..w8=..k...&q3..\|....._.s.]......R.....=..;.h,c.....+."6".....>),e..J....`i..I: s....\|.jx.B...0.......C.c..c.&.QXLFc...u.....m.I.}...d....8.+..kd...>....Q.;..V\|.wl..Yy...Q.W>....]....\. .4...........x..k...i..n]p.x.D.hY....4<

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvoorCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25248, version 1.1
Category:	downloaded
Size (bytes):	25248
Entropy (8bit):	7.98034610697278
Encrypted:	false
SSDEEP:	768:/yeoQC/zFEk1/mDsBOR9HkuuoznRIytv0:/3oQCLFfmDZEKf0
MD5:	550306A0569B1D98E4F25F7CCC7DAE22
SHA1:	69135AD1D6C31307903EF6784DC9DC544CD28EF4
SHA-256:	FE83AC58BCCFC34D73D0C32C73D4385601D71F8F0CB5408F783106A83FED95C6
SHA-512:	E396C46239299BBF990A65C25E7ED338AFF59AA70C6C73D4E855F6C8EB9B930A4D9799EF2D584EF4E997B2B90D69701B56D9EB6B1550C925D11518729E43635E
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVvoorCIPrc.woff
Preview:	wOFF......b........8........................GDEF.......m.......PGPOS..........7:....GSUB.......R.....s.qOS/2...X...O...`aT.GSTAT.......9...D...$cmap............MD..cvt .......N........fpgm...............Zgasp..%.............glyf..%...5P..[..J..head..[....6...6.a..hhea..[T... ...$....hmtx..[t...Z...@..-.loca..]........")..9maxp.._.... ... ....name..`....A....D$fBpost..aH....... ...2prep..a\...A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L....A...7...w.m. .m.(.m.m....[......Q......E......ggx...EI.Ruh.3.@.bj.i..;P..'..R.JOS^.P.K.K....{...U..H.....7....7.5.7N1.2.1.O5.....V...}J...........I.O).3...?....AgA.<.3.....q.L.%UkZ.4v.u/r.............P./.+.90.139......+...;....5.r....?>.g.s.9...pM.fQ..I.P..H..X4.1Y.X.._....LkZ\|E\|...2Ky..RSi.4F.$..9y.\|L>.5.P...z.@.`.B..!.1..1...(,&.....:l.Xl.fL.6..$..>L.A2...l.....5..wq.k......c+..;....<C^...+..L....}.T.`.r...sf..U\k..w<X......P..x(..u.u...+.~.B

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmEU9fBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto MediumRegularVersion 2.137; 2017Roboto-Me
Category:	downloaded
Size (bytes):	35588
Entropy (8bit):	6.410135551455154
Encrypted:	false
SSDEEP:	768:6yVJgIpAqZsXgDNHOBBPXNOKdhT1N+06XAxGrzmoqpxk0SnuUR:enq805OBBdhT1NP6XAxGryoqp2
MD5:	4D88404F733741EAACFDA2E318840A98
SHA1:	49E0F3D32666AC36205F84AC7457030CA0A9D95F
SHA-256:	B464107219AF95400AF44C949574D9617DE760E100712D4DEC8F51A76C50DDA1
SHA-512:	2E5D3280D5F7E70CA3EA29E7C01F47FEB57FE93FC55FD0EA63641E99E5D699BB4B1F1F686DA25C91BA4F64833F9946070F7546558CBD68249B0D853949FF85C5
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf
Preview:	........... GDEF......{....dGPOS......\|<....GSUB7b.....8....OS/2t.#...r....`cmap......st...Lcvt 1..K..y....\fpgm..$...v.....gasp......{.....glyf.'.....,..j.hdmx......r\|....head...r..n....6hhea......q....$hmtx..MO..n@....loca\v@z..l(....maxp......l.... name..:...z,....post.m.d..{.... prep...)..x\|...S...d...(.............o......9........................EX../... >Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^...............<......9.........EX../... >Y..EX../....>Y.....+X!...Y..../01.#.!.462...."&.~......J.JH.H......9KK97JJ....e...@.......%...EX../...">Y..../..../......./01..#.3..#.3..#...-#...w.}....}.....`...............EX../... >Y..EX../... >Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#5!.#5!.3.3.3.3.#.3.#.#.3.#...L.L...:...N.N.N.N..:..L.v.:....f....9....`...`....f.8.9...d.-.&...,...*-...9...EX../... >Y..EX../... >Y..EX.#/.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOlCnqEu92Fr1MmYUtfBBc9[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.Roboto BlackRegularVersion 2.137; 2017Roboto-Bla
Category:	downloaded
Size (bytes):	35208
Entropy (8bit):	6.392518822467014
Encrypted:	false
SSDEEP:	768:53Dmu13ucOmpIN22bN8o6Ze0XlGV+uM49pSeCu7XniviDffw6mo/quUR:lD13DjSNz0XlG0uL9YeCu7Xn4iTo9o/4
MD5:	4D99B85FA964307056C1410F78F51439
SHA1:	F8E30A1A61011F1EE42435D7E18BA7E21D4EE894
SHA-256:	01027695832F4A3850663C9E798EB03EADFD1462D0B76E7C5AC6465D2D77DBD0
SHA-512:	13D93544B16453FE9AC9FC025C3D4320C1C83A2ECA4CD01132CE5C68B12E150BC7D96341F10CBAA2777526CF72B2CA0CD64458B3DF1875A184BBB907C5E3D731
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf
Preview:	........... GDEF......z\...dGPOS......z.....GSUB7b..........OS/2ve#...p....`cmap......r....Lcvt ...=..xX...Zfpgm..#...ud....gasp......zP....glyf.......,..i~hdmx......q ....head...R..l....6hhea.]....p....$hmtx..<...l.....locaK./...j.....maxp......j.... name..9...x....\|post.m.d..z0... prep...C..w ...8...d...(.............P...EX../....>Y..EX../....>Y......9......9......9......9........9......9......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^....g...........<......9.........EX../....>Y..EX../....>Y.....+X!...Y..../01.!.!.462..."&....+.g..k.kk.k......J__.__.......^.......&......9........./......9../........01..#.3..#.3.+..._+...v.S.8..S.8.......z.......... !..9.........EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9../.....+X!...Y............../.....+X!...Y...............................01.#.#.#53.#53.3.3.3.3.!.3.!.#.3.#.d.C.C..,..E.D.E.E...,...C.@.,....f.........`...`.....f.Q......S.&.Q...-.r.+./..9...EX../....>Y..EX.!/..!.>Y..!...9........!..9......

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\KFOmCnqEu92Fr1Mu4mxP[1].ttf Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	TrueType Font data, 18 tables, 1st "GDEF", 8 names, Microsoft, language 0x409, Copyright 2011 Google Inc. All Rights Reserved.RobotoRegularVersion 2.137; 2017Roboto-Regularht
Category:	downloaded
Size (bytes):	35408
Entropy (8bit):	6.412277939913633
Encrypted:	false
SSDEEP:	768:PX4i+tezjtQYgu30G0xL9nQbuEL7LQo9SBxQbptqKmomjJlvh:PJ2z3G0xpUusLEBKptqNomjV
MD5:	372D0CC3288FE8E97DF49742BAEFCE90
SHA1:	754D9EAA4A009C42E8D6D40C632A1DAD6D44EC21
SHA-256:	466989FD178CA6ED13641893B7003E5D6EC36E42C2A816DEE71F87B775EA097F
SHA-512:	8447BC59795B16877974CD77C52729F6FF08A1E741F68FF445C087ECC09C8C4822B83E8907D156A00BE81CB2C0259081926E758C12B3AEA023AC574E4A6C9885
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf
Preview:	........... GDEF......{`...dGPOS...h..{.....GSUB7b..........OS/2tq#...q....`cmap......s....Lcvt +.....yl...Tfpgmw.`...vd....gasp......{T....glyf.......,..j.hdmx......r ....head.j.z..m....6hhea......q....$hmtx..Vl..m.....loca?.#...k.....maxp......k.... name.U9...y....tpost.m.d..{4... prep.f....x ...I...d...(.............q......9........................EX../....>Y..EX../....>Y......9......9......9......9..........9......9.......01!!.!.......!.5.!.(.<..6......................}.w...x.^.^..^.......{.......0...EX../....>Y..EX../....>Y.....+X!...Y......901.#.3.462..."&.[....7l88l7......-==Z;;........#.........../......9../........01..#.3..#.3...o.....o...x...........w...............EX../....>Y..EX../....>Y..EX../....>Y..EX../....>Y......9\|../......+X!...Y............../.....+X!...Y...............................01.!.#.#5!.!5!.3.!.3.3.#.3.#.#.!.!....P.P...E....R.R..R.R..E..P....E.....f....b....`...`.....f.#.b....n.0.....+.i...EX../....>Y..EX."/..".>Y.."...9..................+X!.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\branding[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 124 x 15, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1372
Entropy (8bit):	7.835727883004283
Encrypted:	false
SSDEEP:	24:rce7VZEb8sVPS66BT/Uv/hOMF6ALhgaXmn7tJUmxIccJlOJeisBM8xvBM5nsT4E:gekPS6yT8v/hO06AVX0bXClQeZz6no
MD5:	5FA765D6ECD4DDBE72ABBAC8698FA4B0
SHA1:	468231E63B1AB3ED01A9488F5C981B141A54D024
SHA-256:	331B2B1241F1F2A53744BDCA867C5B76954D9431970E91F490F64C707FC24A16
SHA-512:	2B16AFD708FA0BFAB449F74DD118108777CD0097D1F3359892CD4A310BC4298248E5F49685B87EB59F3FA3E1BCDE22941F80906CC17F9CC8225367399F300A3E
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/images/1x/en/branding.png
Preview:	.PNG........IHDR...\|.........&......#IDATx.b....@;..4K...m.m.w...3.`.m.m.m...u....f..U..I.3...If.6]...eQ..,.}.g/5m~h...........O...c(.f....!......z$J.kd~[._.O.y>Q.2F.w&..G.6t4m.....V....^.m ..Y.t.oV..Fi:.O..1..f.e..j2...E...W9..s.^.....l..u.+6..l.........I....o=V.....'..FP.#.LR,....$..e.......\7..;.....@^m.....>.9...a...%........h.c....fM.H@.T...7.px.......[b.%..=./C.K ...6m~....#/{W..;"{...Q.\.o..o...7...[.6[...Ti..s.\......Y....S....e..\|........r.X.....f.5...O....i...}>A,t.O.wO...H^" e.....=....\.....P.>D..l..~..}...7......-f...yq........?..N.S...S....()......D-...Zzu...m+.U.a....?oL:..,3.d.......B...5...X....?"{..-..f.....C.o..;..(...m.....vL.."..&.i..(.?.....Y...[N.3...7...<..-.8.....S.....Y...^...`..Z.8s.y.$..=.48.F.U.....S..}.}...2&...+ .O.W.......d3..8.Sc...@ v..(.\|.4...CW....o.C..H....k".nJ....V.k.].y...oxe.&...a#...+.2..;..".'`.4Q'.,..8.`.....d.....c..:....o.?...I.!.I.L,.gN......j..:..uP...\.....(..R.....}U......!.pA.)..=.hc...TM

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	dropped
Size (bytes):	2370
Entropy (8bit):	5.308997650309371
Encrypted:	false
SSDEEP:	48:oY3QW7lrY3QL7lKY3Qg7lpY3QxT7lGbY3QC7l+Y3Qw67lvOWuOLGCOglOxTROCtm:oYgWtYgLIYggfYgxT8bYgC4Ygw6JOWuM
MD5:	21B50EC7174DAACCE8E513CA68AFAECB
SHA1:	20CDBEF99FD4F7DAF7B1099FCB8B8822FFED4096
SHA-256:	F3BCE8D5076013F122CDBC1D09B41C2E15D400B5753E0AB6A2D042E44A7B825B
SHA-512:	056355C054E56D5BA4951D938E872314142B92F9D336496AAC3C68BE3D6D6196D8FD148C105D0737DAE03597E8CC6D2724374F1DDD3EDDA1B98E8B38F88F63C4
Malicious:	false
Reputation:	low
Preview:	@font-face {. font-family: 'Raleway';. font-style: italic;. font-weight: 300;. src: url(https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4TbMDrMfJg.woff) format('woff');.}.@font-face {. font-family: 'Raleway';. font-style: italic;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4WjMDrMfJg.woff) format('woff');.}.@font-face {. font-family: 'Raleway';. font-style: italic;. font-weight: 500;. src: url(https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4VrMDrMfJg.woff) format('woff');.}.@font-face {. font-family: 'Raleway';. font-style: italic;. font-weight: 600;. src: url(https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4bbLDrMfJg.woff) format('woff');.}.@font-face {. font-family: 'Raleway';. font-style: italic;. font-weight: 700;. src: url(https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4Y_LDrMfJg.woff) format('woff');.}.@font

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	184
Entropy (8bit):	5.10694341188927
Encrypted:	false
SSDEEP:	3:0SYWFFWlIYCiF15RI5XwDKLRIHDfFRWdFTfqzrZqcdJ2dTv8EuRlG1LQUYARNin:0IFFm15+56ZRWHTizlpd0aFlcLFNin
MD5:	408681294E6694B3929BBC0B3EE38A9D
SHA1:	4E9885F43559CABE1A3EB66C2B08840ADE077C5E
SHA-256:	0D9374CF3695C6E0627D1A183B86C1F7C2A65EE4619B90EF04176D9CF69DD2A3
SHA-512:	48CC0ABDBF7604CFA6BA4CE93300AB7D2E4175C3177F7A7ABFA9C97223F542F6B3B7AD4E28AEB2073459AD1A206160335914FF6D95DD1341AF9F1A659EC81256
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.googleapis.com/css?family=Open+Sans
Preview:	@font-face {. font-family: 'Open Sans';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/opensans/v18/mem8YaGs126MiZpBA-UFVZ0d.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[3].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	169
Entropy (8bit):	5.07579670704692
Encrypted:	false
SSDEEP:	3:0SYWFFWlIYCZZ5RI5XwDKLRIHDfFRWdFTfqzrZqcdjK/mRtBsYARNin:0IFFN+56ZRWHTizlpdgmRtBaNin
MD5:	21293E4BE383F939F010DEEFB93A12DC
SHA1:	63B5D1E607AC77495ABCC9450717EFC4DD39B35B
SHA-256:	A026EF5D961447E008A0E17E2D1B5076A09D1AD83C1FE38C6954E66B420A8484
SHA-512:	EF6E376333D67B4354C185484F3DE1AC5E7C79B2B6A193FDCC0385CA0F62643A96C60DF8BB384BC5AC7B352993A14E7D4A2BBE201D6DE796513371D6D57C2F53
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.googleapis.com/css?family=Lato
Preview:	@font-face {. font-family: 'Lato';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/lato/v17/S6uyw4BMUTPHjx4wWA.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[4].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	208
Entropy (8bit):	5.24520196411175
Encrypted:	false
SSDEEP:	6:0IFFlMcC5+56ZRWHTizlpdAxawTdTmuNin:jF/EO6ZRoT6pixawTNmuY
MD5:	7FB85CAC150CA937798AE5B1067CD37C
SHA1:	135FB90710B0D35DFDE21EC7435A18115EA07855
SHA-256:	436CE6DA77B85F44967DA69ED53CE908B908F73AEE0243AEF7EE3BA650A225E0
SHA-512:	B0C53A0410200010A206A73E5C5A3A29E9CB00EAEB614E746150F8CA216F27938E8A26D3741D07ED08CB0D70CE5D46F08BF15E97213D02AA100702C7652C98E4
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.googleapis.com/css?family=Roboto+Slab
Preview:	@font-face {. font-family: 'Roboto Slab';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/robotoslab/v12/BngbUXZYTXPIvIBgJJSb6s3BzlRRfKOFbvjojISmb2Rl.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\css[5].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	175
Entropy (8bit):	5.036499950322848
Encrypted:	false
SSDEEP:	3:0SYWFFWlIYCzHRiRI5XwDKLRIHDfFRWdFTfqzrZqcdAqsKTFEfENRgVoYARNin:0IFFli+56ZRWHTizlpdAxIFGVuNin
MD5:	941B0F885D63EB60090D1DE0B493F1E2
SHA1:	456CBAE17E153391F0745E190A2FE44B9AD39A20
SHA-256:	4B1CEC019735D77E1DCB6911A520BFA438A2B5E027BD2799DE1EB83F2A110659
SHA-512:	01572411E7BA21E1B6FDCF7DFB6BA4BB17D14D8EAD7DE76018FE98753AA3DF5939A3B9DA46BE4EFB30041CDA5BA869B08F2658A134D0ABD738AB0C6B1F2F83EE
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.googleapis.com/css?family=Roboto
Preview:	@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(https://fonts.gstatic.com/s/roboto/v20/KFOmCnqEu92Fr1Mu4mxM.woff) format('woff');.}.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\ecustom16.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	36282
Entropy (8bit):	5.218096973189974
Encrypted:	false
SSDEEP:	384:dssUbWsOmFKSxYvhpBe3gcpnLIhDMPWXs87/3MeR3eYB5tOTDPSy6kyHDcoA:dsc9Qsplcp2FsE/3Me1ei5STJYvA
MD5:	7EB3F0E4EB5EC5719FAE53E4E47BBB7C
SHA1:	AE2FD7C4B5948FFD934D40B18DD436A36D0B1A52
SHA-256:	91CD7F618A639BD469004BA5DB1994A0AE3EC53B902E4EF635B34125E7606FA3
SHA-512:	FE78AC7E2A4507F379D99ED93DCFACC070E7F28D41B05410311158D5C00C15871D0C93F19FA5453971BAEAE28A0495BDB06A45EF1A7ABC3C2FD75BC108181655
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/ecustom16.min.js?ecv=1476291496
Preview:	function getParameterByName(a,b){b\|\|(b=window.location.href),a=a.replace(/[\[\]]/g,"\\$&");var c=new RegExp("[?&]"+a+"(=([^&#]*)\|&\|#\|$)"),d=c.exec(b);return d?d[2]?decodeURIComponent(d[2].replace(/\+/g," ")):"":null}function getScrollBarWidth(){if(jQuery("body").height()>jQuery(window).height()){var a=document.createElement("div");a.className="modal-scrollbar-measure",document.body.appendChild(a);var b=a.offsetWidth-a.clientWidth;return document.body.removeChild(a),b}return 0}function getURLParameter(a){return decodeURIComponent((new RegExp("[?\|&]"+a+"=([^&;]+?)(&\|#\|;\|$)").exec(location.search)\|\|[,""])[1].replace(/\+/g,"%20"))\|\|null}jQuery(document).ready(function($){eCornell16={winHeight:0,winWidth:0,init:function(){eCornell16.navHeight=1==$("#navHeader .navbar:first").size()?$("#navHeader .navbar:first").height():0;var is_touch_device="ontouchstart"in window\|\|window.DocumentTouch&&document instanceof DocumentTouch;is_touch_device?$("body").addClass("touch"):$("body").addClass("no-tou

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\et-line[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	7022
Entropy (8bit):	4.873707917133701
Encrypted:	false
SSDEEP:	96:GCVdsd9iOV4esZ7sl0jF8v1bYpdetWNSX5KBbZdf7TXvkaZQvwKjY8AzY3Q1Kj/n:HW9i8sZ7sSjB1opDHmM
MD5:	D286F6D047A94654DCC767FF8650A4FB
SHA1:	BEEA28710525A52A50A5062B05E7891F08B06D14
SHA-256:	BCCDCEAEED9F1CC3507A710EBD431572C743DC7A04DC568A36A7233ED2E28B7F
SHA-512:	2B9E7DEED30C139F25A30E0ADD936BA510D942F805730FAAD16BCB5F72CA8FE72A31CD5E2745494D9A94AD16B92A7EF5B573EE2FE606AA0C94F5B2D02199D273
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css
Preview:	@font-face {..font-family: 'et-line';..src:url('et-line.eot');..src:url('et-line.eot?#iefix') format('embedded-opentype'),...url('et-line.woff') format('woff'),...url('et-line.ttf') format('truetype'),...url('et-line.svg#et-line') format('svg');..font-weight: normal;..font-style: normal;.}../* Use the following CSS code if you want to use data attributes for inserting your icons /.[data-icon]:before {..font-family: 'et-line';..content: attr(data-icon);..speak: none;..font-weight: normal;..font-variant: normal;..text-transform: none;..line-height: 1;..-webkit-font-smoothing: antialiased;..-moz-osx-font-smoothing: grayscale;..display:inline-block;.}../ Use the following CSS code if you want to have a class per icon /./.Instead of a list of all class selectors,.you can use the generic selector below, but it's slower:.[class="icon-"] {./..icon-mobile, .icon-laptop, .icon-desktop, .icon-tablet, .icon-phone, .icon-document, .icon-documents, .icon-search, .icon-clipboard, .icon-newspape

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\et-line[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), et-line family
Category:	downloaded
Size (bytes):	32694
Entropy (8bit):	6.2203146870126975
Encrypted:	false
SSDEEP:	768:TXRqnlDDAvfzzf+fvpBF0bhVpAWJCIgrGTzlmFIhjdb97D1Rw:jIlDDA3f+fvLF0bhvApJqlmFIjJ7D1+
MD5:	26EC3C7D0366E0825D705C6E224A8803
SHA1:	64FC3A0BB255C48C19E8C8B84501B81DD19EFB35
SHA-256:	FF155EBF0561DC14160F7B7F713E21B4397AAC411627340AF0D861C11490AA87
SHA-512:	39D426CE91074B0CA8B229CA92DDD94E235E6E3FBDCA6EA87FE46E81312086E75716C28A40C2B123A1EC4EA3CCA648E7B8C8AB1C10277A3FAD4E0B34E0F933DA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.eot?
Preview:	..................................LP........................._......................e.t.-.l.i.n.e.....l.i.n.e.....V.e.r.s.i.o.n. .1...0.....e.t.-.l.i.n.e................PFFTMg..f..~.....GDEF......~.... OS/2/..4...X...Vcmap.w.....@...Rgasp......~.....glyfU......h..s.head..S........6hhea.r.........$hmtx...(........loca............maxp.......8... namef.\U..y8...}post..zC..z..............._._.<............................................................................_.....h...................@.................L.f...G.L.f....................................PfEd.@.............!...................................p.......0....... ........................... ...............P...............`...`.......@...........................P............... ...........0.......`.......0........... ...........`.......................`.......p...........p.......0.......0...@...@.......p...........................P................................................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\et-line[2].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	7022
Entropy (8bit):	4.873707917133701
Encrypted:	false
SSDEEP:	96:GCVdsd9iOV4esZ7sl0jF8v1bYpdetWNSX5KBbZdf7TXvkaZQvwKjY8AzY3Q1Kj/n:HW9i8sZ7sSjB1opDHmM
MD5:	D286F6D047A94654DCC767FF8650A4FB
SHA1:	BEEA28710525A52A50A5062B05E7891F08B06D14
SHA-256:	BCCDCEAEED9F1CC3507A710EBD431572C743DC7A04DC568A36A7233ED2E28B7F
SHA-512:	2B9E7DEED30C139F25A30E0ADD936BA510D942F805730FAAD16BCB5F72CA8FE72A31CD5E2745494D9A94AD16B92A7EF5B573EE2FE606AA0C94F5B2D02199D273
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/fonts/et-line.css?ver=5.5.3
Preview:	@font-face {..font-family: 'et-line';..src:url('et-line.eot');..src:url('et-line.eot?#iefix') format('embedded-opentype'),...url('et-line.woff') format('woff'),...url('et-line.ttf') format('truetype'),...url('et-line.svg#et-line') format('svg');..font-weight: normal;..font-style: normal;.}../* Use the following CSS code if you want to use data attributes for inserting your icons /.[data-icon]:before {..font-family: 'et-line';..content: attr(data-icon);..speak: none;..font-weight: normal;..font-variant: normal;..text-transform: none;..line-height: 1;..-webkit-font-smoothing: antialiased;..-moz-osx-font-smoothing: grayscale;..display:inline-block;.}../ Use the following CSS code if you want to have a class per icon /./.Instead of a list of all class selectors,.you can use the generic selector below, but it's slower:.[class="icon-"] {./..icon-mobile, .icon-laptop, .icon-desktop, .icon-tablet, .icon-phone, .icon-document, .icon-documents, .icon-search, .icon-clipboard, .icon-newspape

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\fbevents[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	92230
Entropy (8bit):	5.392331690409434
Encrypted:	false
SSDEEP:	1536:HM+OWt6w6aic9MeoFMXPwShThe7Kfv0a9sIOU1jaMu5Qm2B+QNSMngUSZYSlIUib:HOQZj1SVBYDGE
MD5:	F0684A30DBE1D82A5593941BBDC71CD1
SHA1:	22062B9EC3E75FAFE6F19D37A60D393DC4B64BBF
SHA-256:	ABDF01DBAB06EFBEC289CF85E83F8EC3618F996AB6803E9F9437DB14BC5CBF53
SHA-512:	081C5639AD728F4F21C5622B7E1FA6FD210EE78394D1FDBECA3654DC3CD29C2FADF0DBA63559A5F056988F54E20E735B64C123ADBC58C1A1CE56EEF9070F0799
Malicious:	false
Reputation:	low
IE Cache URL:	https://connect.facebook.net/en_US/fbevents.js
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\glyphicons-halflings-regular[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), GLYPHICONS Halflings family
Category:	downloaded
Size (bytes):	20127
Entropy (8bit):	7.955177976966453
Encrypted:	false
SSDEEP:	384:KMymENGOF7p8jngOxqVQhBWQE+eudXKQ++2fMfTF2/89NbbeGymiGCQ0YL:7ylqVxqVQ7WYe6KQf2fMfuCHeHWCNYL
MD5:	F4769F9BDB7466BE65088239C12046D1
SHA1:	86B6F62B7853E67D3E635F6512A5A5EFC58EA3C3
SHA-256:	13634DA87D9E23F8C3ED9108CE1724D183A39AD072E73E1B3D8CBF646D2D0407
SHA-512:	EFC910C96B9F5C58EA11A84577CF60AE995503B1EE670BB7E7D4A413B7403769920F82600B581F1BD4EE03D71C76C15255F0972ED66AD969487B5A4043F472C4
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/fonts/glyphicons-halflings-regular.eot?
Preview:	.N..AM............................LP........................'..,..................(.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s.....R.e.g.u.l.a.r...x.V.e.r.s.i.o.n. .1...0.0.9.;.P.S. .0.0.1...0.0.9.;.h.o.t.c.o.n.v. .1...0...7.0.;.m.a.k.e.o.t.f...l.i.b.2...5...5.8.3.2.9...8.G.L.Y.P.H.I.C.O.N.S. .H.a.l.f.l.i.n.g.s. .R.e.g.u.l.a.r.....BSGP.....................M..M..F........(u..<.0D.B/X..N....CC.^...rmR2sk..PJ"5+.gl.Wi.W./E...4#..U.~.f....UD.......J.1./!../...s..7...k.....(...h.N..8o..d$yq..1...9..@.-..HG.....S".Fj...6C3..&......W51.....B..a..QaR.U/..{......=.@d..h$..1.T.nc+c..A......Z..@Q.c.a....l..2>.K....m.' ....C.HM.fB.X.,.Y....p.e....U....*..z..m...i..O1nE.......hx!aC.XT..V..........R....%...\|I.H...P.5".b.N....=...r./_.R...._..%..uz....5.2....P.)........F.7S..q.F.{n.i.a....@D..s.;...}9..?........R{.Tk.;...U\N.Z..Q-.^.s..7.f.0....S3A..._n..`W.7P..p.....i..!.g./._p....Z.-=..~WZ#/.4 KF.`. ...z...0..\|.D........&d.I......;.M.{'.om..m..I...!w.i9\|H:.........{..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\header-only[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	29108
Entropy (8bit):	4.9586751143137775
Encrypted:	false
SSDEEP:	384:+xrn13ZM09tvHquskysI+QB/Fa/aNNRpcHFhszyXYVPQsw5S4SZYTMtAvJLPUzS0:iVdzq9xE3qFS7QNdWhX8yoLyMQ0znWDY
MD5:	185AA86909C5DCCFE8BBF2917DB26E3E
SHA1:	2C59FE3F2FBAAE5CB61FFBAA2CBE159B160BD2CB
SHA-256:	794E54B50F269E275050A62997944D9211E661781A0A8E9D141691422DCD7961
SHA-512:	8CF1AEF2167D0A5B46B613986DD25A9940453B13BD1748FFBD2D7CF4CC3E429D090BA169C4C5FC6C977AF4D226A58091C839A36B51D4467F313E04FC1722CEBB
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Header Only \| eCornell</title><link rel="profile" href="http://gmpg.org/xfn/11" /> HTML5 shim and Respond.js for IE8 support of HTML5 elements and media queries --> [if lt IE 9]> <script src="https://oss.maxcdn.com/libs/html5shiv/3.7.2/html5shiv.js"></script> <script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script> <![endif]--><link rel="pingback" href="https://www.ecornell.com/xmlrpc.php" /> <script type="text/javascript">//store template dir in js variable..var templateDir = "https://www.ecornell.com/wp-content/themes/ecustom18";..document.domain = document.domain.split(".").slice(-2).join(".");//allows cross subdomain communication.. var ws_api_endpoint = 'https://cuttlefish.ecornell.com/api/';...var use_https = true;..var destinyPublicViewHost = 'https://portal.ecornell.com';...var webseries_mode = 'produ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\iframe_api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	810
Entropy (8bit):	5.29635255624997
Encrypted:	false
SSDEEP:	24:E1PgYtpqAK/HJ2TAXC5vuHM8aJLtdRWZ4FhQ:E1DPcSAXC5kaJLzwYhQ
MD5:	810AFF273AE94417C8F38EAB21813DD3
SHA1:	0FF1A3BF697CD8373287C519C3D440EB865DB34A
SHA-256:	2B5521E49DFC253C57DD27E58B56366A5707F7B0835D8CD2F75A4F2F40599C45
SHA-512:	103C8FF466988924E42DB33D46A502D1E68E6599B7AC187DA43BAE3E1D2DB7790FD4ED4B1C2EA892C2F580B9B0042DAE84919EA8572176551DA46DB8F4611DE8
Malicious:	false
Reputation:	low
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/5dd3f3b2\/www-widgetapi.vflset\/www-widgetapi.js';if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;for(var i=0;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){for(var k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",n)}var b=.document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	98730
Entropy (8bit):	5.5144979135047665
Encrypted:	false
SSDEEP:	3072:JB4bXR7peBY0P2JqUgumBlTjw/UTYBpN+:PmiIQGBj+
MD5:	0F052F4EFEF65D0CEC215AC8742DE22C
SHA1:	9D5B19D1C2E9A6AE8C56E5868BB232A46BE27BA0
SHA-256:	ECE3F79F2C55445BE9D8E4424F9C5AA62E6A567F0EFC9FC60B951816A564A95F
SHA-512:	23EA7BC18832F1BEAAEEBD448B4849B42D144E38BF32D8F4E60E7FDC346360F1339EC99E5D4F895C08E90CB2A1F889C3FECE0DA4FD3496ECD549A325EB5082AF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtag/js?id=AW-1072640399
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"1",. . "macros":[{. "function":"__e". },{. "function":"__cid". }],. "tags":[{. "function":"__rep",. "once_per_event":true,. "vtp_containerId":["macro",1],. "tag_id":1. }],. "predicates":[{. "function":"_eq",. "arg0":["macro",0],. "arg1":"gtm.js". }],. "rules":[. [["if",0],["add",0]]].},."runtime":[].....};./.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var ba,ca=function(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}},da=function(a){var b="undefined"!=typeof Symbol&&Symbol.iterator&&a[Symbol.iterator];return b?b.call(a):{next:ca(a)}},ea="function"==typeof Object.create?Object.create:function(a){var b=function(){};b.prototype=a;return new b},ha;.if("function"==typeof Object.setPrototypeOf)ha=Object.setPrototypeOf;else{var ia;a:{var ja={wg:!0},la={};

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\linkid[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1569
Entropy (8bit):	5.369127779967127
Encrypted:	false
SSDEEP:	48:Xpm6RFvCzWzAiWqSeTqn1PByqka1cUj54/vD978:5pfpy1Pkqka1cS52b978
MD5:	0CC3A63FE10060AF4A349E5DF666EEFE
SHA1:	3E8D3925B550345123F2CAB26568221FD4154F9C
SHA-256:	92FCA55833F48B4289AC8F1CEDD48752B580FCE4EC4B5D81670B8193D6E51B54
SHA-512:	5801C9DB98C4998480772CA5AD71F0E400C4756AE713AAB0358CA6593B3A3426499D6DEC81A768C861CBBCD8394DD8C6D647628A13F124FF3A1119F9B7793E8C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/plugins/ua/linkid.js
Preview:	(function(){var e=window,h=document,k="replace";var m=function(a,c,d,b,g){c=encodeURIComponent(c)[k](/$/g,"%28")[k](/$/g,"%29");a=a+"="+c+"; path="+(d\|\|"/")+"; ";g&&(a+="expires="+(new Date((new Date).getTime()+g)).toGMTString()+"; ");b&&"none"!=b&&(a+="domain="+b+";");b=h.cookie;h.cookie=a;return b!=h.cookie},p=function(a){var c=h.body;try{c.addEventListener?c.addEventListener("click",a,!1):c.attachEvent&&c.attachEvent("onclick",a)}catch(d){}};var q=function(a,c,d,b){this.get=function(){for(var b=void 0,c=[],d=h.cookie.split(";"),l=new RegExp("^\\s"+a+"=\\s(.?)\\s$"),f=0;f<d.length;f++){var n=d[f].match(l);n&&c.push(decodeURIComponent(n[1][k](/%28/g,"(")[k](/%29/g,")")))}for(d=0;d<c.length;d++)c[d]&&(b=c[d]);return b};this.set=function(g){return m(a,g,b,c,1E3*d)};this.remove=function(){return m(a,"",b,c,-100)}};var t=function(a,c){var d=void 0;if("function"==typeof a.get&&"function"==typeof a.set){var b=c\|\|{},g=b.hasOwnProperty("cookieName")?b.cookieName:"_gali",r=b.hasOwnProper

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\login[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	14839
Entropy (8bit):	5.620674378055253
Encrypted:	false
SSDEEP:	384:6d02c4c4VIVr2gb+cX7+n/vrJaLkEGodGdmdqdGdkd4dPXdYd5bdiXZl7h1puW:xVrF+e7+bJO5sUg8WCpXCtiXZRh1pl
MD5:	10E7301BFEEFC0887CEB86FC3F3D6F7C
SHA1:	144EEA48A1AD243DB35363EE75DC9983D2827809
SHA-256:	E68D776E867C0694D86A6EAC6315781B31799CD9129FFA70DC10B528DA1F04CE
SHA-512:	A39B4ECFDE20D78505FB53EA46F202B7D3BFEC05131050D86BAA0ED742DE8513CC7D635F87D241E65173934200BD4813066292C781D57D02B6A41568E7A08F8A
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html>................<html lang="en-US">.<head>. <meta charset="UTF-8" />. <meta name="viewport" content="width=device-width, initial-scale=1.0">. <link rel="icon" href="/cas/favicon.ico" type="image/x-icon"/>. <title>eCornell \| Log in</title>.. <link rel="stylesheet" href="//www.ecornell.com/wp-content/themes/ecustom18/css/bootstrap.min.css" type="text/css" media="all"/>. <link rel="stylesheet" href="//www.ecornell.com/wp-content/themes/ecustom18/style.css"/>. <link rel="stylesheet" href="//www.ecornell.com/wp-content/themes/ecustom/css/external_headers.css" type='text/css' media='all' />. <script type="text/javascript" src="//www.ecornell.com/wp-includes/js/jquery/jquery.js"></script>. <script type='text/javascript' src='//www.ecornell.com/wp-includes/js/jquery/jquery-migrate.min.js'></script>.. .. <script>. document.domain = "ecornell.com";//allows cross subdomain communication. </script>.. <style>. body {. pa

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\logo_48[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 48 x 48, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	2228
Entropy (8bit):	7.82817506159911
Encrypted:	false
SSDEEP:	48:4/6MuQu6DYYEcBDlBVzqawiHI1Oupgl8m7NCnagQJFknwD:4SabhtXqMHyCl8m7N0ag6D
MD5:	EF9941290C50CD3866E2BA6B793F010D
SHA1:	4736508C795667DCEA21F8D864233031223B7832
SHA-256:	1B9EFB22C938500971AAC2B2130A475FA23684DD69E43103894968DF83145B8A
SHA-512:	A0C69C70117C5713CAF8B12F3B6E8BBB9CDAF72768E5DB9DB5831A3C37541B87613C6B020DD2F9B8760064A8C7337F175E7234BFE776EEE5E3588DC5662419D9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/api2/logo_48.png
Preview:	.PNG........IHDR...0...0.....W.......gAMA......a.... cHRM..z&..............u0...`..:....p..Q<....bKGD.......C......pHYs.................IDATh...P....=..8.....Nx. ..PlP8..;.C.1iL#6....Z..!......3.po .o.L.i.I..1fl..4..ujL&6$...............w...........,Z..z. ~.....\.._.C.eK...g..%..P..L7...96..q....L.....k6.....,xz.._......B."#...L(n..f..Yb....8.;....K)N...H).%.F"Ic.LB.........jG.uD..B....Tm....T..).A.}D.f..3.V.....O.....t_..].x.{o..........x?!W...j..@..G=Ed.XF.........J..E?../]..?p..W..H..d5% WA+.....)2r..+..'qk8.../HS.[...u..z.P.....-.A.}.......I .P.....S....\|...)..KS4....I.....W...@....S.s..s..$`.X9.....E.x.=.u.iJ...........k......'...!.a....*+.....(...S..\h....@............I.$..%.2....l......a.\|.....U....y.....t..8....TF.o.p.+.@<.g........-.M.....:.@..(.......@......>..=.ofm.WM{...e..,..D.r.......w....T.L.os..T@Rv..;.....9....56<.x...........2.k.1....dd.V.....m..y5../4\|...G.p.V.......6...}.....B........5...&..v..yTd.6...../m.K...(.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\qevents[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	39437
Entropy (8bit):	5.500736002670866
Encrypted:	false
SSDEEP:	768:1keY2NWshOGfV8Cj72zizyzMzqNUtZ8Z2l6:qei+OGfVXRtCE6
MD5:	F32EBB1E93A72C0A57ADD6D07F688510
SHA1:	378E422EA3F93A1AE682A54271D9F014F470BFB8
SHA-256:	EF6DE6BEB1CF5BF809ECCFE10F99AEA0E0969C71D4EAB5446410FEF72695679F
SHA-512:	210A34338B12CC4BA774A4E2E68E17A8D73A8615C99CA9EBFBDF4DA9B126A1791F7D45492B67F8A20D2751BF33925F47A99F7710A21025C890C50F150653EA44
Malicious:	false
Reputation:	low
IE Cache URL:	https://a.quora.com/qevents.js
Preview:	!function(t,e){"object"==typeof exports&&"object"==typeof module?module.exports=e():"function"==typeof define&&define.amd?define([],e):"object"==typeof exports?exports.qevents=e():t.qevents=e()}(this,function(){return function(t){function e(n){if(r[n])return r[n].exports;var i=r[n]={i:n,l:!1,exports:{}};return t[n].call(i.exports,i,i.exports,e),i.l=!0,i.exports}var r={};return e.m=t,e.c=r,e.d=function(t,r,n){e.o(t,r)\|\|Object.defineProperty(t,r,{configurable:!1,enumerable:!0,get:n})},e.n=function(t){var r=t&&t.__esModule?function(){return t["default"]}:function(){return t};return e.d(r,"a",r),r},e.o=function(t,e){return Object.prototype.hasOwnProperty.call(t,e)},e.p="",e(e.s="./shared/qevents/main.js")}({"./shared/Class.js":function(t,e){function r(t,e){function r(){if(i\|\|(t.call(c),n(h,e,a),i=!0,e=null),this!==c){var r=this.__init__;r&&r.apply(this,arguments)}}var i,a=s.prototype=t.prototype,h=new s;return r.prototype=h,r.extend=o,h.constructor=r,r}function n(t,e,r){for(var n in e)e.ha

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\smooth-scroll[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2567
Entropy (8bit):	5.027245098433411
Encrypted:	false
SSDEEP:	48:keJje4NPPT3uxVFWOD0wz0EhQnjZiL61HSmRGrB8ruk:/r+osj0Zj313RGtW
MD5:	544E62F4ADC7CF161ACBD5CB1AC70D00
SHA1:	971F73E18F5A9CF780D95F68B01B78D1B0937C2B
SHA-256:	3CBE9D2AD12FAF05931BCA711AD672EA2D2D58EB445B685D760C329C34330720
SHA-512:	26C2F4DDAFE552DE9A57A8212BB4193B0766ABD082CEEC41D950D81913F9AC0FD37472751EAF0B2901EB846C370DFF3202CCBD40F25A8C789DC7181879CFAE99
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/ecustom16/smooth-scroll.js
Preview:	(function(){'use strict';if('querySelector'in document&&'addEventListener'in window&&Array.prototype.forEach){var smoothScroll=function(anchor,duration,easing,url){var easingPattern=function(type,time){if(type=='easeInQuad')return timetime;if(type=='easeOutQuad')return time(2-time);if(type=='easeInOutQuad')return time<0.5?2timetime:-1+(4-2time)time;if(type=='easeInCubic')return timetimetime;if(type=='easeOutCubic')return(--time)timetime+1;if(type=='easeInOutCubic')return time<0.5?4timetimetime:(time-1)(2time-2)(2time-2)+1;if(type=='easeInQuart')return timetimetimetime;if(type=='easeOutQuart')return 1-(--time)timetimetime;if(type=='easeInOutQuart')return time<0.5?8timetimetimetime:1-8(--time)timetimetime;if(type=='easeInQuint')return timetimetimetimetime;if(type=='easeOutQuint')return 1+(--time)timetimetimetime;if(type=='easeInOutQuint')return time<0.5?16timetimetimetimetime:1+16(--time)timetimetime*time;return time;};var updateURL=functio

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\2WF3MMUU\styles__ltr[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	51171
Entropy (8bit):	5.96817954851436
Encrypted:	false
SSDEEP:	768:+LUmmAWTe2uXYp8Mi+yKSrKebyBwNDl+xedtY5PoiDH1fkQJVEwY:4UcW6v+2rKwNDliP7dnY
MD5:	A6338B6C3AAEBFF39D194BAB215524F9
SHA1:	B29E72AA39A20BC15199E6FC98DFDBF447D71AF3
SHA-256:	B32D419311E9C267D3EA1DA7C0832D21A0D89829D35A98F92BF7DF780FE72D4F
SHA-512:	9F8065642BA6F638BFD1E9AA5694BD032EA18FFDB4141240FD8740C2093FBA59BDA7369484669BFAE2E7011CCB641992AEFC041371BAB61D8FD2B80B916A9B4C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/styles__ltr.css
Preview:	.goog-inline-block{position:relative;display:-moz-inline-box;display:inline-block}* html .goog-inline-block{display:inline}*:first-child+html .goog-inline-block{display:inline}.recaptcha-checkbox{border:none;font-size:1px;height:28px;margin:4px;width:28px;overflow:visible;outline:0;vertical-align:text-bottom}.recaptcha-checkbox-border{-webkit-border-radius:2px;-moz-border-radius:2px;border-radius:2px;background-color:#fff;border:2px solid #c1c1c1;font-size:1px;height:24px;position:absolute;width:24px;z-index:1}.recaptcha-checkbox-borderAnimation{background-image:url(data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAFQAAANICAYAAABZl8i8AAAABmJLR0QA/wD/AP+gvaeTAAAACXBIWXMAAABIAAAASABGyWs+AAAACXZwQWcAAABUAAADSAC4K4y8AAA4oElEQVR42u2dCZRV1ZX3q5iE4IQIiKQQCKBt0JLEIUZwCCk7pBNFiRMajZrIl9aOLZ8sY4CWdkDbT2McooaAEmNixFhpaYE2dCiLScWiQHCgoGQoGQuhGArKKl7V+c5/n33fO/V4w733nVuheXuv9V/rrnvP2Xud3zvTPee+ewsKxMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExMTExP4OdtlT6ztAbRWvvLy8A3QkwxzH6tBGMMexI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4Y_LDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26476, version 1.1
Category:	downloaded
Size (bytes):	26476
Entropy (8bit):	7.981436561198008
Encrypted:	false
SSDEEP:	768:/9+Bz3xdX4xFzmiJOu9urlPbzY8rz+N5Bhi:/9+t3v4HmiPCLrojhi
MD5:	9B4F2EC80E572A0571A15BD0B61539E4
SHA1:	825441EE9ADA5ED345A649CB68F14C0E271C6910
SHA-256:	E2CB182D991D22429C296295C1021F6863926D8B80E095D4D48A0F072304EB93
SHA-512:	8D0B87078206EBCD91CB94C3E95BAB482412B59FD36E1C844D3E0847634237B3A557191047C6B3DB9B746BA56B0936064B2B62850BF5758102551477102C15F4
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4Y_LDrMfJg.woff
Preview:	wOFF......gl................................GDEF.......m.......PGPOS.......@..6.$..jGSUB...D...C........OS/2.......R...`b..RSTAT.......6...@...(cmap............Kd.lcvt .......g........fpgm...0...........Zgasp..'.............glyf..'...8...Y.<9t.head.._....6...6..._hhea..`....#...$...1hmtx..`<...s........loca..b............smaxp..d.... ... ....name..d....0....>.\.post..f........ ...2prep..f....M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T..p.P.....m..;.m..'.m.m....8.3....."'..W.b.....;......=....8.8.:...1.....b.i..8....M.;Y.Oq......S.xS...S...D.f..532.9%\|#.&^#~&QJ...n..s+"..J.2o6.u\|..rHyEu-.Z........QoR.......bZ..4.t\|RV.]7Ew. 4.3T5N2.0.Kq...\.\9e&..Y.X.Y.X.[O.`K.....}....s,pls.q\r.p.r.!.\.<.=.=.U......N.1...E4.\|.\|......}...3...;..@.@\p....z..`.....P.&qXD..+..UX..XG.b...M...I.`7...8.i8G..*Y.[...x..X..x...C..".>.0;........a8....<"..D.......#..A...e......D.]@.q....i@c..0....(Y23.\|a..3[v..=

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4ejLDrMfJg[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26460, version 1.1
Category:	downloaded
Size (bytes):	26460
Entropy (8bit):	7.982206803906658
Encrypted:	false
SSDEEP:	768:VKh49Iw5vD7laxFzggo3QyO7mxi6lphp5sAxFn:lI4YHYQjyxi6/hvsoFn
MD5:	5D063510E6638915D1054831FC10CD3E
SHA1:	AE12FB53223534631502BD94FC0FA0FB4C9FFD48
SHA-256:	CFC087ABD3FA37470277D2D6F2E0486F45A5D663BEEC4CA4A82A91C85C6609C0
SHA-512:	306D04E8FE4A6F1CE3485A1CFBC91BC29ABC0473A28B8BE6CC0A1B3E32A52CFC3DE3F06DD78EF9B70E0E9A5B82E39AE159A422570D0C0BC68397E3AA6D1DE99C
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Pt_g8zYS_SKggPNyCgSQamb1W0lwk4S4ejLDrMfJg.woff
Preview:	wOFF......g\................................GDEF.......m.......PGPOS.......C..6..A.GSUB...H...C........OS/2.......R...`b..2STAT.......6...@.5.)cmap............Kd.lcvt .......g........fpgm...4...........Zgasp..'.............glyf..'...8...Y..5._head.._....6...6..._hhea.._....#...$...1hmtx..`....x.......nloca..b...........z.maxp..d.... ... ....name..d....B....M~m.post..e........ ...2prep..f....M....i..[x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.T...$A...?...6.m.m.m.m.6..../.....#%.CT.h..06..5...tn.#...X..U..m!.e1O.!......Z....L.?.,-.H.....&r....p....r..:S.T.w..).,])},S.....+.*S........T7..c.~.E..xZ^[^.WwPwP.^{T.......zg...J.;k........&..LP.<..:.E.kkVk.7.z.6......~...P.~.K.{.W.j.\.f.N.y.S.w.I.....W..._._>NG.../p..?.......`.`.`.`.`.......P.P.p.......TA/.}1.=1...\|2....C..+0...(.%....1...D. ...'1...b\"Kp....1.`.^........0........h@y{....U.a...G..1...f.0....OX.`.;.u..6..n...2......~.E......z..;.;..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\anchor[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	dropped
Size (bytes):	13482
Entropy (8bit):	5.962289926761156
Encrypted:	false
SSDEEP:	384:3/SLAuB+XMvaBR+4ed6+RcFfASLHgZHOLQUCcIC2x7kt:3/SLA2apewJFfyMCC
MD5:	9FBEC8017047E83E60D029A02560A83C
SHA1:	DBBCED151C9B651E21BB388DC78A516679AA8A35
SHA-256:	414E5E7828D4F91F56C0D01E1EC3246830D91992769C18432C84BF98EE83C34D
SHA-512:	E11652B47ABC0F950826923A2D24736DE342F2898F6A9F3099F34CE0348DC8815B04C6C6277B7CC3EE0BFB62FFF5879C8CA76EA614150B96DB359D5D3194BBF1
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE HTML><html dir="ltr" lang="en"><head><meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.<meta http-equiv="X-UA-Compatible" content="IE=edge">.<style type="text/css">.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOmCnqEu92Fr1Mu4mxP.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 500;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmEU9fBBc9.ttf) format('truetype');.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 900;. src: url(//fonts.gstatic.com/s/roboto/v18/KFOlCnqEu92Fr1MmYUtfBBc9.ttf) format('truetype');.}..</style>.<link rel="stylesheet" type="text/css" href="https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/styles__ltr.css" nonce="nhfM8tFDE6401wWAjlqSxA">.<script nonce="nhfM8tFDE6401wWAjlqSxA" type="text/javascript">window['__recaptcha_api'] = 'https://www.google.c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\async-ads[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	185812
Entropy (8bit):	5.589259866838173
Encrypted:	false
SSDEEP:	3072:Xw2aA6J0HL9N14NzcRsT3XylZ3OcYOxCdCb:4n2KzDW7Txbb
MD5:	BA87C99E3801256CD5ADEFD129F3ECEC
SHA1:	BBEB10F3AFC120774E643F9137BAF86317A50B5F
SHA-256:	0537BE18C93DC1AAAF35760C6AFCFF11CC98C96382241765AE363921431E0889
SHA-512:	D415AA589A0669B834E833A8FFEE5D62001CFB150C537955202FEBDB69C64E0C5CE9C9819E41B8D212373AA506381A8EB5ED0091213E4BA8430A8AC185B103E1
Malicious:	false
Reputation:	low
IE Cache URL:	https://cse.google.com/adsense/search/async-ads.js
Preview:	if(!window['googleNDT_']){window['googleNDT_']=(new Date()).getTime();}window._googCsaExpIds='17300441,17300444,17300494,17300497,17300584,17300587';window._googCsaAlwaysHttps=1;window._googEnableCcpa=1;window._googEnableCcpaForCanoeV2=1;window._googEnablePurposeOneEnforcement=1;window._googEnableQup=1;window._googErrorTurnOffPersonalization=1;window._scs_mismatch=1;window._googTimeoutTurnOffPersonalization=1;window._googLazyLoadingRootMargin=0;window._googTcfApiTimeout=-1;window._googUspApiTimeout=500;(function() {window.googleAltLoader=4;var version_='3.0';var hash_='8936340713842065598';var module_='ads';var packages_='search';var googleApisBase_='https://ajax.googleapis.com/ajax';var serviceBase_='https://cse.google.com/uds';var serviceHost_='cse.google.com';/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var g;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var ba="function"==typeof Object.definePrope

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	35955
Entropy (8bit):	5.180686842452126
Encrypted:	false
SSDEEP:	768:b8lBD27UwlNBMl9nqahC2+jS1g8ep0skCXFXflcKGf3Z1RQ:oe782S1Klvla3ZrQ
MD5:	7B11D4990D6667CC235919ADC908A16B
SHA1:	C232D7B67903824883A88C68E1F4AD4ABD232B27
SHA-256:	ABEC73FCADC5A8B680BF4174F9D36B5B0CA3DA327D32E29816B16D8F1F2FF497
SHA-512:	14CB57939CD724F52218B8CD0482277547809FEDEDB393EB9FDB34A66D5B2D1C80282AC1980D25B3D65D7D25D9C0B37316D94A84478ABFECE5916E8A219672B3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/ecustom16/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.4 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\clear[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	1018
Entropy (8bit):	6.094138866101745
Encrypted:	false
SSDEEP:	24:6y1hpunQWwjx82lY2T3gV10/+yJ3VQN948GiFF7waYaq:6witNn2cCJ3R8tXYx
MD5:	2DF778BF2E22D52FE849BABB330EC977
SHA1:	0F833F030BB43F282473BDDD3A33B5F8CBA7A845
SHA-256:	329D1A750114920332EADC55C129957D9DBE5A1B25745E2F7E0ED4FAD75E04CD
SHA-512:	9CB103E634A832271D2FE840A5AF3107CDB2E92290810B65692A805C29DCDC11C86B773CBF38F0F0E202EC9D0E76C125EA93F96B63521571F57C03568E7F747B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/cse/static/css/v2/clear.png
Preview:	.PNG........IHDR..............2.....tEXtSoftware.Adobe ImageReadyq.e<..."iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.0-c060 61.134777, 2010/02/12-17:32:00 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS5 Macintosh" xmpMM:InstanceID="xmp.iid:29EC528B41B211E1979DCD8193D1E756" xmpMM:DocumentID="xmp.did:29EC528C41B211E1979DCD8193D1E756"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:29EC528941B211E1979DCD8193D1E756" stRef:documentID="xmp.did:29EC528A41B211E1979DCD8193D1E756"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>.VA....nIDATx.bLKKK```..b.Y.f]`@.@9. ........@.P.tE .~F4.. ..jQ......U.W.r.#......8L.D..&.3L.. .Pw9B..A.RX..p.@S\..`...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\external_headers[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	249
Entropy (8bit):	4.940719443604247
Encrypted:	false
SSDEEP:	6:z8HpULLV3Ri6rVJWJE7+91RNBHgCMD3Oi7IUKuODugyeMen:zAMLZdVJW91RrCD3Oi7SuODugyS
MD5:	3B8DB3034000A2A173CB72117D0CC771
SHA1:	24B501E37E1BABC3BA92D66805D6ECBBC75FC6DB
SHA-256:	026E519666929C827321D13CF8838382B3FDE3949B02826BF2CD109E2B565E51
SHA-512:	AE8E34612D06F388823A9E52C0E9A4C23A2AB9CC293C2ADC1F36E3AD505A951054AB56B7D107B3EC59BA3CF5E7106BF55E042080A3C79C6D854FDD17F6E8767D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom/js/external_headers.js
Preview:	jQuery(document).ready(function ($) {//important to pass the $ because somewhere else in WP uses jQuery.noConflict(), which invalidates the $..if ($.fn.iFrameResize) {...$('iframe.resizeframe').iFrameResize({'log':false, checkOrigin: false});..}.});

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	6998
Entropy (8bit):	5.475416897153196
Encrypted:	false
SSDEEP:	192:OCAUAOnGU93NpigmiEcUTvuUL+H6l4/b+:zAEj3Npini1UTvuG+aO+
MD5:	387F1BDDFB6E1950B219516487D1125E
SHA1:	40D9236732F74CEEE4DE9243EC47896C6C579066
SHA-256:	E79FB218B6E9A35756E94E36A1DF4FA8F5177DACCB83B8EC5F933B3329B07F3D
SHA-512:	013F7B6484DDE9386602D72645378B66210482A02231F08AB6288CAED88C261F67456F32206F4294145D2B4848D6AB8DFEE487DC7FD7E4C5401307D09DFD6C44
Malicious:	false
Reputation:	low
Preview:	(function(opts_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,g=/^[\w+/_-]+[=]{0,2}$/,k=null,l=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&g.test(a)?a:""},m=function(a,b){function c(){}c.prototype=b.prototype;a.prototype=new c;a.prototype.constructor=a},n=function(a){return a};var p=function(a){if(Error.captureStackTrace)Error.captureStackTrace(this,p);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))};m(p,Error);p.prototype.name="CustomError";var r=function(a,b){a=a.split("%s");for(var c="",e=a.length-1,d=0;d<e;d++)c+=a[d]+(d<b.length?b[d]:"%s");p.call(this,c+a[e])};m(r,p);r.prototype.name="AssertionError";var t=function(a,b,c){if(!a){var e="Assertion failed";if(b){e+=": "+b;var d=Array.prototype.slice.call(arguments,2)}throw new r(""+e,d\|\|[]);}},u=function(a,b){throw new r("Failure"+(a?": "+a:""),Array.prototype.slice.call(arguments,1));};var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\f[2].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	31076
Entropy (8bit):	5.508583463195817
Encrypted:	false
SSDEEP:	384:dNpa2eCbkJiQR42b2a5MIurQCprYNBkDvCgQAu6aJwFdzyFD1jdNELWmg:jpr4BM7tprYNBkDC1pxL
MD5:	239671CA64D958DBA93EA790BF6B8C80
SHA1:	D7F165DE5C212F9B9CD0E5C9B24BB8C3E040A4C3
SHA-256:	E1EC254792B6FE5CB168D2CE9CB1E35D15311D3B357B305A95CBFB12552477D0
SHA-512:	F13E47A5CAF252F599D3001C03D0E34247F75819822C80B498D3229AE1AF267124F77E52610C67971D6ED6FBCAB6D28B1C0E62A56F505144F92BCDE0809F2962
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googleadservices.com/pagead/conversion_async.js
Preview:	(function(){/* . . Copyright The Closure Library Authors. . SPDX-License-Identifier: Apache-2.0 .*/ .function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}var l="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a}; .function ba(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}var ca=ba(this),da="function"===typeof Symbol&&"symbol"===typeof Symbol("x"),p={},ea={};function t(a,b){var c=ea[b];if(null==c)return a[b];c=a[c];return void 0!==c?c:a[b]} .function u(a,b,c){if(b)a:{var d=a.split(".");a=1===d.length;var e=d[0],f;!a&&e in p?f=p:f=ca;for(e=0;e<d.length-1;e++){var g=d[e];if(!(g in f))break a;f=f[g]}d=d[d.length-1];c=da&&"es6"===c?f[d]:null;b=b(c);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\favicon[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	6.946885890202017
Encrypted:	false
SSDEEP:	6:6v/lhPp+gIoCkE7d9VBUAqgsuftotbtfvM2Edk+l+3zup:6v/7EoCkEx9VBBFloHekQEc
MD5:	3A3A9212B588038E742EE7D2F0562650
SHA1:	C06311AEAFEAD4D369849E4C4034B7C2888CC357
SHA-256:	446D80942895EDBE68FE940A9E143F69E84391F7CCB5FB9A92DF75615952BC36
SHA-512:	B824C07F75C61DCB10CD34FB42F7241AE900192D56650B7F842FB366C80821D78ABC03657CF0354F59877279E967890D95D1D396570D19502016B48BC4E3B1C6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/img/favicon.png
Preview:	.PNG........IHDR................a....IDAT8...R.Q....2.8.F.b..j.ka.....\|.i.f.Z..-D;Q..... x...>....g..w...f<`.5N...r.1lG_....._tB.$H.{.*6..........;A.}S#...((.:.6....5...,.^.@..#.A0.L..)......8..vJ<.l.]..g..&..8...x.\|..N..../..2...R]DH.>.@.-..%.K.z.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\ga[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	46274
Entropy (8bit):	5.48786904450865
Encrypted:	false
SSDEEP:	768:aqNVrKn0VGhn+K7U1r2p/Y60fyy3/g3OMZht1z1prkfw1+9NZ5VA:RHrLVGhnpIwp/Y7cnz1RkLL5m
MD5:	E9372F0EBBCF71F851E3D321EF2A8E5A
SHA1:	2C7D19D1AF7D97085C977D1B69DCB8B84483D87C
SHA-256:	1259EA99BD76596239BFD3102C679EB0A5052578DC526B0452F4D42F8BCDD45F
SHA-512:	C3A1C74AC968FC2FA366D9C25442162773DB9AF1289ADFB165FC71E7750A7E62BD22F424F241730F3C2427AFFF8A540C214B3B97219A360A231D4875E6DDEE6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://ssl.google-analytics.com/ga.js
Preview:	(function(){var E;var g=window,n=document,p=function(a){var b=g._gaUserPrefs;if(b&&b.ioo&&b.ioo()\|\|a&&!0===g["ga-disable-"+a])return!0;try{var c=g.external;if(c&&c._gaUserPrefs&&"oo"==c._gaUserPrefs)return!0}catch(f){}a=[];b=n.cookie.split(";");c=/^\sAMP_TOKEN=\s(.?)\s$/;for(var d=0;d<b.length;d++){var e=b[d].match(c);e&&a.push(e[1])}for(b=0;b<a.length;b++)if("$OPT_OUT"==decodeURIComponent(a[b]))return!0;return!1};var q=function(a){return encodeURIComponent?encodeURIComponent(a).replace(/$/g,"%28").replace(/$/g,"%29"):a},r=/^(www\.)?google(\.com?)?(\.[a-z]{2})?$/,u=/(^\|\.)doubleclick\.net$/i;function Aa(a,b){switch(b){case 0:return""+a;case 1:return 1a;case 2:return!!a;case 3:return 1E3a}return a}function Ba(a){return"function"==typeof a}function Ca(a){return void 0!=a&&-1<(a.constructor+"").indexOf("String")}function F(a,b){return void 0==a\|\|"-"==a&&!b\|\|""==a}function Da(a){if(!a\|\|""==a)return"";for(;a&&-1<" \n\r\t".indexOf(a.charAt(0));)a=a.substring(1);for(;a&&-1<" \n\r\t".i

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\gtm[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	186802
Entropy (8bit):	5.522371600531841
Encrypted:	false
SSDEEP:	1536:TElC9fzrMZMPNYQXSmohs29hMVGvW2MvlsXGroDsH0/2/+9L0axEunkUQA4bmg18:IgeQoa2MvOXGrqsH0/kwXDymiRPkll
MD5:	3EED68F1A523E70D2BD7D0BAAC105B87
SHA1:	F57BBB6E95C2002ED8734E0DCB433C2F8BD4642A
SHA-256:	D32BD8330D73F9B3BCAAD092F73E1FCBBF352410CDF37DC9F75E7DE66D0B274A
SHA-512:	BA4360C68C5571B81B86D7CFFEDD9D13385426553D4B92E8A47D6F265B4B79F66D18A564127316F706A840BD7C29969518D0165A9EFB003D7E6C0B7073771D15
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.googletagmanager.com/gtm.js?id=GTM-M89LQJ
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(w,g){w[g]=w[g]\|\|{};w[g].e=function(s){return eval(s);};})(window,'google_tag_manager');(function(){..var data = {."resource": {. "version":"131",. . "macros":[{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__e". },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__j",. "vtp_name":"origRefer". },{. "function":"__u",. "vtp_component":"HOST",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__e". },{. "function":"__aev",. "vtp_varType":"URL". },{. "function":"__aev",. "vtp_varType":"ELEMENT". },{. "function":"__aev",. "vtp_varType":"ID". },{. "function":"__v",.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\help[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines
Category:	dropped
Size (bytes):	136747
Entropy (8bit):	5.054167963637244
Encrypted:	false
SSDEEP:	1536:Q1zq6EJantX7FQ0zTGUCYbVCOCqljQvOo4vHILrxtPK8woURQJEyOLhbjTJd23P:5kntXJQ0z/dI
MD5:	1429F83E46521C819D59D4B06075539D
SHA1:	01FE28A6767AC416FA30C097F1F5EE9F785E7ABB
SHA-256:	B5D3C197CA09F5BFF98B5815511A3A6DDC8016A534A52A71C72381863270BFDA
SHA-512:	B1684500B57E8B0BF546B1E675B098904D3D261CAB369F90A5727C28F656DE7D9525987660CF36B99088A0034BB93E6BD28E4FB761BBC260741C8B1490BED760
Malicious:	false
Reputation:	low
Preview:	<!DOCTYPE html><html lang="en-US"><head><meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1.0"><title>Help \| eCornell</title><link rel="profile" href="http://gmpg.org/xfn/11" /> HTML5 shim and Respond.js for IE8 support of HTML5 elements and media queries --> [if lt IE 9]> <script src="https://oss.maxcdn.com/libs/html5shiv/3.7.2/html5shiv.js"></script> <script src="https://oss.maxcdn.com/libs/respond.js/1.4.2/respond.min.js"></script> <![endif]--><link rel="pingback" href="https://www.ecornell.com/xmlrpc.php" /> Chrome on Windows only --><style>h1, h2, h3, h4, h5, h6 {text-rendering: auto !important;}</style> <script type="text/javascript">//store template dir in js variable..var templateDir = "https://www.ecornell.com/wp-content/themes/ecustom18";..document.domain = document.domain.split(".").slice(-2).join(".");//allows cross subdomain communication.. var ws_api_endpoint = 'https://cuttlefish.ecornell.com/api/';...var use_https

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\iframe_api[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	810
Entropy (8bit):	5.29635255624997
Encrypted:	false
SSDEEP:	24:E1PgYtpqAK/HJ2TAXC5vuHM8aJLtdRWZ4FhQ:E1DPcSAXC5kaJLzwYhQ
MD5:	810AFF273AE94417C8F38EAB21813DD3
SHA1:	0FF1A3BF697CD8373287C519C3D440EB865DB34A
SHA-256:	2B5521E49DFC253C57DD27E58B56366A5707F7B0835D8CD2F75A4F2F40599C45
SHA-512:	103C8FF466988924E42DB33D46A502D1E68E6599B7AC187DA43BAE3E1D2DB7790FD4ED4B1C2EA892C2F580B9B0042DAE84919EA8572176551DA46DB8F4611DE8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/iframe_api
Preview:	var scriptUrl = 'https:\/\/www.youtube.com\/s\/player\/5dd3f3b2\/www-widgetapi.vflset\/www-widgetapi.js';if(!window["YT"])var YT={loading:0,loaded:0};if(!window["YTConfig"])var YTConfig={"host":"https://www.youtube.com"};.if(!YT.loading){YT.loading=1;(function(){var l=[];YT.ready=function(f){if(YT.loaded)f();else l.push(f)};window.onYTReady=function(){YT.loaded=1;for(var i=0;i<l.length;i++)try{l[i]()}catch(e){}};YT.setConfig=function(c){for(var k in c)if(c.hasOwnProperty(k))YTConfig[k]=c[k]};var a=document.createElement("script");a.type="text/javascript";a.id="www-widgetapi-script";a.src=scriptUrl;a.async=true;var c=document.currentScript;if(c){var n=c.nonce\|\|c.getAttribute("nonce");if(n)a.setAttribute("nonce",n)}var b=.document.getElementsByTagName("script")[0];b.parentNode.insertBefore(a,b)})()};.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-cookie.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1076
Entropy (8bit):	5.270297707560482
Encrypted:	false
SSDEEP:	24:pgSHihjyEY6+aH019yNvdNfA72FDvXaExI18zNHN2RywrWvB+pwnC:GSHw9zJHEyNXfA7+I1cH1wPMC
MD5:	14D2EC9B098032A57A4ED6CA0CD14C0E
SHA1:	257F1FDB1E19616674A846A06B3FB0DC4CB708ED
SHA-256:	708F001CC2044A716A0457AEFBC76511873DE57F172BEF3EE3314E47AEB9CE7F
SHA-512:	6DB1411CA090744419E02B004DED6321D5E4968721EE93C13BE5240F9D6376950BE8B1CC8CD92BD3361FBBC9C3CD25B8918AECE71B4217A3C35E27D8CA009F49
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery-cookie.min.js
Preview:	!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):a(jQuery)}(function(a){function b(a){return a}function c(a){return decodeURIComponent(a.replace(e," "))}function d(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return f.json?JSON.parse(a):a}catch(b){}}var e=/\+/g,f=a.cookie=function(e,g,h){if(void 0!==g){if(h=a.extend({},f.defaults,h),"number"==typeof h.expires){var i=h.expires,j=h.expires=new Date;j.setDate(j.getDate()+i)}return g=f.json?JSON.stringify(g):String(g),document.cookie=[f.raw?e:encodeURIComponent(e),"=",f.raw?g:encodeURIComponent(g),h.expires?"; expires="+h.expires.toUTCString():"",h.path?"; path="+h.path:"",h.domain?"; domain="+h.domain:"",h.secure?"; secure":""].join("")}for(var k=f.raw?b:c,l=document.cookie.split("; "),m=e?void 0:{},n=0,o=l.length;o>n;n++){var p=l[n].split("="),q=k(p.shift()),r=k(p.join("="));if(e&&e===q){m=d(r);break}e\|\|(m[q]=d(r))}return m};f.defaults={},a.removeCookie=function(b,c){return

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery-migrate-1.4.1-wp[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	24436
Entropy (8bit):	5.153228573660459
Encrypted:	false
SSDEEP:	384:pFcZ5+s56X6ABYxg4RSMrEBU++UKMsrle6D3PYUM/xfeYsR:W5+s5anMz++BdxDD/YR/xfsR
MD5:	037CE868CD0A6F2F8362D58487F2BF5B
SHA1:	84C8E0496356A2A84C698A8F441686FB190884DF
SHA-256:	F1D749EC752D0BF5719EE501FD4C0FDA01B71ED35FFC72DC72E1B07D87209544
SHA-512:	E11C444AAC3DFD11069988D3A65F6C027190601C4D2E9B7F897537680EF922B07241214D1F97885B01353DDB4E23DF821CBD4E3D92AD0C6B2AAD5A236622D179
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/plugins/enable-jquery-migrate-helper/js/jquery-migrate-1.4.1-wp.js?ver=1.4.1-wp
Preview:	/!.. jQuery Migrate - v1.4.1 - 2016-05-19.. * Copyright jQuery Foundation and other contributors.. */..(function( jQuery, window, undefined ) {..// See http://bugs.jquery.com/ticket/13335..// "use strict";......jQuery.migrateVersion = "1.4.1";......var warnedAbout = {};....// List of warnings already given; public read only..jQuery.migrateWarnings = [];....// Set to true to prevent console output; migrateWarnings still maintained..// jQuery.migrateMute = false;....// Show a message on the console so devs know we're active..if ( window.console && window.console.log ) {...window.console.log( "JQMIGRATE: Migrate is installed" +....( jQuery.migrateMute ? "" : " with logging active" ) +....", version " + jQuery.migrateVersion );..}....// Set to false to disable traces that appear with warnings..if ( jQuery.migrateTrace === undefined ) {...jQuery.migrateTrace = true;..}....// Forget any warnings we've already given; public..jQuery.migrateReset = function() {...warnedAbout = {};...jQuery.m

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery.imagelistexpander[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	2548
Entropy (8bit):	5.015610754618258
Encrypted:	false
SSDEEP:	48:CxJEH1RskL2yUJU6UbKGG0EqE0ExwmOx21G0EqE0EyN2LOcvqXl/6ZYN0EWEBsdg:CsH1RtLDUJU6UW70C0kU2k0C03ovq1C6
MD5:	8D0DD9234A4376B5A1A0524BB1147E4A
SHA1:	1814DD36C69501C941C2FD3265BF2EEC5E2C2617
SHA-256:	66AE94189C1C17D4FF52124314E35C5B4D688F550FE17C5C9DC04879EB6A8657
SHA-512:	92A7BD4C6C956493688D19EB1ACFFA2A381E8D7B4937605024911DF104D7B1EC76949E7B82E3D494EF5A5F504309942A1E2B598877DA5C627E299BDFB284E4CA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/ecustom16/jquery.imagelistexpander.js
Preview:	;(function(global,factory){if(typeof define==='function'&&define.amd){define(['jquery'],factory);}else{factory(jQuery);}})(this,function($){var defaultSettings={prefix:"imagelistexpander-"};var waitForFinalEvent=(function(){var timer=null;return function(callback,uniqueId){if(timer){clearTimeout(timer);}timer=setTimeout(callback,500);};})();var imageListExpander=function(list,_settings){var.settings=$.extend({},defaultSettings,_settings),$list=$(list),$items=$list.find('.'+settings.prefix+'item'),$trigger=$list.find('.'+settings.prefix+'trigger'),$closeTrigger=$list.find('.'+settings.prefix+'trigger-close'),initialize=function(){$(window).bind('resize',resizeWindow);$trigger.bind('click',clickItem);$closeTrigger.bind('click',clickCloseTrigger);},resizeWindow=function(){waitForFinalEvent(function(){$items.filter('.active').each(function(){var.$item=$(this),$expanderContents=$item.find('.'+settings.prefix+'expander-contents'),$expander=$item.find('.'+settings.prefix+'expander'),expanderH

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery.resizestop.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	706
Entropy (8bit):	4.869456699687316
Encrypted:	false
SSDEEP:	12:21+pJjBLc4dOEN1WMQnhWWrGTpMbdOENBRvR5JAjHKdGOrSkWeN3EuRIYhVbMhIK:21OLRdOtMIzfbdO8RHAjHKdvSkWK3FRa
MD5:	A9F102240F49E45F1130B542E02090A4
SHA1:	13D336EB090C84E1ADE9CB77EDE617A081E96D06
SHA-256:	BC603DE9E31BE30F98F7B63BAE24E21C10DD7169374768F53B357355AC3B79FD
SHA-512:	A0AA9F74D3087B0B63137D478F61DDA9933B3243864541E3B3547BE90FC46DED7C0F13F3B6BA5DF8DA5D30AFB665CD6840D0ABCE2F2FE67625F46080CAFEB9DC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/jquery.resizestop.min.js?ecv=1472666662
Preview:	(function(a){var b=Array.prototype.slice;a.extend(a.event.special,{resizestop:{add:function(d){var c=d.handler;a(this).resize(function(f){clearTimeout(c._timer);f.type="resizestop";var g=a.proxy(c,this,f);c._timer=setTimeout(g,d.data\|\|200)})}},resizestart:{add:function(d){var c=d.handler;a(this).on("resize",function(f){clearTimeout(c._timer);if(!c._started){f.type="resizestart";c.apply(this,arguments);c._started=true}c._timer=setTimeout(a.proxy(function(){c._started=false},this),d.data\|\|300)})}}});a.extend(a.fn,{resizestop:function(){a(this).on.apply(this,["resizestop"].concat(b.call(arguments)))},resizestart:function(){a(this).on.apply(this,["resizestart"].concat(b.call(arguments)))}})})(jQuery);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\jquery[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	96873
Entropy (8bit):	5.372169393547772
Encrypted:	false
SSDEEP:	1536:HYE1fGBiByJsbfXXeRJ/shgWCeLLccJdZVHk04ssx+/mvaSIFSet43tpXJIGVyp3:fsAg0psxTva/FSeKy2bDD5a98Hrq
MD5:	49EDCCEA2E7BA985CADC9BA0531CBED1
SHA1:	F8747F8EE704D9AF31D0950015E01D3F9635B070
SHA-256:	1DB21D816296E6939BA1F42962496E4134AE2B0081E26970864C40C6D02BB1DF
SHA-512:	F766DF685B673657BDF57551354C149BE2024385102854D2CA351E976684BB88361EAE848F11F714E6E5973C061440831EA6F5BE995B89FD5BD2D4559A0DC4A6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-includes/js/jquery/jquery.js?ver=1.12.4-wp
Preview:	/! jQuery v1.12.4 \| (c) jQuery Foundation \| jquery.org/license \| WordPress 2019-05-16 /.!function(a,b){"object"==typeof module&&"object"==typeof module.exports?module.exports=a.document?b(a,!0):function(a){if(!a.document)throw new Error("jQuery requires a window with a document");return b(a)}:b(a)}("undefined"!=typeof window?window:this,function(a,b){var c=[],d=a.document,e=c.slice,f=c.concat,g=c.push,h=c.indexOf,i={},j=i.toString,k=i.hasOwnProperty,l={},m="1.12.4",n=function(a,b){return new n.fn.init(a,b)},o=/^[\s\uFEFF\xA0]+\|[\s\uFEFF\xA0]+$/g,p=/^-ms-/,q=/-([\da-z])/gi,r=function(a,b){return b.toUpperCase()};n.fn=n.prototype={jquery:m,constructor:n,selector:"",length:0,toArray:function(){return e.call(this)},get:function(a){return null!=a?a<0?this[a+this.length]:this[a]:e.call(this)},pushStack:function(a){var b=n.merge(this.constructor(),a);return b.prevObject=this,b.context=this.context,b},each:function(a){return n.each(this,a)},map:function(a){return this.pushStack(n.map(this,fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\moment-f7dc254652ebf9f04950[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	244989
Entropy (8bit):	5.105030322665209
Encrypted:	false
SSDEEP:	3072:jH0kl6lwDD/DCD/DCDAcirrHrriJkrlbupnDDDFDD9at70Wf7rPFP2hXG+WU42iK:b0X8yN0WfYwDG
MD5:	F7DC254652EBF9F04950C446450BDF9E
SHA1:	E2EE8416E9F049D9ECBA4E33FA4AA0D34F29EA3C
SHA-256:	73A34BDF8A11D5F24F71FC513F34E36717F372B10A623D0377FDC99786DD6000
SHA-512:	569948509344F6D30B29FBF768911F85AACD2C62EE2068CA58FA463E9E32CB551A3E9C2E31F8BC36BCCA5E08854726F517FE80F8151E5D8E02B2BE5D3F72FB51
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/deploy/assets/assets/moment-f7dc254652ebf9f04950.js
Preview:	(window.driftWebpackJsonp=window.driftWebpackJsonp\|\|[]).push([[106],{1091:function(c){c.exports={version:"2019c",zones:["Africa/Abidjan\|LMT GMT\|g.8 0\|01\|-2ldXH.Q\|48e5","Africa/Accra\|LMT GMT +0020\|.Q 0 -k\|012121212121212121212121212121212121212121212121\|-26BbX.8 6tzX.8 MnE 1BAk MnE 1BAk MnE 1BAk MnE 1C0k MnE 1BAk MnE 1BAk MnE 1BAk MnE 1C0k MnE 1BAk MnE 1BAk MnE 1BAk MnE 1C0k MnE 1BAk MnE 1BAk MnE 1BAk MnE 1C0k MnE 1BAk MnE 1BAk MnE 1BAk MnE 1C0k MnE 1BAk MnE 1BAk MnE\|41e5","Africa/Nairobi\|LMT EAT +0230 +0245\|-2r.g -30 -2u -2J\|01231\|-1F3Cr.g 3Dzr.g okMu MFXJ\|47e5","Africa/Algiers\|PMT WET WEST CET CEST\|-9.l 0 -10 -10 -20\|0121212121212121343431312123431213\|-2nco9.l cNb9.l HA0 19A0 1iM0 11c0 1oo0 Wo0 1rc0 QM0 1EM0 UM0 DA0 Imo0 rd0 De0 9Xz0 1fb0 1ap0 16K0 2yo0 mEp0 hwL0 jxA0 11A0 dDd0 17b0 11B0 1cN0 2Dy0 1cN0 1fB0 1cL0\|26e5","Africa/Lagos\|LMT WAT\|-d.A -10\|01\|-22y0d.A\|17e6","Africa/Bissau\|LMT -01 GMT\|12.k 10 0\|012\|-2ldX0 2xoo0\|39e4","Africa/Maputo\|LMT CAT\|-2a.k -20\|01\|-2GJea.k\|26e5","Africa/C

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\pixel[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	https://q.quora.com/_/ad/38dbc5f3bef0495f9b60a514c5243560/pixel?j=1&u=https%3A%2F%2Fauth-ex.ecornell.com%2Fcas%2Flogin%3Fservice%3Dhttps%253A%252F%252Flms.ecornell.com%252Flogin%252Fcas&tag=ViewContent&ts=1610016409290
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\recaptcha__en[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	341608
Entropy (8bit):	5.708160375215365
Encrypted:	false
SSDEEP:	6144:iWU67KLhOxNppHCZryeSMnsL5FTXG7wEZoE8l5ySp2fO7hF4FFZf0+sV:iWtQhOxNpBCx//A5FTXGcEZmlJn7f4Fy
MD5:	B61A36B2DAAC8465FD7BC4B61FD3EFF2
SHA1:	4BEFAFEB9C8C87DFD2E9E0ACFEBD02C362BDA615
SHA-256:	FB3B275E8321C2C87095A4F4F0FD89FBBBDBE07E6FD5191C4C8CCABFC21692FB
SHA-512:	16AA601BA51E504D67D89F1832F8E2122AE28E57A89AA5BEB4FEE4C27FE171FD150836F074A4B82463E4D489A4C502A8F8F3FC28536D5D1F32C9489E9FE0EDCF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var H=function(){return[function(q,Q,u,p,B,r,X,E){if(((X=[5,"10",9],q<<2)&X[0]\|\|(r=B.V.get(u),!r\|\|r.tB\|\|r.nr>r.ma?(r&&(n[2](91,B.T,p,QJ,r.uR),U[11](X[0],Q,B.V,u)),y[43](14,Q,p,B.S)):(r.nr++,p.send(r.o7(),r.NJ(),r.Cv(),r.qL))),1)==((q\|X[2])&3))a:{if(u6&&!(l&&n[43](36,Q)&&!n[43](4,X[1])&&g.SVGElement&&p instanceof g.SVGElement)&&(B=p.parentElement)){E=B;break a}E=b[41](18,(B=p.parentNode,B))&&B.nodeType==u?B:null}return E},function(q,Q,u,p,B,r,X,E,K,R,v){return((((q<<(v=[67,28,11],2))%10\|\|(T.call(this,.qD.width,qD.height,"default"),this.M=null,this.V=new pX,n[33](23,this.V,this),this.S=new Bc,n[33](7,this.S,this)),q+6)%5\|\|(K="visible"==U[v[1]](7,u,X.V),W[21](v[1],X.V,{visibility:r?"visible":"hidden",opacity:r?"1":"0",transition:r?"visibility 0s linear 0s, opacity 0.3s linear":"visibility 0s linear 0.3s, opacity 0.3s linear"}),K&&!r?X.Z=b[v[2]](27,function(){W[21](28,this.V,"top","-10000px")},p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\rp[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	42
Entropy (8bit):	2.9881439641616536
Encrypted:	false
SSDEEP:	3:CUXPQE/xlEy:1QEoy
MD5:	D89746888DA2D9510B64A9F031EAECD5
SHA1:	D5FCEB6532643D0D84FFE09C40C481ECDF59E15A
SHA-256:	EF1955AE757C8B966C83248350331BD3A30F658CED11F387F8EBF05AB3368629
SHA-512:	D5DA26B5D496EDB0221DF1A4057A8B0285D15592A8F8DC7016A294DF37ED335F3FDE6A2252962E0DF38B62847F8B771463A0124EF3F84299F262ED9D9D3CEE4C
Malicious:	false
Reputation:	low
IE Cache URL:	https://alb.reddit.com/rp.gif?ts=1610016426909&id=t2_57crh7il&event=PageVisit&uuid=6d071264-355f-4f17-a0e4-ab27642d0b39&s=z4PeZPxu2ygefNsCa2inEqinc830hatvTKz0qyLaLR4%3D
Preview:	GIF89a.............!.......,...........D.;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\uwt[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	5160
Entropy (8bit):	5.237447818138746
Encrypted:	false
SSDEEP:	96:GiisflD3FBirFBggHst6MZXzmr77AQYQCzqdkpEsBtozasKAonJbRNGTEV:Giisfl7FUF/Hg477m5JQonvNGTEV
MD5:	CBC512946C8ABB461C6215ED5B454E5F
SHA1:	435AD7449A61092BC18921533509257FF74C9CA4
SHA-256:	4CF52CC73734AA71F26F6A10BE9AEEC89602AF45BF0F9ABD5C8445A076C1AE1A
SHA-512:	A70390512B35A71689DF9EF1D7250B66E31E0461650162CE17E1B4BE1DC2B86328D4F3DC011425F16E7FDB6D4EEF6A8188D1DD4A587F33805BE69CA994CC3F6F
Malicious:	false
Reputation:	low
IE Cache URL:	https://static.ads-twitter.com/uwt.js
Preview:	twttr=window.twttr\|\|{},twttr.conversion=function(){function e(e,t){var n=!1,i=!0,r=e.document,o=r.documentElement,a=r.addEventListener,s=a?"addEventListener":"attachEvent",u=a?"removeEventListener":"detachEvent",c=a?"":"on",d=function(i){"readystatechange"===i.type&&"complete"!==r.readyState\|\|(("load"===i.type?e:r)[u](c+i.type,d,!1),!n&&(n=!0)&&t.call(e,i.type\|\|i))},f=function(){try{o.doScroll("left")}catch(e){return void setTimeout(f,50)}d("poll")};if("complete"===r.readyState)t.call(e,"lazy");else{if(!a&&o.doScroll){try{i=!e.frameElement}catch(e){}i&&f()}r[s](c+"DOMContentLoaded",d,!1),e[s](c+"load",d,!1)}}function t(){this.pixelId="",this.eventQueue=[[]]}var n="//t.co/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0",i="https://analytics.twitter.com/i/adsct?type=javascript&version=1.1.1&p_id=Twitter&p_user_id=0",r=function(e,t){var n=t.toLowerCase();for(var i in e)if(i.toLowerCase()===n&&e.hasOwnProperty(i))return!0;return!1},o=function(e,t){var n=t.toLowerCase();for(v

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\vendors-widget-8f96283c571fdb07659e[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	downloaded
Size (bytes):	785192
Entropy (8bit):	5.24800996065114
Encrypted:	false
SSDEEP:	6144:RQhNakvXxYC+uyc4unpUrtR50mAzte47w/kNDSQxCEQbpa2Rhdv:CiOB+ynpU5RAfQphdv
MD5:	8F96283C571FDB07659EE310D4A680FA
SHA1:	9A25BC2B511EC8CC3BB35BD3288FA7BABCE62583
SHA-256:	6B25F7F9A94D41460F8785F369DB35C08148ADF7F9A26C81A0B44F944600187D
SHA-512:	C505090E285B890E78284FA9ECA81A2C3C55F6656296F2DBF297012882148316452EDB37CE9DEBC93EFCDDDFB29AAADD8B63DADB43647C51BDD74A1E593163A0
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/deploy/assets/assets/vendors-widget-8f96283c571fdb07659e.js
Preview:	(window.driftWebpackJsonp=window.driftWebpackJsonp\|\|[]).push([[105],[function(t,e,n){"use strict";var r=n(107),i=n(1142),o=n(362),s=n(459),a=function(){function t(t){this._isScalar=!1,t&&(this._subscribe=t)}return t.prototype.lift=function(e){var n=new t;return n.source=this,n.operator=e,n},t.prototype.subscribe=function(t,e,n){var r=this.operator,o=i.toSubscriber(t,e,n);if(r?r.call(o,this.source):o.add(this.source\|\|!o.syncErrorThrowable?this._subscribe(o):this._trySubscribe(o)),o.syncErrorThrowable&&(o.syncErrorThrowable=!1,o.syncErrorThrown))throw o.syncErrorValue;return o},t.prototype._trySubscribe=function(t){try{return this._subscribe(t)}catch(e){t.syncErrorThrown=!0,t.syncErrorValue=e,t.error(e)}},t.prototype.forEach=function(t,e){var n=this;if(e\|\|(r.root.Rx&&r.root.Rx.config&&r.root.Rx.config.Promise?e=r.root.Rx.config.Promise:r.root.Promise&&(e=r.root.Promise)),!e)throw new Error("no Promise impl found");return new e(function(e,r){var i;i=n.subscribe(function(e){if(i)try{t(e)}c

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\webworker[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	102
Entropy (8bit):	4.881176415327319
Encrypted:	false
SSDEEP:	3:JSbMqSL1cdXWKQK7/OwTcZT8gWaee:PLKdXNQKTOWcZogL
MD5:	361ACB06F0961A71419C0B1B82B38EA8
SHA1:	2BACD9ECC2D83B98CFA68D90C563CD842CD06F66
SHA-256:	F541F7A27E537DD55BC29F1F74C8A26E107F8CAB11A677EB70CF3394B8F7E6E2
SHA-512:	CA521940C6E910355C75602622146C39D0E4F2AA02DB0D0B6CC48C538D21B4E56482E898E05BBB4A2F91CC044CFE62536AA0D7097404F42F2728C4B98D272745
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/recaptcha/api2/webworker.js?hl=en&v=qc5B-qjP0QEimFYUxcpWJy5B
Preview:	importScripts('https://www.gstatic.com/recaptcha/releases/qc5B-qjP0QEimFYUxcpWJy5B/recaptcha__en.js');

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\widget-5b26db8f51e3508b106d[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	327982
Entropy (8bit):	5.345837550182871
Encrypted:	false
SSDEEP:	3072:NsiliPcSfPgosgQdoTeY7+EgwlehwMfARuUKRBD:Pt4goz6oTeY7+u4hrxUa
MD5:	5B26DB8F51E3508B106DEBCE4A00D511
SHA1:	B1894621F014DB80E4820534045AD8BD18E2741B
SHA-256:	9F9376BE785528639678D9A47980573BF2B32815834D53C83D054FF999A97D24
SHA-512:	A9BBB45B789898C1C6BF2B455008C26E1109FAE783AB4BC31481A233A90CCD32DD0D4C9B041BEA7ABE2A01816D6CAC42629C77D81E22B6F15D9E319C79B099C3
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/deploy/assets/assets/widget-5b26db8f51e3508b106d.js
Preview:	!function(e){function t(t){for(var r,a,c=t[0],u=t[1],s=t[2],d=0,l=[];d<c.length;d++)a=c[d],i[a]&&l.push(i[a][0]),i[a]=0;for(r in u)Object.prototype.hasOwnProperty.call(u,r)&&(e[r]=u[r]);for(f&&f(t);l.length;)l.shift()();return o.push.apply(o,s\|\|[]),n()}function n(){for(var e,t=0;t<o.length;t++){for(var n=o[t],r=!0,a=1;a<n.length;a++){var u=n[a];0!==i[u]&&(r=!1)}r&&(o.splice(t--,1),e=c(c.s=n[0]))}return e}var r={},a={107:0},i={107:0};var o=[];function c(t){if(r[t])return r[t].exports;var n=r[t]={i:t,l:!1,exports:{}};return e[t].call(n.exports,n,n.exports,c),n.l=!0,n.exports}c.e=function(e){var t=[];a[e]?t.push(a[e]):0!==a[e]&&{1:1,3:1,6:1,7:1,8:1,9:1,10:1,11:1,12:1,13:1,14:1,15:1,16:1,17:1}[e]&&t.push(a[e]=new Promise(function(t,n){for(var r="assets/"+({0:"vendors-AwayMessage-EmailCaptureSlider-LiveAudienceMessagePreview-MessageSlider-ProductAnnouncementS-231ed7db",1:"AwayMessage-LiveAudienceMessagePreview-MessageSlider-Minimized-ProductAnnouncementSlider-ProductAnno-9041cd50",2:"vendor

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\widget-61635a1beb663755fac0[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5287
Entropy (8bit):	5.166737295485311
Encrypted:	false
SSDEEP:	48:HgWJJxGDnFrQVmzz+H12G3kGtG9Tp5IXYe27GDD+otpxywgEZpGfRufX3uqLAhE+:HgWJJeF+Lpn+mqEZQ5s/UWOTP
MD5:	4439F045419BF781A98DAC4A8B2BED34
SHA1:	7A08D227D64EA2D84A95401754144EE1578232DE
SHA-256:	9F2A69EFA5FABD2D3DFA461DBCF0F0DB1F28D0113E14A4B8F93EEAEA1B64C1EF
SHA-512:	F205897490A09C7223D48FDA19AAB8A3E7DE3EE4D4F0884D509CA0666039AA6592062063374158DD5FE209F4D1559BB6D3766C08C548B80BB043E5B1F822F97C
Malicious:	false
Reputation:	low
IE Cache URL:	https://js.driftt.com/deploy/assets/assets/widget-61635a1beb663755fac0.css
Preview:	@import url(https://fonts.googleapis.com/css?family=Lato);.@import url(https://fonts.googleapis.com/css?family=Open+Sans);.@import url(https://fonts.googleapis.com/css?family=Roboto);.@import url(https://fonts.googleapis.com/css?family=Roboto+Slab);.@import url(https://fonts.googleapis.com/css?family=Overpass);..widget-container{position:absolute;z-index:2147483647;width:100%;height:100%;color:var(--main-gray-extra-dark);font-size:16px;overflow:hidden}.widget-container *{box-sizing:border-box}.widget-container .ConversationListItem{min-height:4.7rem}.body-font{-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.body-font.Arial{font-family:Arial,sans-serif}.body-font.TimesNewRoman{font-family:Times New Roman,serif}.body-font.Helvetica{font-family:Helvetica,sans-serif}.body-font.Georgia{line-height:1.45;font-family:Georgia,serif}.body-font.Brandon{font-family:Brandon,sans-serif}.body-font.Lato{font-family:Lato,sans-serif}.body-font.OpenSans{line-height:1.35;font-family:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9026IKNJ\www-widgetapi[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	103217
Entropy (8bit):	5.509913987770375
Encrypted:	false
SSDEEP:	1536:jhkKFaMJpn18iVUv1wWWWuUDg3WmkEhtupfQQZ0zBJ0zxxu+FL6hi2a:kyFILVx7pnx5/
MD5:	1A2021CC7B9625DCDF397E79FF561407
SHA1:	84A13F3F1ECE88043D0EB7ACCE54F439DFDFBE0C
SHA-256:	079125F689A2BDEB07090E26BF6A36FF437911956588ECE588B2BC75C4DCE5D1
SHA-512:	B8973FE10EE697A1C7C1C40FF69B7132D57CEAD3958EA1ED07DD7009C7D8D71112E2942D42057D9DBEBEDFDD7931EA48D2E2E14C3C6BEA3BEF14317FDCDBC52A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.youtube.com/s/player/5dd3f3b2/www-widgetapi.vflset/www-widgetapi.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var r;function aa(a){var b=0;return function(){return b<a.length?{done:!1,value:a[b++]}:{done:!0}}}.var ba="function"==typeof Object.defineProperties?Object.defineProperty:function(a,b,c){if(a==Array.prototype\|\|a==Object.prototype)return a;a[b]=c.value;return a};.function ca(a){a=["object"==typeof globalThis&&globalThis,a,"object"==typeof window&&window,"object"==typeof self&&self,"object"==typeof global&&global];for(var b=0;b<a.length;++b){var c=a[b];if(c&&c.Math==Math)return c}throw Error("Cannot find global object");}.var da=ca(this);function t(a,b){if(b)a:{for(var c=da,d=a.split("."),e=0;e<d.length-1;e++){var f=d[e];if(!(f in c))break a;c=c[f]}d=d[d.length-1];e=c[d];f=b(e);f!=e&&null!=f&&ba(c,d,{configurable:!0,writable:!0,value:f})}}.t("Symbol",function(a){function b(e){if(this instanceof b)throw new TypeError("Symbol is not a constructor");return new c("jscomp_symbol_"+(e\|\|"")+"_"+d++,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVs9pbCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26128, version 1.1
Category:	downloaded
Size (bytes):	26128
Entropy (8bit):	7.9776636697814975
Encrypted:	false
SSDEEP:	768:3xGGMCaE7bGWYzCdI5MxYwQnbEYw+mP0kDXQoh:kGMCr7b8Ca8Ybe+qzj
MD5:	34E7129835007363315A1A01E3C120BD
SHA1:	B0BEADF4DFDDA3B38C17166107BA1BD0D04400DF
SHA-256:	5D9D2C02D6BA48A49E9B2939CFC68F6F2B69E23C3CB4B46BF61F4F2125B0305D
SHA-512:	B6464799192B377F99414D2D358DFC46723453EDF5A283E912AE2D39042B0200F3328092DF866A3EE5EAFC72AE71755E16FCA06D3078A745D08F7B3E3C791832
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVs9pbCIPrc.woff
Preview:	wOFF......f.................................GDEF.......m.......PGPOS..........7H....GSUB.......R.....s.qOS/2...$...O...`b..'STAT...t...9...D...&cmap............MD..cvt ...h...N........fpgm...............Zgasp..'.............glyf..'...7...[...7head..^....6...6.b..hhea..^.... ...$....hmtx..^....^...@#-'.loca..aP......."(Q..maxp..cd... ... ....name..c....3...f;.[[post..d........ ...2prep..d....A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L..t,A...6.b..\|.m.m.m.m..T.s.%h.X..9.+Z.lU.............z.`,.J.Y..0.q?.ia.mU_C..O.`..wr.......:..O...a..LNCy...QM`xKgUco.@sq.T.a.[K.D3m.m....Y....wJ...........q{...wN.\|z.x2.....'..9.3.....n.^..}........:.........`..t...sm...G>5...-...BGa..PX....bN1..SZ-...KOe...C.ph...5._Gf....id...=rzd_.K..G.U.+9..JI..2V...T.)...U.6..A.*......1..1...xL.HL".....j2.....[0.......1...l.!sp.W1...Z.....c<.F...l.7...pP.'de.Q.}F#......e...E....a.P.....N...Al`.......0......../

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVsEpbCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 26084, version 1.1
Category:	downloaded
Size (bytes):	26084
Entropy (8bit):	7.980314665971624
Encrypted:	false
SSDEEP:	768:z44yU7viGrmzNxXFr2Fu7docjhMgu/272:zdrkpmu7doYw2K
MD5:	B6CCD91A6B8C7F0F3064659E64C3DDA8
SHA1:	20631BA215A53D95366BFEA607A834634DCAFCA1
SHA-256:	63EC19E1E10D01B93B97D4D14B62B8398ECD014E06B1FA23C89CBDDE19B4EBBB
SHA-512:	7BD987D71E0E15C3033749EC8512BF2D64B997B66E46290B760CDCFBE839991A360DBC7C0A0C685851347F2E905524AE85E80FD71D7C613EA28E35F2D2AD68EE
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVsEpbCIPrc.woff
Preview:	wOFF......e........h........................GDEF.......m.......PGPOS.......m..7H.W.,GSUB...t...R.....s.qOS/2.......M...`a..GSTAT.......9...D..%cmap...T........MD..cvt .......N........fpgm...\...........Zgasp..'4............glyf..'<..7"..[.SN..head..^`...6...6.a..hhea..^.... ...$....hmtx..^...._...@...loca..a........"g..maxp..c,... ... ....name..cL...@....E.g.post..d........ ...2prep..d....A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L...-A....l..p=.m.m.m.m.m.7...$.@......]..e...W..m.=\|...c.Q.6.:.......f.V.54.....5...........q.x......dr...f..j..[Z..{..........Zz'.ikn{..O.:>'.7.Sr.v.uN.s<.L.m.O...v..s...).1....u8QW.....w.w.....H.._.?0.9......6f.s..s...k.m.>....k.'..:...r..f.s....j.t^z{eNN..&.C......:2cd.xM#[....#..\..=.^..VJ..l.r^M.nV.......T.P.}h...d..c.Fb...%d.V..X.............i8Df....c....N....`...96.=>`....v.... +;...3../..../..~.,....L.1..a...9...<..7.'i.S\.eJ=Vwo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\1Ptxg8zYS_SKggPN4iEgvnHyvveLxVtapbCIPrc[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 25984, version 1.1
Category:	downloaded
Size (bytes):	25984
Entropy (8bit):	7.978124312293861
Encrypted:	false
SSDEEP:	384:6WGAiZSqstmYyTMUcrnUGB5QZ4uVjO9vd1LGlyRCMJsZRIX0HOSs3AqDdfLNksN:6nZSl7TzkZ5w9vdFGlySZuSqFfN
MD5:	44A0C7110FC9A61D4677853BEC63173C
SHA1:	C036B11D5A88563E74C04E842455234664E1D19C
SHA-256:	A0CAB96898F40329F422A584BBCD591CE197F97DB9BE5EC061D57524159283B3
SHA-512:	9B609490F56ACF9670B5D4172A87AA08EF0DE130EC66394E6BE28942AB0772051B25612863BDEAE20EAC7B08F9D91405AA56DCB93D29A7D704C76956179112B0
Malicious:	false
Reputation:	low
IE Cache URL:	https://fonts.gstatic.com/s/raleway/v18/1Ptxg8zYS_SKggPN4iEgvnHyvveLxVtapbCIPrc.woff
Preview:	wOFF......e........T........................GDEF.......m.......PGPOS..........7V....GSUB.......R.....s.qOS/2...<...O...`b..GSTAT.......8...D.H.'cmap............MD..cvt ...\|...N........fpgm...............Zgasp..'.............glyf..'...6K..[."D.head..]....6...6.a..hhea..^0... ...$....hmtx..^P...[...@-($hloca..`........"#x..maxp..b.... ... ....name..b....G....E.i.post..d(....... ...2prep..d<...A....O(..x.=........y-.$!....@R@.@.D...H..>../d.hh......_.Y.U.]..'..bTbl".%f%..bYbUb]bSbk'...X..,...V.^.Q..%.........@...x.L...#A.@.... vzm.m.m.m..m.6jk<.......#.>%JU.AT..:..i.ND.. ..@.e.N.B.O..%8..4.A...4.R.).m.....c.J%i.....B..J~s........g..~.C.K...<..&._.9!.B.....}JI.>S.5.\...i. bN...:E.(v%..H..,.EW).$=t.b'H....[.....I.DW....-..m1_..A+w)..c*c.c?...?S..1....\.<.....b.....T..[.X.Y.X?..T.<..T.Q.y.....S.S"A7O...=.Y..'.6...-..ZJ...R....5.9.N.\...z...Z..P..I.y.b... .f....Ti...&..-Ld.....0.}.b&G.y...s.+,......g#.x&...\|.;.1.J\|'.8E)..7]....K..g.$.3.0F.w....%>.I.c.8.^.C.s.....\

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\animate[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	55258
Entropy (8bit):	5.097845669184704
Encrypted:	false
SSDEEP:	768:fkZlIbIM6fZBIaI2IHwO1CA5kiDb3CyQ5xrQe/0STfs2sj:fkZ/IHwO1CA5kiDb3CyQ5xrQe/0ST4
MD5:	9ADCCC20459B1BC27BF7F16AB577F25D
SHA1:	056FF7CC4C7CA17C4A52A3D88DCC56242E5CF16F
SHA-256:	5A42DAF1921EA54FA43AC117B6ED1D6255337D0AA523E5185CA84351D03C05FB
SHA-512:	0FD4760A195D09802227A234077CB9237906984775B030753CF3132F77490AF973739ECF1F2A6AE0FE8FA9725F18BB870F0F6DFAB01B5296F7208158600B2067
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/css/animate.css?ver=1539886788
Preview:	@charset "UTF-8";/!.Animate.css - http://daneden.me/animate.Licensed under the MIT license - http://opensource.org/licenses/MIT..Copyright (c) 2015 Daniel Eden./.animated{-webkit-animation-duration:1s;animation-duration:1s;-webkit-animation-fill-mode:both;animation-fill-mode:both}.animated.infinite{-webkit-animation-iteration-count:infinite;animation-iteration-count:infinite}.animated.hinge{-webkit-animation-duration:2s;animation-duration:2s}.animated.bounceIn,.animated.bounceOut,.animated.flipOutX,.animated.flipOutY{-webkit-animation-duration:.75s;animation-duration:.75s}@-webkit-keyframes bounce{0%,100%,20%,53%,80%{-webkit-animation-timing-function:cubic-bezier(0.215,.61,.355,1);animation-timing-function:cubic-bezier(0.215,.61,.355,1);-webkit-transform:translate3d(0,0,0);transform:translate3d(0,0,0)}40%,43%{-webkit-animation-timing-function:cubic-bezier(0.755,.050,.855,.060);animation-timing-function:cubic-bezier(0.755,.050,.855,.060);-webkit-transform:translate3d(0,-30px,0);transf

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	35955
Entropy (8bit):	5.180686842452126
Encrypted:	false
SSDEEP:	768:b8lBD27UwlNBMl9nqahC2+jS1g8ep0skCXFXflcKGf3Z1RQ:oe782S1Klvla3ZrQ
MD5:	7B11D4990D6667CC235919ADC908A16B
SHA1:	C232D7B67903824883A88C68E1F4AD4ABD232B27
SHA-256:	ABEC73FCADC5A8B680BF4174F9D36B5B0CA3DA327D32E29816B16D8F1F2FF497
SHA-512:	14CB57939CD724F52218B8CD0482277547809FEDEDB393EB9FDB34A66D5B2D1C80282AC1980D25B3D65D7D25D9C0B37316D94A84478ABFECE5916E8A219672B3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/unpacked/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.4 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(a){"use strict";var b=a.fn.jquery.split(" ")[0].split(".");if(b[0]<2&&b[1]<9\|\|1==b[0]&&9==b[1]&&b[2]<1)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher")}(jQuery),+function(a){"use strict";function b(){var a=document.createElement("bootstrap"),b={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var c in b)if(void 0!==a.style[c])return{end:b[c]};return!1}a.fn.emulateTransitionEnd=function(b){var c=!1,d=this;a(this).one("bsTransitionEnd",function(){c=!0});var e=function(){c\|\|a(d).trigger(a.support.transition.end)};return setTimeout(e,b),this},a(function(){a.support.transition=b(),a.support.transition&

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ec-logo-smaller[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 167 x 44, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	5462
Entropy (8bit):	7.940500687475096
Encrypted:	false
SSDEEP:	96:5BvidNU1IPwY5m6W6MlbkOFByCiSefpSvcFe0koUYdbDKNtyC/fUj:SdSq4YM6WT2C5efEvcs0koAyCXg
MD5:	395C29CE7E3EA85043A845A529899A05
SHA1:	CCC171CA5140EA00325E041484832890EF9DD1F2
SHA-256:	9D9D4CFD236295E863249406AF3912D242B7307A7D68C662A33BC8AE5E2C129C
SHA-512:	8078D2C3421A3C3B11B41E2E81577A2756C4F6F3AC1F1AE842506F9B527E134FA9E46FAA2ABC267EB4884874E99CC08FEE58C0B5AA84F3F09F12CB77DAC10D32
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/img/ec-logo-smaller.png
Preview:	.PNG........IHDR.......,......a......IDATx..].t.E..\@. .D.I:I_I:7.3r...#@P.p.0..uY.k..eX.G...).8.s'.e..>.pw.U.GYG.<V....@.t....W.u..9!...^Q_......U.5.j.wg..kW..s..IL..r.......c....P...@.lL.{.Rl.z.}..%Y...Y...;....g0.@.......U...;5..H...\|e...tGk.s..1.....!..J..t>.U.^.(^%.m...;.<wT..W.+..u..s....j...Z...].6.t.Z...E..Q>.w~0...^oHLL.....9"M...&.).I...7........%s...(...T...u.&[.r...2s.:g.ru.}kpN"Vg.G..z..........#x."6P....(C4d.....}HH.y..%.CUpr].....-(..w...A#.!W..s...6..:t..IiBB........W.yBFF. .h.......L.g....sQF.._...fJ....K...:..;;...Z..B#...l!".......h........r8.....<.B...]lA.g.......".....7.....4.]c.8.&.Hp>.4p^e.8..\|.8...t../...@o........b...}..h..L.F....WD...Z,.%.......G.F.&.9p.#..sN.No.6.l.[...w.........f..qNohhh...A.#G.\|@m/.x..89gm...q..NO/X.T>.O....Z..................t...:.]d>....<o.b.f I...;........P......o.].T..C.sN.At....s.HZ..u....7n<...N..U.......#...<R.Pp.wh!.9*....1v....L.@.wD...A.....9{.N.....q.....\.k{..3..S...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ecornell-logo-red-shield-white-txt[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2631
Entropy (8bit):	4.567965312488133
Encrypted:	false
SSDEEP:	48:CIloezpmceLlPSoSmhGglse9uw0vUY111sofdZpB8dScdUNUcsHGxCuiEaFmd:ZVNaBLS91eY7UYBd13sBG9VaC
MD5:	2BC981571A68D7B3D06FA10E27BDCA47
SHA1:	10F4F9D689378B89C9E818FC450B8179FBCE87C4
SHA-256:	4DCC5D42623D1591D2B94FE75E609FE64D530E5F757889389650B46C50D1DDF1
SHA-512:	C6087E2EC3DE90758B68005DDF7103C5AD12F06D16D4E9ACE5A088B893FE7B25EB662608381460108563778DAEF97EA4395B33EE5E5870909276BCDAD2AAFD39
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/img/ecornell-logo-red-shield-white-txt.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 446.95 117.21"><defs><style>.cls-1{fill:#fff;}.cls-2{fill:#b30909;}</style></defs><title>Asset 1</title><g id="Layer_2" data-name="Layer 2"><g id="Layer_1-2" data-name="Layer 1"><path class="cls-1" d="M140,33.68c-14,0-21.46,8.93-21.46,21.53v6.36c0,13.05,8.5,20.74,21.63,20.74,10.29,0,18.6-6.16,20.23-14.65H149.7c-1.16,3.22-4.39,5.9-9.58,5.9-7.06,0-9.83-4.75-9.83-10.2V62.2h30.4V54.06C160.69,42.88,153.72,33.68,140,33.68Zm9.56,19.94H130.29v-.46c0-6.25,2.69-10.92,9.67-10.92,6.52,0,9.56,4.4,9.56,10.2Z"/><path class="cls-1" d="M194.59,27.68c9.29,0,13.77,6.17,14.58,13.24h11.62c-.61-12.78-10.37-23.51-26.2-23.51-18.85,0-27.35,12.05-27.35,28.07V54.4c0,16,8.5,28.1,27.35,28.1,15.83,0,25.59-10.74,26.2-23.54H209.17c-.81,7.08-5.29,13.24-14.58,13.24-10.45,0-14.92-7.15-14.92-17.15V44.86C179.67,34.84,184.14,27.68,194.59,27.68Z"/><path class="cls-1" d="M248.64,33.68c-14,0-21.91,9.1-21.91,21v6.61c0,11.89,8,21,21.91,21s21.9-9.12,21.9-21V54.68C270.55,42.78,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ecustom-embed[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	7108
Entropy (8bit):	4.80914910948738
Encrypted:	false
SSDEEP:	192:13JcuyYrusuaDRvVBr81AZ4SLYw335Iqyoj1xHNxKoZj:PztrIs0gjHNQO
MD5:	D0CC061758A1F90550D4C24DCE378A17
SHA1:	C889F732229E04EA6BE2B522C4D0F2DFC765D6EB
SHA-256:	7B176173DDF513C7094E771D44F459EC01DD78C685C46D3FD094936A9D42B072
SHA-512:	CB9DD5546B29C9F0146E6E82754E4490993E57285D5FCD377478FB9F1C8B5BE2EEF632AD99BF9A19542A7877940F7CCD363F7B582F57DCB5F67544A581D7000B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/plugins/ecustom-embed/js/ecustom-embed.js
Preview:	if (typeof ytPlayers === "undefined") {. var ytPlayers = new Object();.}..var iOS = /(iPad\|iPhone\|iPod)/g.test( navigator.userAgent );.var iPad = /(iPad)/g.test( navigator.userAgent );..if (iPad) { jQuery('body').addClass("is-ipad"); }..//Functions to interact with YouTube videos.function onPlayerStateChange(event, thisID) {. if (typeof $jQ == 'undefined') { var $jQ = jQuery.noConflict();}.. var $thisEmbed = $jQ('.yt-frame[id="'+thisID+'"]');. var $parentCarousel = $thisEmbed.parents('.carousel:first');. if ( $parentCarousel.data('bs.carousel') ) {//if in carousel, stop autoplaying carousel. $parentCarousel.data('bs.carousel').options.interval = false;. }.. ytPlayers[thisID].playing = false;.. if (event.data == YT.PlayerState.PLAYING) {. ytPlayers[thisID].playing = true;. //make double sure this slide is active (in case the carousel failed to stop above for whatever reason). $parentCarousel.carousel( $jQ('.item', $parentCarousel).inde

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ecustom18-form.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	27818
Entropy (8bit):	5.203468796765296
Encrypted:	false
SSDEEP:	768:md6YFleoXd7TIlyBtmlTdZ2f+vMIu8S5H05ilH9X:omod4JdZ2WvMHlt
MD5:	D5C5D17FF15A67A26862B84A94361B80
SHA1:	9CBCE0BB2C83007DD906FDAFD05DF5C4B5F85630
SHA-256:	5399601EE24563EE084A1213FF191692A4A51781481ACF6E50F71911DF10D457
SHA-512:	BEB3BB5C2E6C461BFA4D3848028CBEFF84AAC0471B51F330E1EF8FB388AB35718CE412EE1FD204AC6912F2E0421C4D858649FF55E200C62395A3B539F21D6A86
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18-form.min.js?ver=1607007271
Preview:	var calling_codes=new Array;calling_codes.afghanistan="93",calling_codes.albania="355",calling_codes.algeria="213",calling_codes["american samoa"]="1 684",calling_codes.andorra="376",calling_codes.angola="244",calling_codes.anguilla="1264",calling_codes.antarctica="672",calling_codes["antigua and barbuda"]="1268",calling_codes["antilles, netherlands"]="599",calling_codes.argentina="54",calling_codes.armenia="374",calling_codes.aruba="297",calling_codes.australia="61",calling_codes.austria="43",calling_codes.azerbaijan="994",calling_codes.bahamas="1242",calling_codes.bahrain="973",calling_codes.bangladesh="880",calling_codes.barbados="1246",calling_codes.belarus="375",calling_codes.belgium="375",calling_codes.belize="501",calling_codes.benin="229",calling_codes.bermuda="1 441",calling_codes.bhutan="975",calling_codes.bolivia="591",calling_codes["bosnia and herzegovina"]="387",calling_codes.botswana="267",calling_codes.brazil="55",calling_codes["british indian ocean territory"]="246",cal

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ecustom18-header.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	6907
Entropy (8bit):	5.269850770504578
Encrypted:	false
SSDEEP:	192:ddYqOmAS/F3T/qoiVP6Gb04glOBE9yVOz2njiC1qw:dBAS93T/C686Q
MD5:	202A9AE01798A9649E8721986C971B88
SHA1:	2A2C9E6CA7690905B3C5D3B92DF947B2F5AC1B0E
SHA-256:	CA03756D281DF910BEA985383609BDD47D8631361B3ED9078B8525FA0FCD9E99
SHA-512:	4464A0F5961AD52DA4F462453EF46ECF42DB8A2B21DD025B5A928184285EA72252340A17DC660C570F0995AA5F992780F82ED6D67BF604E39F108FC8043C8E32
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18-header.min.js?ver=1590674122
Preview:	function getParameterByName(a,b){b\|\|(b=window.location.href),a=a.replace(/[\[\]]/g,"\\$&");var c=new RegExp("[?&]"+a+"(=([^&#])\|&\|#\|$)"),d=c.exec(b);return d?d[2]?decodeURIComponent(d[2].replace(/\+/g," ")):"":null}function getScrollBarWidth(){if(jQuery("body").height()>jQuery(window).height()){var a=document.createElement("div");a.className="scrollbar-measure",document.body.appendChild(a);var b=a.offsetWidth-a.clientWidth;return document.body.removeChild(a),b}return 0}jQuery(document).ready(function(a){eCornell16Header={winHeight:0,winWidth:0,init:function(){"undefined"==typeof destinyPublicViewHost&&a("[data-destiny-pv]:first").length>0&&(window.destinyPublicViewHost=a("*[data-destiny-pv]:first").data("destiny-pv")),a("#navHeader").length>0&&a("body.ecornell-www").length>0&&this.checkLogin(),a(window).on("scroll",function(){eCornell16Header.windowScroll()}),a("#headerNavCollapse").each(function(){var b=a(this),c=a(this).parents(".navbar:first");b.on("show.bs.collapse",function(){c.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\ecustom18.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	48073
Entropy (8bit):	5.236947746476916
Encrypted:	false
SSDEEP:	768:dWQIwEuv8Hv91F0FElrmsYMee/IoD17PqtsQ3qsh9hEgvPYQMwcMYTTA6CQHK3xr:IpCqIoD17PqtsQ3qGaMY7CN3xr
MD5:	E1F6A2763E5141F07F85F9DF2F92BF74
SHA1:	1E230BD54FAB2B821F09A4B7385F9663FDEB5D62
SHA-256:	276AFBB3A14EB122EAF3701DAEF0C1F9D22DFF10E70F395BB3892D8362B08F6B
SHA-512:	A73FA84894E304893CA1665061A80587A9C12B69F2591E32B92174366A838A03C359B476381D1AB515A9E9146BBA32ED4F1AD9A13D2DDAD17AFAE20D6E5F4919
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/ecustom18.min.js?ver=1607023636
Preview:	function getParameterByName(a,b){b\|\|(b=window.location.href),a=a.replace(/[\[\]]/g,"\\$&");var c=new RegExp("[?&]"+a+"(=([^&#]*)\|&\|#\|$)"),d=c.exec(b);return d?d[2]?decodeURIComponent(d[2].replace(/\+/g," ")):"":null}function getScrollBarWidth(){if(jQuery("body").height()>jQuery(window).height()){var a=document.createElement("div");a.className="modal-scrollbar-measure",document.body.appendChild(a);var b=a.offsetWidth-a.clientWidth;return document.body.removeChild(a),b}return 0}function getURLParameter(a){return decodeURIComponent((new RegExp("[?\|&]"+a+"=([^&;]+?)(&\|#\|;\|$)").exec(location.search)\|\|[,""])[1].replace(/\+/g,"%20"))\|\|null}function out(a){console.log(a)}var monthNames=["January","February","March","April","May","June","July","August","September","October","November","December"];jQuery(document).ready(function($){eCornell16={winHeight:0,winWidth:0,sndleveldomain:location.hostname.split(".").slice(-2).join("."),init:function(){eCornell16.navHeight=1==$("#navHeader .navbar:first

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\f[1].txt Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6998
Entropy (8bit):	5.47456238618025
Encrypted:	false
SSDEEP:	96:Oc3AUAO4ktwnU9Ydfu+IDdKrc/NigwoYiYZnqZqKRUTvuWrL+H6l4/T:OCAUAOnGU93NpigmiEcUTvuUL+H6l4/T
MD5:	86C41358AA30DDD478FA4E0A540C7045
SHA1:	F8CB1AA16EB57121B6888C2C6EE448D2C1B3C771
SHA-256:	A75FEDAFAE8857D87FCED27AB153E74A821053EC51BEFF5855F6A1E5272B6E99
SHA-512:	52A7921120F1D81D73043B7A1CCD5621B8AD0553DBCAD89582B8FC29C6E4A83B3D5CC7020DCEE6E46EC473A3C2F8ED31533B41DB636B7BC309AB06609612993A
Malicious:	false
Reputation:	low
IE Cache URL:	https://cse.google.com/cse.js?cx=006021230338483373297:bhgfgvz2m7w
Preview:	(function(opts_){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var f=this\|\|self,g=/^[\w+/_-]+[=]{0,2}$/,k=null,l=function(a){return(a=a.querySelector&&a.querySelector("script[nonce]"))&&(a=a.nonce\|\|a.getAttribute("nonce"))&&g.test(a)?a:""},m=function(a,b){function c(){}c.prototype=b.prototype;a.prototype=new c;a.prototype.constructor=a},n=function(a){return a};var p=function(a){if(Error.captureStackTrace)Error.captureStackTrace(this,p);else{var b=Error().stack;b&&(this.stack=b)}a&&(this.message=String(a))};m(p,Error);p.prototype.name="CustomError";var r=function(a,b){a=a.split("%s");for(var c="",e=a.length-1,d=0;d<e;d++)c+=a[d]+(d<b.length?b[d]:"%s");p.call(this,c+a[e])};m(r,p);r.prototype.name="AssertionError";var t=function(a,b,c){if(!a){var e="Assertion failed";if(b){e+=": "+b;var d=Array.prototype.slice.call(arguments,2)}throw new r(""+e,d\|\|[]);}},u=function(a,b){throw new r("Failure"+(a?": "+a:""),Array.prototype.slice.call(arguments,1));};var

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\iframeResizer.contentWindow[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	11390
Entropy (8bit):	5.136347170323314
Encrypted:	false
SSDEEP:	192:09X6Zk8pjSXzmGzNzutruQr9vvrMSzsXRgb8ncdROJMeuWKcL++Sb4LQsbTljz6j:PZcd5U9vbKgI2AJMeuWKcLdw6QsbTl2j
MD5:	85D8B7ECC82B2F1613054AA3BB8A3BA9
SHA1:	2B5A8D48271C18ED464A2F3A8CCE4B2B37A52346
SHA-256:	5014E48F918DE784DC70C9BE98124F0F5A0996D085CF1F3CF5E751B58EFA6B46
SHA-512:	FA2FF335C0B251883D38BBE369C23664A415F38F64594A974909CC14A3ACF1311E38B1173C1045B2C03892AA496DD32730299DC1988073191DE7821481117ED2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom/js/iframeResizer.contentWindow.js
Preview:	;(function(){'use strict';var.autoResize=true,base=10,bodyBackground='',bodyMargin=0,bodyMarginStr='',bodyPadding='',calculateWidth=false,doubleEventList={'resize':1,'click':1},eventCancelTimer=128,height=1,firstRun=true,heightCalcModeDefault='offset',heightCalcMode=heightCalcModeDefault,initLock=true,initMsg='',interval=32,logging=false,msgID='[iFrameSizer]',msgIdLen=msgID.length,myID='',publicMethods=false,resetRequiredMethods={max:1,scroll:1,bodyScroll:1,documentElementScroll:1},targetOriginDefault='*',target=window.parent,tolerance=0,triggerLocked=false,triggerLockedTimer=null,width=1;function addEventListener(el,evt,func){if('addEventListener'in window){el.addEventListener(evt,func,false);}else if('attachEvent'in window){el.attachEvent('on'+evt,func);}}function formatLogMsg(msg){return msgID+'['+myID+']'+' '+msg;}function log(msg){if(logging&&('object'===typeof window.console)){console.log(formatLogMsg(msg));}}function warn(msg){if('object'===typeof window.console){console.warn(fo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\iframeResizer.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5525
Entropy (8bit):	5.338151633120082
Encrypted:	false
SSDEEP:	96:3EX0p1a3xOtQjOU+UwU48mpyinfjKtsWvzHrXIPlJJKOnOTmIQBPxbztV:LpY3It5U+f1FVMzHjc5zPxbT
MD5:	83A91092DCFDF29E675D6CCA4DE2D793
SHA1:	6809B82C835B4AF508EE1CE2C0ACF6F26090F703
SHA-256:	C1AF8C44F5AD3A31F5B38DE1C08E0242477AE2A075AC33C85DB01202F748676C
SHA-512:	BA8F5332BC890AA32A6F8CB974C24CE6EB684E482164AE16E8EB1DEBFE30DB427E708B10313BDE73F127A9EE963FE9D058918A2FE38A3929BF3A098914D9D819
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/iframeResizer.min.js
Preview:	/! iFrame Resizer (iframeSizer.min.js ) - v2.6.2 - 2014-10-11. Desc: Force cross domain iframes to size to content.. * Requires: iframeResizer.contentWindow.min.js to be loaded into the target frame.. * Copyright: (c) 2014 David J. Bradshaw - dave@bradshaw.net. * License: MIT. */..!function(){"use strict";function a(a,b,c){"addEventListener"in window?a.addEventListener(b,c,!1):"attachEvent"in window&&a.attachEvent("on"+b,c)}function b(){var a,b=["moz","webkit","o","ms"];for(a=0;a<b.length&&!w;a+=1)w=window[b[a]+"RequestAnimationFrame"];w\|\|c(" RequestAnimationFrame not supported")}function c(a){y.log&&"object"==typeof console&&console.log(s+"[Host page"+u+"]"+a)}function d(a){function b(){function a(){h(z),f(),y.resizedCallback(z)}i(a,z,"resetPage")}function d(a){var b=a.id;c(" Removing iFrame: "+b),a.parentNode.removeChild(a),y.closedCallback(b),c(" --")}function e(){var a=x.substr(t).split(":");return{iframe:document.getElementById(a[0]),id:a[0],height:a[1],width:a[2],type:a[3]

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-cookie.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	1076
Entropy (8bit):	5.270297707560482
Encrypted:	false
SSDEEP:	24:pgSHihjyEY6+aH019yNvdNfA72FDvXaExI18zNHN2RywrWvB+pwnC:GSHw9zJHEyNXfA7+I1cH1wPMC
MD5:	14D2EC9B098032A57A4ED6CA0CD14C0E
SHA1:	257F1FDB1E19616674A846A06B3FB0DC4CB708ED
SHA-256:	708F001CC2044A716A0457AEFBC76511873DE57F172BEF3EE3314E47AEB9CE7F
SHA-512:	6DB1411CA090744419E02B004DED6321D5E4968721EE93C13BE5240F9D6376950BE8B1CC8CD92BD3361FBBC9C3CD25B8918AECE71B4217A3C35E27D8CA009F49
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/jquery-cookie.min.js
Preview:	!function(a){"function"==typeof define&&define.amd?define(["jquery"],a):a(jQuery)}(function(a){function b(a){return a}function c(a){return decodeURIComponent(a.replace(e," "))}function d(a){0===a.indexOf('"')&&(a=a.slice(1,-1).replace(/\\"/g,'"').replace(/\\\\/g,"\\"));try{return f.json?JSON.parse(a):a}catch(b){}}var e=/\+/g,f=a.cookie=function(e,g,h){if(void 0!==g){if(h=a.extend({},f.defaults,h),"number"==typeof h.expires){var i=h.expires,j=h.expires=new Date;j.setDate(j.getDate()+i)}return g=f.json?JSON.stringify(g):String(g),document.cookie=[f.raw?e:encodeURIComponent(e),"=",f.raw?g:encodeURIComponent(g),h.expires?"; expires="+h.expires.toUTCString():"",h.path?"; path="+h.path:"",h.domain?"; domain="+h.domain:"",h.secure?"; secure":""].join("")}for(var k=f.raw?b:c,l=document.cookie.split("; "),m=e?void 0:{},n=0,o=l.length;o>n;n++){var p=l[n].split("="),q=k(p.shift()),r=k(p.join("="));if(e&&e===q){m=d(r);break}e\|\|(m[q]=d(r))}return m};f.defaults={},a.removeCookie=function(b,c){return

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery-migrate.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	10056
Entropy (8bit):	5.308628526814024
Encrypted:	false
SSDEEP:	192:kZrk/GNyd31svs7wkX8KzJcqSDdAcHX4YE5NLR:srhNyNO0kkMKzFSDdAcIYwLR
MD5:	7121994EEC5320FBE6586463BF9651C2
SHA1:	90532AFF6D4121954254CDF04994D834F7EC169B
SHA-256:	48EB8B500AE6A38617B5738D2B3FAEC481922A7782246E31D2755C034A45CD5D
SHA-512:	B74A2F03C64E883B9A34DE43690429327DFB4AA230A7A6AFCA8150A16E3D84E98461245FF264C26368D9904562CC34FE219F71F951D364FA5C68C039B76776CD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-includes/js/jquery/jquery-migrate.min.js
Preview:	/! jQuery Migrate v1.4.1 \| (c) jQuery Foundation and other contributors \| jquery.org/license /."undefined"==typeof jQuery.migrateMute&&(jQuery.migrateMute=!0),function(a,b,c){function d(c){var d=b.console;f[c]\|\|(f[c]=!0,a.migrateWarnings.push(c),d&&d.warn&&!a.migrateMute&&(d.warn("JQMIGRATE: "+c),a.migrateTrace&&d.trace&&d.trace()))}function e(b,c,e,f){if(Object.defineProperty)try{return void Object.defineProperty(b,c,{configurable:!0,enumerable:!0,get:function(){return d(f),e},set:function(a){d(f),e=a}})}catch(g){}a._definePropertyBroken=!0,b[c]=e}a.migrateVersion="1.4.1";var f={};a.migrateWarnings=[],b.console&&b.console.log&&b.console.log("JQMIGRATE: Migrate is installed"+(a.migrateMute?"":" with logging active")+", version "+a.migrateVersion),a.migrateTrace===c&&(a.migrateTrace=!0),a.migrateReset=function(){f={},a.migrateWarnings.length=0},"BackCompat"===document.compatMode&&d("jQuery is not compatible with Quirks Mode");var g=a("<input/>",{size:1}).attr("size")&&a.attrFn,h=a.att

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.animateNumber.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1365
Entropy (8bit):	5.208566770049527
Encrypted:	false
SSDEEP:	24:gkQYFFfKGXuLI645Yu9hZm4zawRuXeDG2It14sZX3uvJe2AOYaW3QQGv:glYzKGeLID39h/PMs2zTX3klYXQQ4
MD5:	11396A5454D38B0E650C4B6D8990D97A
SHA1:	E7E93C4AED8CCBB2DF443B12813ECE85D614F438
SHA-256:	0DB751426827FE8188DF25996C6B8816AA02038415C8D417ADBD4A99DF99C1D3
SHA-512:	02FA4F8A3E038681C00150222FD9BFBA531D6D09A959877892E6B6E71A9B79E42D546C7F085E485D6378882361BADD17105EE4699CB9B48DD51AB03EED08CE67
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.animateNumber.min.js?ver=1539886789
Preview:	/. jQuery animateNumber plugin v0.0.13. (c) 2013, Alexandr Borisov.. https://github.com/aishek/jquery-animateNumber./.(function(d){var q=function(b){return b.split("").reverse().join("")},m={numberStep:function(b,a){var e=Math.floor(b);d(a.elem).text(e)}},h=function(b){var a=b.elem;a.nodeType&&a.parentNode&&(a=a._animateNumberSetter,a\|\|(a=m.numberStep),a(b.now,b))};d.Tween&&d.Tween.propHooks?d.Tween.propHooks.number={set:h}:d.fx.step.number=h;d.animateNumber={numberStepFactories:{append:function(b){return function(a,e){var g=Math.floor(a);d(e.elem).prop("number",a).text(g+b)}},separator:function(b,a,e){b=b\|\|" ";.a=a\|\|3;e=e\|\|"";return function(g,k){var c=Math.floor(g).toString(),t=d(k.elem);if(c.length>a){for(var f=c,l=a,m=f.split("").reverse(),c=[],n,r,p,s=0,h=Math.ceil(f.length/l);s<h;s++){n="";for(p=0;p<l;p++){r=s*l+p;if(r===f.length)break;n+=m[r]}c.push(n)}f=c.length-1;l=q(c[f]);c[f]=q(parseInt(l,10).toString());c=c.join(b);c=q(c)}t.prop("number",g).text(c+e)}}}};d.fn.animateNumbe

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.hoverIntent[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	6920
Entropy (8bit):	4.4900698709322215
Encrypted:	false
SSDEEP:	192:6pQtqg/1KCmIq5/wwXyBQ/QYbvWq9GuBymd:6WtqgbmPiobvzzJ
MD5:	8164E858AB742D24C92E49E5AAFA22FC
SHA1:	7C865C4D73F6B1EE72E8790A5DBE74D7D52151E8
SHA-256:	7B3070FB9A342F6DD16891B9C6948B3327829243F4C525A3ACA14F5B73924D62
SHA-512:	45998325E93E9CD90B8D847AEF7A0F32FD63679EDD7A9D8F3D09632C0B450794ACA603A5770914C5206650A88DE8B07BAAAF5961482A6F3A9B9834DC35453995
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/unpacked/jquery.hoverIntent.js
Preview:	/!. hoverIntent v1.8.1 // 2014.08.11 // jQuery v1.9.1+. * http://briancherne.github.io/jquery-hoverIntent/. . You may use hoverIntent under the terms of the MIT license. Basically that. * means you are free to use hoverIntent as long as this header is left intact.. * Copyright 2007, 2014 Brian Cherne. /../ hoverIntent is similar to jQuery's built-in "hover" method except that. * instead of firing the handlerIn function immediately, hoverIntent checks. * to see if the user's mouse has slowed down (beneath the sensitivity. * threshold) before firing the event. The handlerOut function is only. * called after a matching handlerIn.. . // basic usage ... just like .hover(). * .hoverIntent( handlerIn, handlerOut ). * .hoverIntent( handlerInOut ). . // basic usage ... with event delegation!. * .hoverIntent( handlerIn, handlerOut, selector ). * .hoverIntent( handlerInOut, selector ). . // using a basic configuration object. * .hoverIntent( config ). . @param handlerIn fun

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\jquery.resizestop.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	706
Entropy (8bit):	4.869456699687316
Encrypted:	false
SSDEEP:	12:21+pJjBLc4dOEN1WMQnhWWrGTpMbdOENBRvR5JAjHKdGOrSkWeN3EuRIYhVbMhIK:21OLRdOtMIzfbdO8RHAjHKdvSkWK3FRa
MD5:	A9F102240F49E45F1130B542E02090A4
SHA1:	13D336EB090C84E1ADE9CB77EDE617A081E96D06
SHA-256:	BC603DE9E31BE30F98F7B63BAE24E21C10DD7169374768F53B357355AC3B79FD
SHA-512:	A0AA9F74D3087B0B63137D478F61DDA9933B3243864541E3B3547BE90FC46DED7C0F13F3B6BA5DF8DA5D30AFB665CD6840D0ABCE2F2FE67625F46080CAFEB9DC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/jquery.resizestop.min.js?ver=1539886789
Preview:	(function(a){var b=Array.prototype.slice;a.extend(a.event.special,{resizestop:{add:function(d){var c=d.handler;a(this).resize(function(f){clearTimeout(c._timer);f.type="resizestop";var g=a.proxy(c,this,f);c._timer=setTimeout(g,d.data\|\|200)})}},resizestart:{add:function(d){var c=d.handler;a(this).on("resize",function(f){clearTimeout(c._timer);if(!c._started){f.type="resizestart";c.apply(this,arguments);c._started=true}c._timer=setTimeout(a.proxy(function(){c._started=false},this),d.data\|\|300)})}}});a.extend(a.fn,{resizestop:function(){a(this).on.apply(this,["resizestop"].concat(b.call(arguments)))},resizestart:function(){a(this).on.apply(this,["resizestart"].concat(b.call(arguments)))}})})(jQuery);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\js[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	89067
Entropy (8bit):	5.499694662505391
Encrypted:	false
SSDEEP:	1536:Cq4bXD7zVeBY0cw+bSge2Ez147MA0Ufku3W6BQpI4Y4159dKP+jqV9Yn9XpeOD6y:Cq4bXD7peBY0z2JqUMumRDYN+tpV
MD5:	A43A683C6FD53E4D5B2A63D9734ED3A0
SHA1:	8A9A0C3BF8FAC0912268A2347598AAB40C157C8C
SHA-256:	86900BD7ED394CEA76AED0B2A58089F489AA2E8A6F8EC68A20BA259BDFC8C006
SHA-512:	A1330E619B6C858A18A58000902F492A3F6FACEFB8EFB82C8CAAD59957500E0184105FF047D1A221A4DFC6A9A7FB5D905D6C15E409004BE90836EB03B8D6D5AD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/gtm/js?id=GTM-PN4995V&t=gtm4&cid=232816534.1610016408
Preview:	.// Copyright 2012 Google Inc. All rights reserved..(function(){..var data = {."resource": {. "version":"58",. . "macros":[{. "function":"__e". },{. "function":"__dee". },{. "vtp_experimentKey":"OPT-PN4995V_OPT-KLJFX",. "function":"__c",. "vtp_value":false. },{. "function":"__u",. "vtp_component":"URL",. "vtp_enableMultiQueryKeys":false,. "vtp_enableIgnoreEmptyQueryParam":false. },{. "function":"__exs",. "vtp_measurementId":"dQa6A4ocQAGqzIg8hjAC6Q",. "vtp_sections":["list",5]. },{. "vtp_experimentKey":"OPT-PN4995V_OPT-KLJFX",. "function":"__c",. "vtp_value":1000. },{. "vtp_experimentKey":"OPT-PN4995V_OPT-KLJFX",. "function":"__c",. "vtp_value":366. },{. "function":"__cie",. "vtp_experimentState":["macro",4],. "vtp_trafficCoverage":["macro",5],. "vtp_trafficCoverageHash":["macro",6]. },{. "function":"__c",. "vtp_value":false. },{. "fu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\lc_switch.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2099
Entropy (8bit):	4.990558043076559
Encrypted:	false
SSDEEP:	48:PcBaBqFdH/7bPFnMCWbiZ5SJYE0SW5xuba:PcsBqXHPPxMsSa6ba
MD5:	0DDAAA8CE495F9C58F7C12F2D0BB83F5
SHA1:	782E93E8B33B6FA2F8FF4BA8CE60A4953E9B8AFD
SHA-256:	B1B6B8E2202BB9128702E3912A597EA54ED8FCD174206AA238ACEEDF75BF8E5E
SHA-512:	06FCACD92EDBC06C64C302A76A0A7FC55236ED4D1282F22D152C61E862A57948B84A557BE516353040CCB25125A6C6E3E147DC661D6BB638F4ACEED6B88ED696
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom16/js/lc_switch.min.js?ecv=1472666662
Preview:	(function(a){if("undefined"!=typeof a.fn.lc_switch)return!1;a.fn.lc_switch=function(d,f){a.fn.lcs_destroy=function(){a(this).each(function(){a(this).parents(".lcs_wrap").children().not("input").remove();a(this).unwrap()});return!0};a.fn.lcs_on=function(){a(this).each(function(){var b=a(this).parents(".lcs_wrap"),c=b.find("input");"function"==typeof a.fn.prop?b.find("input").prop("checked",!0):b.find("input").attr("checked",!0);b.find("input").trigger("lcs-on");b.find("input").trigger("lcs-statuschange");b.find(".lcs_switch").removeClass("lcs_off").addClass("lcs_on");if(b.find(".lcs_switch").hasClass("lcs_radio_switch")){var d=c.attr("name");b.parents("form").find("input[name="+d+"]").not(c).lcs_off()}});return!0};a.fn.lcs_off=function(){a(this).each(function(){var b=a(this).parents(".lcs_wrap");"function"==typeof a.fn.prop?b.find("input").prop("checked",!1):b.find("input").attr("checked",!1);b.find("input").trigger("lcs-off");b.find("input").trigger("lcs-statuschange");b.find(".lcs_swi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\lc_switch.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	2099
Entropy (8bit):	4.990558043076559
Encrypted:	false
SSDEEP:	48:PcBaBqFdH/7bPFnMCWbiZ5SJYE0SW5xuba:PcsBqXHPPxMsSa6ba
MD5:	0DDAAA8CE495F9C58F7C12F2D0BB83F5
SHA1:	782E93E8B33B6FA2F8FF4BA8CE60A4953E9B8AFD
SHA-256:	B1B6B8E2202BB9128702E3912A597EA54ED8FCD174206AA238ACEEDF75BF8E5E
SHA-512:	06FCACD92EDBC06C64C302A76A0A7FC55236ED4D1282F22D152C61E862A57948B84A557BE516353040CCB25125A6C6E3E147DC661D6BB638F4ACEED6B88ED696
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/js/lc_switch.min.js?ver=1539886789
Preview:	(function(a){if("undefined"!=typeof a.fn.lc_switch)return!1;a.fn.lc_switch=function(d,f){a.fn.lcs_destroy=function(){a(this).each(function(){a(this).parents(".lcs_wrap").children().not("input").remove();a(this).unwrap()});return!0};a.fn.lcs_on=function(){a(this).each(function(){var b=a(this).parents(".lcs_wrap"),c=b.find("input");"function"==typeof a.fn.prop?b.find("input").prop("checked",!0):b.find("input").attr("checked",!0);b.find("input").trigger("lcs-on");b.find("input").trigger("lcs-statuschange");b.find(".lcs_switch").removeClass("lcs_off").addClass("lcs_on");if(b.find(".lcs_switch").hasClass("lcs_radio_switch")){var d=c.attr("name");b.parents("form").find("input[name="+d+"]").not(c).lcs_off()}});return!0};a.fn.lcs_off=function(){a(this).each(function(){var b=a(this).parents(".lcs_wrap");"function"==typeof a.fn.prop?b.find("input").prop("checked",!1):b.find("input").attr("checked",!1);b.find("input").trigger("lcs-off");b.find("input").trigger("lcs-statuschange");b.find(".lcs_swi

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\pd[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	5186
Entropy (8bit):	5.177511759121435
Encrypted:	false
SSDEEP:	96:SZ6XcSJpDSMe+8gGVHRwE9gib6Ymv4/q1ykQ7KJcBWXDylZP25A/F4tT5yqUg8:SZMcSK/PgdQYBQ7KGBW2lZ25A9mT5f8
MD5:	4801DAC64526FE7AE9A2B34F19E7943F
SHA1:	4DF465117F396C248B6A3EFC4E897D496C1D2041
SHA-256:	925BE107869153B6120DE872C1AE333977BFAEE69A0F7C6271F32D4A8348BCA8
SHA-512:	4E911ABB2A57BE6491AD3AD0E7E82AF31674B83E20B3017D544015AC269BD9A84FC5D7ABF0BF055779EAED7D1084BDE5C6E7B4D8118BE8B6902733FF45A16AF8
Malicious:	false
Reputation:	low
IE Cache URL:	https://pi.pardot.com/pd.js
Preview:	/! 2020-03-12 10:41:10 /.function checkNamespace(e){for(var t=e.split("."),r=window,i=0;i<t.length;i++){var a=t[i];r[a]\|\|(r[a]={}),r=r[a]}}function getPardotUrl(){var e="pi.pardot.com";return"string"==typeof piHostname&&(e=piHostname),("https:"==document.location.protocol?"https://":"http://")+e}function piTracker(e){if(checkNamespace("pi.tracker"),pi.tracker.visitor_id=piGetCookie("visitor_id"+(piAId-1e3)),pi.tracker.visitor_id_sign=piGetCookie("visitor_id"+(piAId-1e3)+"-hash"),pi.tracker.pi_opt_in=piGetCookie("pi_opt_in"+(piAId-1e3)),"false"!=pi.tracker.pi_opt_in\|\|void 0!==pi.tracker.title&&pi.tracker.notify_pi){var t=piGetParameter(document.URL,"pi_campaign_id");null!=t?pi.tracker.campaign_id=t:"undefined"!=typeof piCId&&""!=piCId&&null!=piCId?pi.tracker.campaign_id=piCId:pi.tracker.campaign_id=null,pi.tracker.account_id=piAId,pi.tracker.title=document.title,"undefined"!=typeof piPoints&&(pi.tracker.pi_points=piPoints),pi.tracker.url=void 0!==e?e:document.URL,pi.tracker.referrer=d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\pixel[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	downloaded
Size (bytes):	43
Entropy (8bit):	2.7374910194847146
Encrypted:	false
SSDEEP:	3:CU9yltxlHh/:m/
MD5:	DF3E567D6F16D040326C7A0EA29A4F41
SHA1:	EA7DF583983133B62712B5E73BFFBCD45CC53736
SHA-256:	548F2D6F4D0D820C6C5FFBEFFCBD7F0E73193E2932EEFE542ACCC84762DEEC87
SHA-512:	B2CA25A3311DC42942E046EB1A27038B71D689925B7D6B3EBB4D7CD2C7B9A0C7DE3D10175790AC060DC3F8ACF3C1708C336626BE06879097F4D0ECAA7F567041
Malicious:	false
Reputation:	low
IE Cache URL:	https://q.quora.com/_/ad/38dbc5f3bef0495f9b60a514c5243560/pixel?j=1&u=https%3A%2F%2Fwww.ecornell.com%2Fabout-ecornell%2Fhelp%2F&tag=ViewContent&ts=1610016426968
Preview:	GIF89a.............!.......,...........D..;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\rhfnkn45i93k[1].json Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	55713
Entropy (8bit):	5.451055311473391
Encrypted:	false
SSDEEP:	384:nXatLJd7CIsGnzbEZYC01HmuX3mnriP0SY6cfrqplmors+6OQdPQCN2/GQA06dC5:nKd7fzJfOmYk+iyrGV/1wOVaWwXyeU1
MD5:	33C7C5999BA93DED5048E34472A352A6
SHA1:	7F968D003CC59632E33BE16AD7766BB461ED8D78
SHA-256:	29B56091AB9376D92548BA384D703221F83E3DDABF7F394D856B63FBB1C81971
SHA-512:	0C70B51B0D7CD2C55C1D0FA9051CE18E1A86A7A898DADF2FDE23649B72EAFC1D0A33723664711C992B3A5FE9C969B344F3D9B10CFA7C67EC433475B1548CE4D3
Malicious:	false
Reputation:	low
IE Cache URL:	https://embeds.driftcdn.com/embeds/rhfnkn45i93k.json
Preview:	{"id":"rhfnkn45i93k","url":"https://js.driftt.com/embeds/rhfnkn45i93k.json","snippet":null,"orgId":1176912,"verified":false,"includeUrl":"https://js.driftt.com/include/53666519/rhfnkn45i93k.js","configuration":{"inboxId":278988,"refreshRate":300000,"layerAppId":null,"inboxEmailAddress":"info@ecornell.com","authClientId":"6mx25hy22pgpbc","redirectUri":"https://app.drift.com","organizationName":"eCornell","organizationAddress":"950 Danby Rd, Suite 150, Ithaca, NY 14850","organizationUrl":"www.ecornell.com","organizationTwitterLink":"","organizationLinkedinLink":"","organizationFacebookLink":"","theme":{"backgroundColor":"A3241D","foregroundColor":"FFFFFF","textColor":null,"activeColor":"A3241D","widgetBackgroundColor":"FFFFFF","logoUrl":"https://file2.api.drift.com/download/drift-prod-file-uploads/dcac%2Fdcac67bafb3b60352cfef7b1f8877d9c/COR001.eCornell.Logo.RGB.png?mimeType=image%2Fpng","iconUrl":null,"userListMode":"RANDOM","userList":[],"welcomeMessage":null,"awayMessage":null,"awayMes

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\style[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	223727
Entropy (8bit):	5.159400889328025
Encrypted:	false
SSDEEP:	3072://MtFcL4EaLrW3RuSA5EhsC/sXUxji1WgEhJ7BCYxCl4puI+J7mdvtB/://sFauF5qHH
MD5:	382A4DB35DCE559D5480C9F2CFC5750F
SHA1:	3D3DCDE7F6DE6E5EB7BDC603648F5909A25443FD
SHA-256:	A73DD1EB7D92B4E3A1EAA04D623F5CF37FD50A93893A74AB5D1DF8CFC70BDD6B
SHA-512:	152152F9D000B1FA7E85176E035B68D3571E33A9085AEADD8194BA041183A389C49109FED33A5A3E4C5F1739E7BEB5E195AF1F45CF81121CB4BF67FAB82B9F3A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/themes/ecustom18/style.css?ver=1608654674
Preview:	@import url('https://fonts.googleapis.com/css?family=Raleway:300,300i,400,400i,500,500i,600,600i,700,700i,800,800i');@import url(fonts/et-line.css);/!.Theme Name: .eCustom18.Theme URI: ..http://www.ecornell.com.Description: .custom eCornell theme.Author: ..Danny Freire.Author URI: .http://freire-design.com.Version: ..1.0./.gotham-lt{font-family:'Raleway',sans-serif;font-style:normal;font-weight:300}.gotham-book,.raleway-normal{font-family:'Raleway',sans-serif;font-style:normal;font-weight:400}.gotham-med,.raleWayMed{font-family:'Raleway',sans-serif;font-style:normal;font-weight:500}.raleway-semibold{font-family:'Raleway',sans-serif;font-style:normal;font-weight:600}.gotham-bold,.raleway-bold{font-family:'Raleway',sans-serif;font-style:normal;font-weight:700}.raleway-extrabold{font-family:'Raleway',sans-serif;font-style:normal;font-weight:800}.removeFilter{filter:none!important;-webkit-filter:none!important;-webkit-transition:none!important}@media screen{body.page-template-default #ma

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\verification[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	416
Entropy (8bit):	4.862300897033639
Encrypted:	false
SSDEEP:	12:zASHA4QytmwSBHl3vqRH9hl6oFsHfvqN958v:zA0A4HtgT/W9SouY5+
MD5:	EB3364012F9C3C0BB8EFC7B7113C3E66
SHA1:	8CD9069D865082724D7492BA607EEEBDB360BAC5
SHA-256:	DB204CEC7ECB38F2A6F90F483AEC04AB48D3689C5CA79060E85CDF4457E6B48F
SHA-512:	C82EED2731FAB83D2EA0D8F758C4F833A914F9F7B17AE23482F6CBEE7530B6D541ED1B0FBB83CA0A62A758518DD78C8877B53A4E0A1250FB5EBE2F74A835B314
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-content/plugins/google-site-verification-using-meta-tag//verification.js?ver=5.5.3
Preview:	jQuery(document).ready( function($) {..$("#btngoogle").click( function() {. var dt = $('#google_head_tag_verification_item').val();. var data = {....action: 'test_response',. post_var: dt...};...// the_ajax_script.ajaxurl is a variable that will contain the url to the ajax processing file.. .$.post(the_ajax_script.ajaxurl, data, function(response) {....alert(response);.. .});.. .return false;..});.});.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\CS6IXJW6\wp-embed.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	1434
Entropy (8bit):	5.163070230765156
Encrypted:	false
SSDEEP:	24:Q77/3OiIoZisEenEyst1mbqLiEFjGTLrOpEi6Ruy5iWWYSCkmgP+:Q7jn0sxEysbmmWrGEia5iWWL4gP+
MD5:	8ED6038A5DBF62380DE72A681340AFD3
SHA1:	1B7F829B844EAA1A3E2D05F51FA81D6579D76738
SHA-256:	6EBCDA7A3A41EF97F0B4071160CEB1020E540FDC0F790079A5C2EF01AB654FE0
SHA-512:	CF69087B8F92F7B81EFA788C3EB0B8A551405CDC7FA137E09A918349617359715AD5EF833F901E8D6E80C9FF20F63091710B492224E2AD23848673995DFF5610
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.ecornell.com/wp-includes/js/wp-embed.min.js?ver=4.6.1
Preview:	/! This file is auto-generated /.!function(d,l){"use strict";var e=!1,o=!1;if(l.querySelector)if(d.addEventListener)e=!0;if(d.wp=d.wp\|\|{},!d.wp.receiveEmbedMessage)if(d.wp.receiveEmbedMessage=function(e){var t=e.data;if(t)if(t.secret\|\|t.message\|\|t.value)if(!/[^a-zA-Z0-9]/.test(t.secret)){var r,a,i,s,n,o=l.querySelectorAll('iframe[data-secret="'+t.secret+'"]'),c=l.querySelectorAll('blockquote[data-secret="'+t.secret+'"]');for(r=0;r<c.length;r++)c[r].style.display="none";for(r=0;r<o.length;r++)if(a=o[r],e.source===a.contentWindow){if(a.removeAttribute("style"),"height"===t.message){if(1e3<(i=parseInt(t.value,10)))i=1e3;else if(~~i<200)i=200;a.height=i}if("link"===t.message)if(s=l.createElement("a"),n=l.createElement("a"),s.href=a.getAttribute("src"),n.href=t.value,n.host===s.host)if(l.activeElement===a)d.top.location.href=t.value}}},e)d.addEventListener("message",d.wp.receiveEmbedMessage,!1),l.addEventListener("DOMContentLoaded",t,!1),d.addEventListener("load",t,!1);function t(){if(!o)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\1564543307137132[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	246678
Entropy (8bit):	5.467444335736789
Encrypted:	false
SSDEEP:	6144:Rk1HWCSntDV/H4K3V/H486EPjQHWuH3HpsG9:f6Ey
MD5:	2E0FE846DF7FA152B26F4D03C80B8219
SHA1:	19DFE71DE36B0ACD74CB159E2C03486B0839622D
SHA-256:	F00F72C7AAD3718FBB2411B881D3AB1BB36031EE2FA0778D5854C4818697C22B
SHA-512:	B9CC8CC1FBAE1A7CD7556CE87C4287B4C74AC9FC5EC0CF693E6ADEB36CE2E4BB7890815CDB6E34C2699E59D92598262CBB75B6134AF0F3DEB431465770A43134
Malicious:	false
Reputation:	low
IE Cache URL:	https://connect.facebook.net/signals/config/1564543307137132?v=2.9.31&r=stable
Preview:	/*. Copyright (c) 2017-present, Facebook, Inc. All rights reserved... You are hereby granted a non-exclusive, worldwide, royalty-free license to use,.* copy, modify, and distribute this software in source code or binary form for use.* in connection with the web services and APIs provided by Facebook... As with any software that integrates with the Facebook platform, your use of.* this software is subject to the Facebook Platform Policy.* [http://developers.facebook.com/policy/]. This copyright notice shall be.* included in all copies or substantial portions of the software... THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR.* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS.* FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR.* COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER.* IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN.* CONNECTION WI

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\1lJ_0XvJmqEPocFYVYGCtByhfat14c3J70plBBDGL4k[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	22048
Entropy (8bit):	5.593258339873243
Encrypted:	false
SSDEEP:	384:nj3+rCkEgdfEoJBfE/+PyvsTBpaNKX1yz9uwGNRc6S1nBX+l:RkvCYY20IXNdOBK
MD5:	6E921DE6E8F31E2ED58E5B1533C8AF3F
SHA1:	B16E0DE171D7BC35D18D818807AE3A50649EBCD7
SHA-256:	D6527FD17BC99AA10FA1C158558182B41CA17DAB75E1CDC9EF4A650410C62F89
SHA-512:	3011B219DED1B8F9169566DC7B5F109C38AA95F765CBEBF1963A866FCBA8088BAD811381AEA96C33D8B2C7188A39293EB9FFCCEB3325986CEFCB23A28F5F0468
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google.com/js/bg/1lJ_0XvJmqEPocFYVYGCtByhfat14c3J70plBBDGL4k.js
Preview:	/* Anti-spam. Want to say hello? Contact (base64) Ym90Z3VhcmQtY29udGFjdEBnb29nbGUuY29t / (function(){var I=function(Z){return Z},q=this\|\|self,D=function(Z,c){if(c=null,Z=q.trustedTypes,!Z\|\|!Z.createPolicy)return c;try{c=Z.createPolicy("bg",{createHTML:I,createScript:I,createScriptURL:I})}catch(v){q.console&&q.console.error(v.message)}return c};(0,eval)(function(Z){return(Z=D())&&1===eval(Z.createScript("1"))?function(c){return Z.createScript(c)}:function(c){return""+c}}()(Array(7824Math.random()\|0).join("\n")+'(function(){var ZX=function(Z,I,c,v,F){for(v=(c=F=0,[]);c<Z.length;c++)I=Z.charCodeAt(c),128>I?v[F++]=I:(2048>I?v[F++]=I>>6\|192:(55296==(I&64512)&&c+1<Z.length&&56320==(Z.charCodeAt(c+1)&64512)?(I=65536+((I&1023)<<10)+(Z.charCodeAt(++c)&1023),v[F++]=I>>18\|240,v[F++]=I>>12&63\|128):v[F++]=I>>12\|224,v[F++]=I>>6&63\|128),v[F++]=I&63\|128);return v},cq=function(Z,I,c){if((I=typeof Z,"object")==I)if(Z){if(Z instanceof Array)return"array";if(Z instanceof Object)return I;if((c=Object.pro

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\OR0WKIO1\analytics[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	47051
Entropy (8bit):	5.516264124030958
Encrypted:	false
SSDEEP:	768:ryOveCSBZfsnt5XqY/yPndFTkoWY3SoavqVy2rlebYUDTJC6g0stZm:ryJNDfs5hYdFTwY3SorSg0su
MD5:	53EE95B384D866E8692BB1AEF923B763
SHA1:	A82812B87B667D32A8E51514C578A5175EDD94B4
SHA-256:	E441C3E2771625BA05630AB464275136A82C99650EE2145CA5AA9853BEDEB01B
SHA-512:	C1F98A09A102BB1E87BFDF825A725B0E2CC1DBEDB613D1BD9E8FD9D8FD8B145104D5F4CACA44D96DB14AC20F2F51B4C653278BFC87556E7F00E48A5FA6231FAD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.google-analytics.com/analytics.js
Preview:	(function(){/.. Copyright The Closure Library Authors.. SPDX-License-Identifier: Apache-2.0./.var l=this\|\|self,m=function(a,b){a=a.split(".");var c=l;a[0]in c\|\|"undefined"==typeof c.execScript\|\|c.execScript("var "+a[0]);for(var d;a.length&&(d=a.shift());)a.length\|\|void 0===b?c=c[d]&&c[d]!==Object.prototype[d]?c[d]:c[d]={}:c[d]=b};var q=function(a,b){for(var c in b)b.hasOwnProperty(c)&&(a[c]=b[c])},r=function(a){for(var b in a)if(a.hasOwnProperty(b))return!0;return!1};var t=/^(?:(?:https?\|mailto\|ftp):\|[^:/?#]*(?:[/?#]\|$))/i;var u=window,v=document,w=function(a,b){v.addEventListener?v.addEventListener(a,b,!1):v.attachEvent&&v.attachEvent("on"+a,b)};var x={},y=function(){x.TAGGING=x.TAGGING\|\|[];x.TAGGING[1]=!0};var z=/:[0-9]+$/,A=function(a,b,c){a=a.split("&");for(var d=0;d<a.length;d++){var e=a[d].split("=");if(decodeURIComponent(e[0]).replace(/\+/g," ")===b)return b=e.slice(1).join("="),c?b:decodeURIComponent(b).replace(/\+/g," ")}},D=function(a,b){b&&(b=String(b).toLowerCase());if("p

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2021 11:46:44.740320921 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:44.741122961 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:44.866842031 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:44.867044926 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:44.867393017 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:44.867491007 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:44.880026102 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:44.880290985 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.006445885 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.006465912 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.007546902 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.007572889 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.007589102 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.007663012 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.008538961 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.008558989 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.008600950 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.008626938 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.008635998 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.008685112 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.177076101 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.182821989 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.183043003 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.185502052 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.185795069 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.303970098 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.304014921 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.304080009 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.304124117 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.304744005 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.309205055 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.309294939 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.312002897 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.312043905 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.312076092 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.312117100 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.312890053 CET	49727	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.337979078 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.338037968 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.338346958 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.338402987 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.348835945 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.464977026 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.481884003 CET	443	49727	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.497148991 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.497178078 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.497302055 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.507554054 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.656522989 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.656569004 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.656600952 CET	443	49728	18.235.114.243	192.168.2.4
Jan 7, 2021 11:46:45.656621933 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.656672001 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.656678915 CET	49728	443	192.168.2.4	18.235.114.243
Jan 7, 2021 11:46:45.727305889 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.728148937 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.853956938 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.854084969 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.854631901 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.854737997 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.854804039 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.855525970 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.981324911 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.981921911 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.982405901 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.982424974 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.982486963 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.982506990 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.982521057 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.982539892 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.982567072 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.982589006 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.983256102 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.983273029 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.983314037 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.983350992 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.983442068 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.983485937 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.983515024 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:45.983557940 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.999258041 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.999701977 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:45.999905109 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.003808975 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.004326105 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.126209021 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.126233101 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.126319885 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.126351118 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.127049923 CET	49729	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.130573988 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.130667925 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.130762100 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.130788088 CET	443	49730	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.130815029 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.130827904 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.133934021 CET	49730	443	192.168.2.4	3.217.57.115
Jan 7, 2021 11:46:46.159079075 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.159104109 CET	443	49729	3.217.57.115	192.168.2.4
Jan 7, 2021 11:46:46.159116030 CET	443	49729	3.217.57.115	192.168.2.4

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Jan 7, 2021 11:46:40.446923971 CET	49714	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:40.508398056 CET	53	49714	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:41.541443110 CET	58028	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:41.589350939 CET	53	58028	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:42.516072035 CET	53097	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:42.564043999 CET	53	53097	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:43.049855947 CET	49257	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:43.110243082 CET	53	49257	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:43.437777996 CET	62389	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:43.488632917 CET	53	62389	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:44.521507978 CET	49910	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:44.569760084 CET	53	49910	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:44.572925091 CET	55854	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:44.730959892 CET	53	55854	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:45.665879011 CET	64549	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:45.724654913 CET	53	64549	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:45.804075956 CET	63153	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:45.852066040 CET	53	63153	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:46.234174013 CET	52991	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:46.382894039 CET	53	52991	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:46.404058933 CET	53700	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:46.468653917 CET	53	53700	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:47.268770933 CET	51726	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:47.316659927 CET	53	51726	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:47.808825016 CET	56794	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:47.865369081 CET	53	56794	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.177201033 CET	56534	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.241848946 CET	53	56534	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.265661001 CET	56627	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.271557093 CET	56621	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.276271105 CET	63116	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.324068069 CET	53	63116	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.327706099 CET	53	56627	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.338953018 CET	53	56621	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.434537888 CET	64078	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.440438986 CET	64801	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.488125086 CET	53	64801	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.501699924 CET	53	64078	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:48.717179060 CET	61721	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:48.781344891 CET	53	61721	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.114865065 CET	51255	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.181896925 CET	53	51255	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.277563095 CET	61522	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.349405050 CET	52337	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.397124052 CET	53	52337	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.411716938 CET	55046	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.428457975 CET	53	61522	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.433587074 CET	49612	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.452265024 CET	49285	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.460825920 CET	50601	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.473094940 CET	60875	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.476027012 CET	53	55046	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.481614113 CET	56448	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.493325949 CET	53	49612	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.514487982 CET	53	49285	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.523433924 CET	53	50601	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.533265114 CET	53	60875	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.539511919 CET	53	56448	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.558917999 CET	59172	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.613290071 CET	62420	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.619576931 CET	53	59172	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.669742107 CET	53	62420	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.804689884 CET	60579	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.809853077 CET	50183	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.857666969 CET	53	50183	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.862335920 CET	53	60579	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.890397072 CET	61531	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.898478985 CET	49228	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.915426970 CET	59794	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.940347910 CET	55916	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:49.949353933 CET	53	49228	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.949429035 CET	53	61531	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:49.963273048 CET	53	59794	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.007155895 CET	53	55916	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.291433096 CET	52752	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:50.338310003 CET	60542	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:50.363991022 CET	53	52752	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.388952017 CET	53	60542	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.411412954 CET	60689	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:50.450599909 CET	64206	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:50.469377041 CET	53	60689	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.506835938 CET	53	64206	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:50.911443949 CET	50904	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:50.967675924 CET	53	50904	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:51.141460896 CET	57525	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:51.189302921 CET	53	57525	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:51.221436977 CET	53814	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:51.269227982 CET	53	53814	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:51.957994938 CET	53418	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:51.985271931 CET	62833	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:52.054195881 CET	53	62833	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:52.133300066 CET	53	53418	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:52.365658998 CET	59260	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:52.416541100 CET	53	59260	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:53.367098093 CET	49944	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:53.414937973 CET	53	49944	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:54.316579103 CET	63300	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:54.364456892 CET	53	63300	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:55.346977949 CET	61449	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:55.394931078 CET	53	61449	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:56.313309908 CET	51275	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:56.361502886 CET	53	51275	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:57.364531040 CET	63492	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:57.423913956 CET	53	63492	8.8.8.8	192.168.2.4
Jan 7, 2021 11:46:59.669047117 CET	58945	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:46:59.717081070 CET	53	58945	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:01.324827909 CET	60779	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:01.381176949 CET	53	60779	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:01.525378942 CET	64014	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:01.576251984 CET	53	64014	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:03.140574932 CET	57091	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:03.188801050 CET	53	57091	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:09.856523037 CET	55904	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:09.917263985 CET	53	55904	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:13.040371895 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:13.096892118 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:14.024247885 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:14.054693937 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:14.074083090 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:14.111140013 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:15.034981966 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:15.057121038 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:15.091151953 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:15.113343954 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:16.046200991 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:16.094994068 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:17.075988054 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:17.133161068 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:18.059500933 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:18.107528925 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:19.994976997 CET	49374	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:20.067128897 CET	53	49374	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:20.125746012 CET	50436	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:20.198523045 CET	53	50436	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:20.508343935 CET	62605	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:20.579713106 CET	53	62605	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:21.082757950 CET	52109	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:21.130642891 CET	53	52109	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:21.224783897 CET	54256	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:21.281477928 CET	53	54256	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:21.651460886 CET	52189	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:21.708277941 CET	53	52189	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:22.065238953 CET	54450	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:22.105585098 CET	56131	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:22.128792048 CET	53	54450	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:22.161830902 CET	53	56131	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:22.611433029 CET	62992	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:22.667608976 CET	53	62992	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:23.106726885 CET	54432	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:23.166218996 CET	53	54432	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:23.729036093 CET	57227	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:23.788203955 CET	53	57227	8.8.8.8	192.168.2.4
Jan 7, 2021 11:47:24.413383007 CET	58383	53	192.168.2.4	8.8.8.8
Jan 7, 2021 11:47:24.472621918 CET	53	58383	8.8.8.8	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Jan 7, 2021 11:46:44.572925091 CET	192.168.2.4	8.8.8.8	0x76bb	Standard query (0)	lms.ecornell.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:45.665879011 CET	192.168.2.4	8.8.8.8	0xb89a	Standard query (0)	auth-ex.ecornell.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:46.234174013 CET	192.168.2.4	8.8.8.8	0xca8e	Standard query (0)	www.ecornell.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:46.404058933 CET	192.168.2.4	8.8.8.8	0x9cda	Standard query (0)	www.youtube.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:48.265661001 CET	192.168.2.4	8.8.8.8	0xf6a9	Standard query (0)	js.driftt.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.277563095 CET	192.168.2.4	8.8.8.8	0xcda	Standard query (0)	portal.ecornell.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.433587074 CET	192.168.2.4	8.8.8.8	0xc419	Standard query (0)	snap.licdn.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.452265024 CET	192.168.2.4	8.8.8.8	0x7969	Standard query (0)	www.redditstatic.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.460825920 CET	192.168.2.4	8.8.8.8	0x8716	Standard query (0)	connect.facebook.net	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.473094940 CET	192.168.2.4	8.8.8.8	0x4d5b	Standard query (0)	static.ads-twitter.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.481614113 CET	192.168.2.4	8.8.8.8	0x5361	Standard query (0)	a.quora.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.558917999 CET	192.168.2.4	8.8.8.8	0x7624	Standard query (0)	analytics.tiktok.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.804689884 CET	192.168.2.4	8.8.8.8	0xbc97	Standard query (0)	alb.reddit.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.809853077 CET	192.168.2.4	8.8.8.8	0x6aa6	Standard query (0)	px.ads.linkedin.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.890397072 CET	192.168.2.4	8.8.8.8	0x9219	Standard query (0)	q.quora.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.898478985 CET	192.168.2.4	8.8.8.8	0xb46d	Standard query (0)	analytics.twitter.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.915426970 CET	192.168.2.4	8.8.8.8	0xf491	Standard query (0)	t.co	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.940347910 CET	192.168.2.4	8.8.8.8	0x9219	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.291433096 CET	192.168.2.4	8.8.8.8	0x3abe	Standard query (0)	googleads.g.doubleclick.net	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.338310003 CET	192.168.2.4	8.8.8.8	0xfba4	Standard query (0)	www.linkedin.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.411412954 CET	192.168.2.4	8.8.8.8	0x263	Standard query (0)	sf19-scmcdn-va.ibytedtos.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.450599909 CET	192.168.2.4	8.8.8.8	0xb9a1	Standard query (0)	www.google.co.uk	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.911443949 CET	192.168.2.4	8.8.8.8	0x1e1f	Standard query (0)	pi.pardot.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:51.141460896 CET	192.168.2.4	8.8.8.8	0xc8ac	Standard query (0)	cdnjs.cloudflare.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:51.957994938 CET	192.168.2.4	8.8.8.8	0xcdcb	Standard query (0)	start.ecornell.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:51.985271931 CET	192.168.2.4	8.8.8.8	0x1e55	Standard query (0)	embeds.driftcdn.com	A (IP address)	IN (0x0001)
Jan 7, 2021 11:47:01.324827909 CET	192.168.2.4	8.8.8.8	0x8933	Standard query (0)	auth-ex.ecornell.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Jan 7, 2021 11:46:44.730959892 CET	8.8.8.8	192.168.2.4	0x76bb	No error (0)	lms.ecornell.com	ecornell-vanity.instructure.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:44.730959892 CET	8.8.8.8	192.168.2.4	0x76bb	No error (0)	ecornell-vanity.instructure.com	canvas-vanity-ecornell-290976688.us-east-1.elb.amazonaws.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:44.730959892 CET	8.8.8.8	192.168.2.4	0x76bb	No error (0)	canvas-vanity-ecornell-290976688.us-east-1.elb.amazonaws.com		18.235.114.243	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:44.730959892 CET	8.8.8.8	192.168.2.4	0x76bb	No error (0)	canvas-vanity-ecornell-290976688.us-east-1.elb.amazonaws.com		52.73.215.240	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:44.730959892 CET	8.8.8.8	192.168.2.4	0x76bb	No error (0)	canvas-vanity-ecornell-290976688.us-east-1.elb.amazonaws.com		107.22.27.241	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:45.724654913 CET	8.8.8.8	192.168.2.4	0xb89a	No error (0)	auth-ex.ecornell.com	ec-cas-prod.us-east-1.elasticbeanstalk.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:45.724654913 CET	8.8.8.8	192.168.2.4	0xb89a	No error (0)	ec-cas-prod.us-east-1.elasticbeanstalk.com		3.217.57.115	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:45.724654913 CET	8.8.8.8	192.168.2.4	0xb89a	No error (0)	ec-cas-prod.us-east-1.elasticbeanstalk.com		34.194.225.199	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:46.382894039 CET	8.8.8.8	192.168.2.4	0xca8e	No error (0)	www.ecornell.com		35.227.175.178	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:46.468653917 CET	8.8.8.8	192.168.2.4	0x9cda	No error (0)	www.youtube.com	youtube-ui.l.google.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:48.327706099 CET	8.8.8.8	192.168.2.4	0xf6a9	No error (0)	js.driftt.com	dl7g9llrghqi1.cloudfront.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:48.327706099 CET	8.8.8.8	192.168.2.4	0xf6a9	No error (0)	dl7g9llrghqi1.cloudfront.net		143.204.2.32	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:48.327706099 CET	8.8.8.8	192.168.2.4	0xf6a9	No error (0)	dl7g9llrghqi1.cloudfront.net		143.204.2.118	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:48.327706099 CET	8.8.8.8	192.168.2.4	0xf6a9	No error (0)	dl7g9llrghqi1.cloudfront.net		143.204.2.99	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:48.327706099 CET	8.8.8.8	192.168.2.4	0xf6a9	No error (0)	dl7g9llrghqi1.cloudfront.net		143.204.2.71	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.428457975 CET	8.8.8.8	192.168.2.4	0xcda	No error (0)	portal.ecornell.com		23.23.202.249	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.493325949 CET	8.8.8.8	192.168.2.4	0xc419	No error (0)	snap.licdn.com	wildcard.licdn.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.514487982 CET	8.8.8.8	192.168.2.4	0x7969	No error (0)	www.redditstatic.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.514487982 CET	8.8.8.8	192.168.2.4	0x7969	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.514487982 CET	8.8.8.8	192.168.2.4	0x7969	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.514487982 CET	8.8.8.8	192.168.2.4	0x7969	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.514487982 CET	8.8.8.8	192.168.2.4	0x7969	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.523433924 CET	8.8.8.8	192.168.2.4	0x8716	No error (0)	connect.facebook.net	scontent.xx.fbcdn.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.523433924 CET	8.8.8.8	192.168.2.4	0x8716	No error (0)	scontent.xx.fbcdn.net		31.13.92.14	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.533265114 CET	8.8.8.8	192.168.2.4	0x4d5b	No error (0)	static.ads-twitter.com	platform.twitter.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.533265114 CET	8.8.8.8	192.168.2.4	0x4d5b	No error (0)	platform.twitter.map.fastly.net		199.232.136.157	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.539511919 CET	8.8.8.8	192.168.2.4	0x5361	No error (0)	a.quora.com	quora.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.539511919 CET	8.8.8.8	192.168.2.4	0x5361	No error (0)	quora.map.fastly.net		151.101.1.2	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.539511919 CET	8.8.8.8	192.168.2.4	0x5361	No error (0)	quora.map.fastly.net		151.101.65.2	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.539511919 CET	8.8.8.8	192.168.2.4	0x5361	No error (0)	quora.map.fastly.net		151.101.129.2	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.539511919 CET	8.8.8.8	192.168.2.4	0x5361	No error (0)	quora.map.fastly.net		151.101.193.2	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.619576931 CET	8.8.8.8	192.168.2.4	0x7624	No error (0)	analytics.tiktok.com	analytics.tiktok.com.edgekey.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.669742107 CET	8.8.8.8	192.168.2.4	0x5e53	No error (0)	pagead.l.doubleclick.net		142.250.180.130	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.857666969 CET	8.8.8.8	192.168.2.4	0x6aa6	No error (0)	px.ads.linkedin.com	mix.linkedin.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.857666969 CET	8.8.8.8	192.168.2.4	0x6aa6	No error (0)	mix.linkedin.com	pop-efr5.mix.linkedin.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.857666969 CET	8.8.8.8	192.168.2.4	0x6aa6	No error (0)	pop-efr5.mix.linkedin.com		185.63.145.5	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.862335920 CET	8.8.8.8	192.168.2.4	0xbc97	No error (0)	alb.reddit.com	reddit.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.862335920 CET	8.8.8.8	192.168.2.4	0xbc97	No error (0)	reddit.map.fastly.net		151.101.1.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.862335920 CET	8.8.8.8	192.168.2.4	0xbc97	No error (0)	reddit.map.fastly.net		151.101.65.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.862335920 CET	8.8.8.8	192.168.2.4	0xbc97	No error (0)	reddit.map.fastly.net		151.101.129.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.862335920 CET	8.8.8.8	192.168.2.4	0xbc97	No error (0)	reddit.map.fastly.net		151.101.193.140	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	analytics.twitter.com	ads.twitter.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	ads.twitter.com	s.twitter.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	s.twitter.com		104.244.42.131	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	s.twitter.com		104.244.42.195	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	s.twitter.com		104.244.42.67	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949353933 CET	8.8.8.8	192.168.2.4	0xb46d	No error (0)	s.twitter.com		104.244.42.3	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.217.219.88	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.214.152.179	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.230.50.184	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.227.227.165	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.213.100.238	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		3.225.115.141	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.949429035 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	q.quora.com		50.17.2.180	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.963273048 CET	8.8.8.8	192.168.2.4	0xf491	No error (0)	t.co		104.244.42.5	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.963273048 CET	8.8.8.8	192.168.2.4	0xf491	No error (0)	t.co		104.244.42.69	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.963273048 CET	8.8.8.8	192.168.2.4	0xf491	No error (0)	t.co		104.244.42.197	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:49.963273048 CET	8.8.8.8	192.168.2.4	0xf491	No error (0)	t.co		104.244.42.133	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.007155895 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.007155895 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	stats.l.doubleclick.net		108.177.15.154	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.007155895 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	stats.l.doubleclick.net		108.177.15.155	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.007155895 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	stats.l.doubleclick.net		108.177.15.156	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.007155895 CET	8.8.8.8	192.168.2.4	0x9219	No error (0)	stats.l.doubleclick.net		108.177.15.157	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.363991022 CET	8.8.8.8	192.168.2.4	0x3abe	No error (0)	googleads.g.doubleclick.net	pagead46.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.363991022 CET	8.8.8.8	192.168.2.4	0x3abe	No error (0)	pagead46.l.doubleclick.net		142.250.180.162	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.388952017 CET	8.8.8.8	192.168.2.4	0xfba4	No error (0)	www.linkedin.com	www-linkedin-com.l-0005.l-msedge.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.469377041 CET	8.8.8.8	192.168.2.4	0x263	No error (0)	sf19-scmcdn-va.ibytedtos.com	bytedance.map.fastly.net		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.469377041 CET	8.8.8.8	192.168.2.4	0x263	No error (0)	bytedance.map.fastly.net		199.232.138.133	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.506835938 CET	8.8.8.8	192.168.2.4	0xb9a1	No error (0)	www.google.co.uk		142.250.180.99	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:50.967675924 CET	8.8.8.8	192.168.2.4	0x1e1f	No error (0)	pi.pardot.com	pi-ue1.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.967675924 CET	8.8.8.8	192.168.2.4	0x1e1f	No error (0)	pi-ue1.pardot.com	pi.t.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.967675924 CET	8.8.8.8	192.168.2.4	0x1e1f	No error (0)	pi.t.pardot.com	pi-ue1-lba1.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:50.967675924 CET	8.8.8.8	192.168.2.4	0x1e1f	No error (0)	pi-ue1-lba1.pardot.com		52.202.69.186	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:51.189302921 CET	8.8.8.8	192.168.2.4	0xc8ac	No error (0)	cdnjs.cloudflare.com		104.16.19.94	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:51.189302921 CET	8.8.8.8	192.168.2.4	0xc8ac	No error (0)	cdnjs.cloudflare.com		104.16.18.94	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:52.054195881 CET	8.8.8.8	192.168.2.4	0x1e55	No error (0)	embeds.driftcdn.com		13.226.169.91	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:52.054195881 CET	8.8.8.8	192.168.2.4	0x1e55	No error (0)	embeds.driftcdn.com		13.226.169.31	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:52.054195881 CET	8.8.8.8	192.168.2.4	0x1e55	No error (0)	embeds.driftcdn.com		13.226.169.125	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:52.054195881 CET	8.8.8.8	192.168.2.4	0x1e55	No error (0)	embeds.driftcdn.com		13.226.169.56	A (IP address)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	start.ecornell.com	go.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	go.pardot.com	pi.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	pi.pardot.com	pi-ue1.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	pi-ue1.pardot.com	pi.t.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	pi.t.pardot.com	pi-ue1-lba4.pardot.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:46:52.133300066 CET	8.8.8.8	192.168.2.4	0xcdcb	No error (0)	pi-ue1-lba4.pardot.com		35.174.151.106	A (IP address)	IN (0x0001)
Jan 7, 2021 11:47:01.381176949 CET	8.8.8.8	192.168.2.4	0x8933	No error (0)	auth-ex.ecornell.com	ec-cas-prod.us-east-1.elasticbeanstalk.com		CNAME (Canonical name)	IN (0x0001)
Jan 7, 2021 11:47:01.381176949 CET	8.8.8.8	192.168.2.4	0x8933	No error (0)	ec-cas-prod.us-east-1.elasticbeanstalk.com		3.217.57.115	A (IP address)	IN (0x0001)
Jan 7, 2021 11:47:01.381176949 CET	8.8.8.8	192.168.2.4	0x8933	No error (0)	ec-cas-prod.us-east-1.elasticbeanstalk.com		34.194.225.199	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.ecornell.com

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	Process
0	192.168.2.4	49824	35.227.175.178	80	C:\Program Files (x86)\Internet Explorer\iexplore.exe

Timestamp	kBytes transferred	Direction	Data
Jan 7, 2021 11:47:04.613295078 CET	2760	OUT	GET /about-ecornell/help/ HTTP/1.1 Accept: text/html, application/xhtml+xml, image/jxr, / Accept-Language: en-US User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like Gecko Accept-Encoding: gzip, deflate Host: www.ecornell.com Connection: Keep-Alive Cookie: __utmc=97568779; __utmz=97568779.1610016408.1.1.utmcsr=(direct)\|utmccn=(direct)\|utmcmd=(none); __utma=97568779.232816534.1610016408.1610016408.1610016408.1; __utmb=97568779.1.10.1610016408; login-checked=%7B%22isStudentLogon%22%3A%22no%22%2C%22studentLogonUrl%22%3A%22%2Fportal%2Flogon.do%3Fmethod%3Dload%22%2C%22studentLogoutUrl%22%3A%22%2Fportal%2Flogon.do%3Fmethod%3Dload%22%2C%22currentActiveShoppingPathPage%22%3A%22%22%2C%22currentActiveStudentPortalPage%22%3A%22%22%2C%22currentActiveAdminPortalPage%22%3A%22%22%2C%22studentName%22%3A%22%22%2C%22numCartItems%22%3A%220%22%2C%22personId%22%3A%22%22%7D; __utmt=1; driftt_aid=3ab2b37c-632e-425d-a48a-9ef0eb27d4ff
Jan 7, 2021 11:47:04.795763969 CET	2760	IN	HTTP/1.1 301 Moved Permanently Server: nginx Date: Thu, 07 Jan 2021 10:47:04 GMT Content-Type: text/html Content-Length: 162 Connection: keep-alive Keep-Alive: timeout=20 Location: https://www.ecornell.com/about-ecornell/help/ Data Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 33 30 31 20 4d 6f 76 65 64 20 50 65 72 6d 61 6e 65 6e 74 6c 79 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>301 Moved Permanently</title></head><body><center><h1>301 Moved Permanently</h1></center><hr><center>nginx</center></body></html>

HTTPS Packets

Timestamp	Source IP	Source Port	Dest IP	Dest Port	Subject	Issuer	Not Before	Not After	JA3 SSL Client Fingerprint	JA3 SSL Client Digest
Jan 7, 2021 11:46:45.007589102 CET	18.235.114.243	443	192.168.2.4	49727	CN=lms.ecornell.com, O="Instructure, Inc.", L=Cottonwood Heights, ST=Utah, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu May 21 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu May 26 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:45.007589102 CET	18.235.114.243	443	192.168.2.4	49727	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:45.008635998 CET	18.235.114.243	443	192.168.2.4	49728	CN=lms.ecornell.com, O="Instructure, Inc.", L=Cottonwood Heights, ST=Utah, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu May 21 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Thu May 26 14:00:00 CEST 2022 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:45.008635998 CET	18.235.114.243	443	192.168.2.4	49728	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:45.982539892 CET	3.217.57.115	443	192.168.2.4	49729	CN=*.ecornell.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Aug 22 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Sep 22 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:45.983515024 CET	3.217.57.115	443	192.168.2.4	49730	CN=*.ecornell.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Aug 22 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Sep 22 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:46.809874058 CET	35.227.175.178	443	192.168.2.4	49734	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:46.811348915 CET	35.227.175.178	443	192.168.2.4	49737	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:46.815159082 CET	35.227.175.178	443	192.168.2.4	49733	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:46.816363096 CET	35.227.175.178	443	192.168.2.4	49736	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:46.818698883 CET	35.227.175.178	443	192.168.2.4	49735	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:46.819788933 CET	35.227.175.178	443	192.168.2.4	49732	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:47.245759010 CET	35.227.175.178	443	192.168.2.4	49740	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:47.251426935 CET	35.227.175.178	443	192.168.2.4	49741	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:48.412503958 CET	143.204.2.32	443	192.168.2.4	49752	CN=drift.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Mon Sep 21 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 23 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:48.414653063 CET	143.204.2.32	443	192.168.2.4	49753	CN=drift.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Mon Sep 21 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Sat Oct 23 02:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:49.628993988 CET	151.101.1.140	443	192.168.2.4	49773	CN=www.redditstatic.com, O=Reddit Inc., L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 26 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Mon Feb 22 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.628993988 CET	151.101.1.140	443	192.168.2.4	49773	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.629755974 CET	151.101.1.140	443	192.168.2.4	49772	CN=www.redditstatic.com, O=Reddit Inc., L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 26 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Mon Feb 22 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.629755974 CET	151.101.1.140	443	192.168.2.4	49772	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.640167952 CET	199.232.136.157	443	192.168.2.4	49775	CN=ads-twitter.com, OU=Twitter Security, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Aug 14 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Aug 19 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.640167952 CET	199.232.136.157	443	192.168.2.4	49775	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.640400887 CET	31.13.92.14	443	192.168.2.4	49776	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 22 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Mon Mar 22 00:59:59 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.640400887 CET	31.13.92.14	443	192.168.2.4	49776	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.641072035 CET	199.232.136.157	443	192.168.2.4	49774	CN=ads-twitter.com, OU=Twitter Security, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Aug 14 02:00:00 CEST 2020 Tue Oct 22 14:00:00 CEST 2013	Thu Aug 19 14:00:00 CEST 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.641072035 CET	199.232.136.157	443	192.168.2.4	49774	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.641156912 CET	31.13.92.14	443	192.168.2.4	49777	CN=*.facebook.com, O="Facebook, Inc.", L=Menlo Park, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Dec 22 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Mon Mar 22 00:59:59 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.641156912 CET	31.13.92.14	443	192.168.2.4	49777	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.646733999 CET	151.101.1.2	443	192.168.2.4	49779	CN=quora.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Dec 27 18:16:54 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Sat Mar 27 18:16:54 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.646733999 CET	151.101.1.2	443	192.168.2.4	49779	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.646866083 CET	151.101.1.2	443	192.168.2.4	49778	CN=quora.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Dec 27 18:16:54 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Sat Mar 27 18:16:54 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.646866083 CET	151.101.1.2	443	192.168.2.4	49778	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.818208933 CET	23.23.202.249	443	192.168.2.4	49766	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:49.820391893 CET	23.23.202.249	443	192.168.2.4	49767	CN=*.ecornell.com, OU=Domain Control Validated CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Fri Mar 29 19:00:11 CET 2019 Tue May 03 09:00:00 CEST 2011 Wed Jan 01 08:00:00 CET 2014 Tue Jun 29 19:06:20 CEST 2004	Fri May 28 15:51:41 CEST 2021 Sat May 03 09:00:00 CEST 2031 Fri May 30 09:00:00 CEST 2031 Thu Jun 29 19:06:20 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Go Daddy Secure Certificate Authority - G2, OU=http://certs.godaddy.com/repository/, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	Tue May 03 09:00:00 CEST 2011	Sat May 03 09:00:00 CEST 2031
					CN=Go Daddy Root Certificate Authority - G2, O="GoDaddy.com, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Wed Jan 01 08:00:00 CET 2014	Fri May 30 09:00:00 CEST 2031
					OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	OU=Go Daddy Class 2 Certification Authority, O="The Go Daddy Group, Inc.", C=US	Tue Jun 29 19:06:20 CEST 2004	Thu Jun 29 19:06:20 CEST 2034
Jan 7, 2021 11:46:49.914114952 CET	142.250.180.130	443	192.168.2.4	49782	CN=www.googleadservices.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:40:02 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:40:01 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.914114952 CET	142.250.180.130	443	192.168.2.4	49782	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.932533979 CET	142.250.180.130	443	192.168.2.4	49783	CN=www.googleadservices.com, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:40:02 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:40:01 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.932533979 CET	142.250.180.130	443	192.168.2.4	49783	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.954895020 CET	151.101.1.140	443	192.168.2.4	49786	CN=*.reddit.com, O=Reddit Inc., L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 26 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Mon Feb 22 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.954895020 CET	151.101.1.140	443	192.168.2.4	49786	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.959321022 CET	185.63.145.5	443	192.168.2.4	49785	CN=px.ads.linkedin.com, O=LinkedIn Corporation, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jan 06 01:00:00 CET 2021 Wed Sep 23 02:00:00 CEST 2020	Tue Jul 06 01:59:59 CEST 2021 Mon Sep 23 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.959321022 CET	185.63.145.5	443	192.168.2.4	49785	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.959384918 CET	185.63.145.5	443	192.168.2.4	49784	CN=px.ads.linkedin.com, O=LinkedIn Corporation, L=Sunnyvale, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Jan 06 01:00:00 CET 2021 Wed Sep 23 02:00:00 CEST 2020	Tue Jul 06 01:59:59 CEST 2021 Mon Sep 23 01:59:59 CEST 2030	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.959384918 CET	185.63.145.5	443	192.168.2.4	49784	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Sep 23 02:00:00 CEST 2020	Mon Sep 23 01:59:59 CEST 2030		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.961868048 CET	151.101.1.140	443	192.168.2.4	49787	CN=*.reddit.com, O=Reddit Inc., L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Wed Aug 26 02:00:00 CEST 2020 Fri Mar 08 13:00:00 CET 2013	Mon Feb 22 13:00:00 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:49.961868048 CET	151.101.1.140	443	192.168.2.4	49787	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.036592007 CET	104.244.42.131	443	192.168.2.4	49789	CN=*.twitter.com, OU=fra2, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 05 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Tue Mar 02 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.036592007 CET	104.244.42.131	443	192.168.2.4	49789	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.036956072 CET	104.244.42.131	443	192.168.2.4	49791	CN=*.twitter.com, OU=fra2, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Thu Mar 05 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Tue Mar 02 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.036956072 CET	104.244.42.131	443	192.168.2.4	49791	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.074130058 CET	104.244.42.5	443	192.168.2.4	49792	CN=t.co, OU=lon3, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Feb 18 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Sat Feb 06 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.074130058 CET	104.244.42.5	443	192.168.2.4	49792	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.078085899 CET	104.244.42.5	443	192.168.2.4	49793	CN=t.co, OU=lon3, O="Twitter, Inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Feb 18 01:00:00 CET 2020 Tue Oct 22 14:00:00 CEST 2013	Sat Feb 06 13:00:00 CET 2021 Sun Oct 22 14:00:00 CEST 2028	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.078085899 CET	104.244.42.5	443	192.168.2.4	49793	CN=DigiCert SHA2 High Assurance Server CA, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert High Assurance EV Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue Oct 22 14:00:00 CEST 2013	Sun Oct 22 14:00:00 CEST 2028		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.117053032 CET	108.177.15.154	443	192.168.2.4	49794	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:34:37 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:34:36 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.117053032 CET	108.177.15.154	443	192.168.2.4	49794	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.117683887 CET	108.177.15.154	443	192.168.2.4	49795	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:34:37 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:34:36 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.117683887 CET	108.177.15.154	443	192.168.2.4	49795	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.245233059 CET	3.217.219.88	443	192.168.2.4	49790	CN=*.quora.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Dec 27 18:16:22 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Sat Mar 27 18:16:22 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.245233059 CET	3.217.219.88	443	192.168.2.4	49790	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.432662964 CET	3.217.219.88	443	192.168.2.4	49788	CN=*.quora.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sun Dec 27 18:16:22 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Sat Mar 27 18:16:22 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.432662964 CET	3.217.219.88	443	192.168.2.4	49788	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.544591904 CET	142.250.180.162	443	192.168.2.4	49798	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:34:37 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:34:36 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.544591904 CET	142.250.180.162	443	192.168.2.4	49798	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.544991016 CET	142.250.180.162	443	192.168.2.4	49799	CN=*.g.doubleclick.net, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:34:37 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:34:36 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.544991016 CET	142.250.180.162	443	192.168.2.4	49799	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.565166950 CET	199.232.138.133	443	192.168.2.4	49801	CN=*.ibytedtos.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue May 12 02:00:00 CEST 2020 Mon Nov 06 13:23:33 CET 2017	Thu May 12 14:00:00 CEST 2022 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.565166950 CET	199.232.138.133	443	192.168.2.4	49801	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.565269947 CET	199.232.138.133	443	192.168.2.4	49800	CN=*.ibytedtos.com CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Tue May 12 02:00:00 CEST 2020 Mon Nov 06 13:23:33 CET 2017	Thu May 12 14:00:00 CEST 2022 Sat Nov 06 13:23:33 CET 2027	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.565269947 CET	199.232.138.133	443	192.168.2.4	49800	CN=RapidSSL RSA CA 2018, OU=www.digicert.com, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Mon Nov 06 13:23:33 CET 2017	Sat Nov 06 13:23:33 CET 2027		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.670416117 CET	142.250.180.99	443	192.168.2.4	49803	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:39:57 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:39:56 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.670416117 CET	142.250.180.99	443	192.168.2.4	49803	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.677651882 CET	142.250.180.99	443	192.168.2.4	49802	CN=www.google.co.uk, O=Google LLC, L=Mountain View, ST=California, C=US CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GTS CA 1O1, O=Google Trust Services, C=US CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Tue Nov 10 15:39:57 CET 2020 Thu Jun 15 02:00:42 CEST 2017	Tue Feb 02 15:39:56 CET 2021 Wed Dec 15 01:00:42 CET 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:50.677651882 CET	142.250.180.99	443	192.168.2.4	49802	CN=GTS CA 1O1, O=Google Trust Services, C=US	CN=GlobalSign, O=GlobalSign, OU=GlobalSign Root CA - R2	Thu Jun 15 02:00:42 CEST 2017	Wed Dec 15 01:00:42 CET 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.230249882 CET	52.202.69.186	443	192.168.2.4	49804	CN=pi.pardot.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sat Dec 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Sun Dec 05 00:59:59 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.230249882 CET	52.202.69.186	443	192.168.2.4	49804	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.233133078 CET	52.202.69.186	443	192.168.2.4	49805	CN=pi.pardot.com, O="salesforce.com, inc.", L=San Francisco, ST=California, C=US CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Sat Dec 05 01:00:00 CET 2020 Fri Mar 08 13:00:00 CET 2013	Sun Dec 05 00:59:59 CET 2021 Wed Mar 08 13:00:00 CET 2023	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.233133078 CET	52.202.69.186	443	192.168.2.4	49805	CN=DigiCert SHA2 Secure Server CA, O=DigiCert Inc, C=US	CN=DigiCert Global Root CA, OU=www.digicert.com, O=DigiCert Inc, C=US	Fri Mar 08 13:00:00 CET 2013	Wed Mar 08 13:00:00 CET 2023		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.305125952 CET	104.16.19.94	443	192.168.2.4	49806	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.305125952 CET	104.16.19.94	443	192.168.2.4	49806	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.309467077 CET	104.16.19.94	443	192.168.2.4	49807	CN=sni.cloudflaressl.com, O="Cloudflare, Inc.", L=San Francisco, ST=CA, C=US CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Wed Oct 21 02:00:00 CEST 2020 Mon Jan 27 13:48:08 CET 2020	Thu Oct 21 01:59:59 CEST 2021 Wed Jan 01 00:59:59 CET 2025	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:51.309467077 CET	104.16.19.94	443	192.168.2.4	49807	CN=Cloudflare Inc ECC CA-3, O="Cloudflare, Inc.", C=US	CN=Baltimore CyberTrust Root, OU=CyberTrust, O=Baltimore, C=IE	Mon Jan 27 13:48:08 CET 2020	Wed Jan 01 00:59:59 CET 2025		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:52.140491962 CET	13.226.169.91	443	192.168.2.4	49809	CN=*.driftcdn.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Apr 10 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon May 10 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:52.141877890 CET	13.226.169.91	443	192.168.2.4	49810	CN=*.driftcdn.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Fri Apr 10 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Mon May 10 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034
Jan 7, 2021 11:46:52.477688074 CET	35.174.151.106	443	192.168.2.4	49811	CN=start.ecornell.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sat Dec 05 07:12:53 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Fri Mar 05 07:12:53 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:52.477688074 CET	35.174.151.106	443	192.168.2.4	49811	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:52.502397060 CET	35.174.151.106	443	192.168.2.4	49812	CN=start.ecornell.com CN=R3, O=Let's Encrypt, C=US	CN=R3, O=Let's Encrypt, C=US CN=DST Root CA X3, O=Digital Signature Trust Co.	Sat Dec 05 07:12:53 CET 2020 Wed Oct 07 21:21:40 CEST 2020	Fri Mar 05 07:12:53 CET 2021 Wed Sep 29 21:21:40 CEST 2021	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-16-23-24-65281,29-23-24,0	9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:46:52.502397060 CET	35.174.151.106	443	192.168.2.4	49812	CN=R3, O=Let's Encrypt, C=US	CN=DST Root CA X3, O=Digital Signature Trust Co.	Wed Oct 07 21:21:40 CEST 2020	Wed Sep 29 21:21:40 CEST 2021		9e10692f1b7f78228b2d4e424db3a98c
Jan 7, 2021 11:47:01.641752005 CET	3.217.57.115	443	192.168.2.4	49820	CN=*.ecornell.com CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	CN=Amazon, OU=Server CA 1B, O=Amazon, C=US CN=Amazon Root CA 1, O=Amazon, C=US CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Sat Aug 22 02:00:00 CEST 2020 Thu Oct 22 02:00:00 CEST 2015 Mon May 25 14:00:00 CEST 2015 Wed Sep 02 02:00:00 CEST 2009	Wed Sep 22 14:00:00 CEST 2021 Sun Oct 19 02:00:00 CEST 2025 Thu Dec 31 02:00:00 CET 2037 Wed Jun 28 19:39:16 CEST 2034	771,49196-49195-49200-49199-49188-49187-49192-49191-49162-49161-49172-49171-157-156-61-60-53-47-10,0-10-11-13-35-23-65281,29-23-24,0	37f463bf4616ecd445d4a1937da06e19
					CN=Amazon, OU=Server CA 1B, O=Amazon, C=US	CN=Amazon Root CA 1, O=Amazon, C=US	Thu Oct 22 02:00:00 CEST 2015	Sun Oct 19 02:00:00 CEST 2025
					CN=Amazon Root CA 1, O=Amazon, C=US	CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	Mon May 25 14:00:00 CEST 2015	Thu Dec 31 02:00:00 CET 2037
					CN=Starfield Services Root Certificate Authority - G2, O="Starfield Technologies, Inc.", L=Scottsdale, ST=Arizona, C=US	OU=Starfield Class 2 Certification Authority, O="Starfield Technologies, Inc.", C=US	Wed Sep 02 02:00:00 CEST 2009	Wed Jun 28 19:39:16 CEST 2034

Code Manipulations

Statistics

Behavior

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 6788 Parent PID: 800

General

Start time:	11:46:41
Start date:	07/01/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff65b190000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Analysis Process: iexplore.exe PID: 6844 Parent PID: 6788

General

Start time:	11:46:42
Start date:	07/01/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:6788 CREDAT:17410 /prefetch:2
Imagebase:	0x1200000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Disassembly

Reset < >

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://lms.ecornell.com/courses/1448472/assignments/6966798/submissions/5795157

Overview

General Information

Detection

Signatures

Classification

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

Network Port Distribution

TCP Packets

UDP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

HTTP Packets

HTTPS Packets

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 6788 Parent PID: 800

General

Analysis Process: iexplore.exe PID: 6844 Parent PID: 6788

General

Disassembly