Create Interactive Tour

Analysis Report https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions

Overview

General Information

Sample URL:	https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions
Analysis ID:	347601
Most interesting Screenshot:

Detection

Score:	1
Range:	0 - 100
Whitelisted:	false
Confidence:	60%

Signatures

Checks for available system drives (often done to infect USB drives)

Found iframes

Classification

Analysis Advice

Sample is looking for USB drives. Launch the sample with the USB Fake Disk cookbook

Uses HTTPS for network communication, use the 'Proxy HTTPS (port 443) to read its encrypted data' cookbook for further analysis

Startup

System is w10x64

iexplore.exe (PID: 4676 cmdline: 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding MD5: 6465CB92B25A7BC1DF8E01D8AC5E7596)

iexplore.exe (PID: 4692 cmdline: 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4676 CREDAT:17410 /prefetch:2 MD5: 071277CC2E3DF41EEEA8013E2AB58D5A)

cleanup

Malware Configuration

No configs have been found

Yara Overview

No yara matches

Sigma Overview

No Sigma rule has matched

Signature Overview

• Phishing
• Compliance
• Spreading
• Networking
• System Summary

Click to jump to signature section

Show All Signature Results

There are no malicious signatures, click here to show all signatures.

Phishing:

Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: Iframe src: https://d3tracking.rbc.com/fp/HP?session_id=3dbdf1576e4702a1943ade902dacf6fb&org_id=4rvrfbxt&nonce=877c8180abbcc715&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessio
Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: Iframe src: https://d3tracking.rbc.com/fp/HP?session_id=3dbdf1576e4702a1943ade902dacf6fb&org_id=4rvrfbxt&nonce=877c8180abbcc715&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessio

Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: No <meta name="author".. found
Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: No <meta name="author".. found

Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: No <meta name="copyright".. found
Source: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	HTTP Parser: No <meta name="copyright".. found

Compliance:

Uses new MSVCR Dlls

Show sources

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Uses secure TLS version for HTTPS connections

Show sources

Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.3:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.3:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.46.111.120:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.32.241.65:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.32.241.65:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49803 version: TLS 1.2

Spreading:

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: z:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: x:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: v:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: t:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: r:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: p:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: n:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: l:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: j:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: h:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: f:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: b:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: y:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: w:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: u:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: s:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: q:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: o:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: m:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: k:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: i:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: g:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: e:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: c:
Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe	File opened: a:

Networking:

Source: global traffic

HTTP traffic detected: GET / HTTP/1.1Accept: text/html, application/xhtml+xml, image/jxr, */*Accept-Language: en-USUser-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; Trident/7.0; rv:11.0) like GeckoAccept-Encoding: gzip, deflateHost: www.rbcds.comConnection: Keep-Alive

Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/HP?session_id=3dbdf1576e4702a1943ade902dacf6fb&org_id=4rvrfbxt&nonce=877c8180abbcc715&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanq
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/HP?session_id=ae4d079d6d2c89dcff96af95b5e4da74&org_id=4rvrfbxt&nonce=8b53648b3959e18b&mode=2&hp=.co-operativebank.co.uk/CBIBSWeb/login.do.co-operativebank.co.uk/CBIBSWeb/start.do.de/portal/portal/x.entropay.com/basemenu/prot/x.facebook.comx.nationet.com/x.netbank.commbank.com.au/netbank/bankmainx.npbs.co.uk/netmastergoldbanking/x.nwolb.xlogin.aspx?refereridentx.rbsdigital.xAccountSummaryx.smile.co.uk/SmileWeb/login.do.smile.co.uk/SmileWeb/start.do.yandex.rux/CapitalOne_Consumer/x/easypay.by/x/sbank.ru/x53.com/servlet/efsonlinex://online.wellsfargo.com/x://secure.assist.ru/assistid/protected/main.doxabbeynational.co.uk/EBAN_ENS/BtoChannelDriverxalliance-leicesterxaltergold.com/login.phpxamericanexpress.com/myca/intl/acctsumm/emea/accountSummaryxbancaintesa.it/xbankcardservices.co.ukxbankofamerica.com/xbanquepopulaire.fr/xbnpparibas.net/xcahoot.comxcapitaloneonline.co.uk/CapitalOne_Consumer/Transactionsxcbonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagexcibc.comxPreSignOnxcibc.comxSignOnxcitibank.ru/xclient.uralsibbank.ruxco-operativebank.co.uk/CBIBSWeb/loginSpixcommerceonlinebanking.comxcoventrybuildingsociety.co.ukxdeutsche-bank.dexdiscovercard.com/cardmembersvcs/strongauth/app/sa_mainxebanking.bawag.comxebc_ebc1961xegg.com/customer/movemoneyxegg.com/customer/yourmoneyxfacebook.com/xhalifax-online.co.ukxMyAccountsxhalifax-online.co.uk/x/Mhalifax-online.co.uk/personalxhsbc.co.uk/1/2/personal/internet-banking/xhsbc.comxhttps://banking.postbank.de/app/finanzstatus.init.do;jsessionidxib.fineco.it/FinecoWeb/BonificiServletxib.fineco.it/FinecoWeb/jsp/Main/HBFineco.jspxib.fineco.it/FinecoWeb/jsp/Main/Principale.jspxibank.alfabank.ruxin-biz.it/xipko.plxlibertyreserve.com/x/historylibertyreserve.com/x/loginwww.libertyreserve.com/x/Core.jswww.libertyreserve.com/x/transfer.libertyreserve.com/x/commonscript.jslloydstsb.co.uk/personal/a/account_overview/xmbna.co.ukxmenyala.ruxmoney.yandex.ruxmoneybookers.com/app/login.plxmoneymail.ruxmy.ebay.co.uk/ws/eBayISAPI.dll?MyEbayxmy.ebay.com/ws/eBayISAPI.dll?MyEbayxmy.ebay.fr/ws/eBayISAPI.dll?MyEbayxmybusinessbank.co.ukxnationet.com/AppServices/SignOn/SignOnProcess/RcaSignOnxnpbs.co.ukxnwolb.com/AccountSummaryxnwolb.com/Statementsxnwolb.com/TransfersLandingPagexoltx.fidelity.com/x/x/ofsummary/summaryxonline.lloydstsb.co.ukxonlinebanking.mandtbank.com/summary/AccountSummaryxpassport.yandex.ruxpaypal.com/x/cgi-bin/webscr?cmd=_accountxpaypal.com/x/cgi-bin/webscr?cmd=_login-done&login_access=xpaypal.com/us/cgi-bin/webscr?cmd=_login-done&login_access=xposte.it/xpsk.co.at/xsecure.lloydstsb.co.uk/personal/a/account_overviewxsmile.co.uk/SmileWeb/passcodexusaa.com/xusbank.com/internetBanking/RequestRouter?requestCmdId=Gxwachovia.comxybonline.co.uk/ralu/reglm-web/setupSecurityQuestionPagex.amazon.fr/xhistory/orders/view.htmlx.banquepopulaire.frxShowPortal.dox.bnpparibasfortis.bexHome_Logon.aspx.cdiscount.com/Account/Home.aspxx.cmb.frxaccueil.jspx.credit-agricole.frxentreeBam?sessionSAGx.labanq

Source: unknown

DNS traffic detected: queries for: ca.rbcwealthmanagement.com

Source: bootstrap-responsive-dropdown[1].js.2.dr	String found in binary or memory: http://blog.alexmaccaw.com/css-transitions
Source: bootstrap-hover-dropdown.min[2].js.2.dr	String found in binary or memory: http://cameronspear.com/blog/bootstrap-dropdown-on-hover-plugin/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: http://cipf.ca/
Source: combo[1].js.2.dr	String found in binary or memory: http://developer.yahoo.com/yui/license.html
Source: blazy.min[1].js0.2.dr	String found in binary or memory: http://dinbror.dk/blazy
Source: da-theme[1].css.2.dr	String found in binary or memory: http://docs.jquery.com/UI/Theming/API
Source: font-awesome.min[1].css.2.dr, font-awesome.min[3].css.2.dr	String found in binary or memory: http://fontawesome.io
Source: font-awesome.min[1].css.2.dr	String found in binary or memory: http://fontawesome.io/license
Source: wm[1].css.2.dr	String found in binary or memory: http://geedmo.github.com/yamm3
Source: bootstrap.min[1].css.2.dr, bootstrap.min[1].css0.2.dr	String found in binary or memory: http://getbootstrap.com)
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: http://getbootstrap.com/customize/?id=473ef579f2940dd9039f)
Source: bootstrap-responsive-dropdown[1].js.2.dr	String found in binary or memory: http://getbootstrap.com/javascript/#collapse
Source: bootstrap-responsive-dropdown[1].js.2.dr	String found in binary or memory: http://getbootstrap.com/javascript/#transitions
Source: barebone[1].js1.2.dr	String found in binary or memory: http://gist.github.com/292562
Source: da-theme[1].css.2.dr	String found in binary or memory: http://jquery.org/license
Source: da-theme[1].css.2.dr	String found in binary or memory: http://jqueryui.com/about)
Source: da-theme[1].css.2.dr	String found in binary or memory: http://jqueryui.com/themeroller/?ffDefault=Arial
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://maps.rbc.com/index.en.asp
Source: modernizr.min[1].js.2.dr	String found in binary or memory: http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-flexbox-f
Source: underscore-min[1].js.2.dr	String found in binary or memory: http://underscorejs.org
Source: da-theme[1].css.2.dr	String found in binary or memory: http://wijmo.com/
Source: hashtable[1].js.2.dr, da-theme[1].css.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: bootstrap.min[1].js.2.dr	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0.txt
Source: lock-small[1].svg.2.dr	String found in binary or memory: http://www.bohemiancoding.com/sketch
Source: QJCP83P3.htm.2.dr	String found in binary or memory: http://www.cipf.ca/HomePage.aspx
Source: utilities[1].js.2.dr	String found in binary or memory: http://www.dynamicdrive.com)
Source: jquery.swiper[1].js.2.dr, wm_sass[1].css.2.dr	String found in binary or memory: http://www.idangero.us/
Source: jquery.swiper[1].js.2.dr	String found in binary or memory: http://www.idangero.us/sliders/swiper/
Source: wm_sass[1].css.2.dr	String found in binary or memory: http://www.idangero.us/swiper/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: http://www.iiroc.ca/investors/knowyouradvisor/Pages/default.aspx
Source: bootstrap-responsive-dropdown[1].js.2.dr	String found in binary or memory: http://www.modernizr.com/)
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/accessibility/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/canada.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/legal/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/online-services.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/privacysecurity/ca/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbc.com/privacysecurity/ca/contact-us.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbcgam.com/landing.html
Source: QJCP83P3.htm.2.dr	String found in binary or memory: http://www.rbcphnic.com/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbcroyalbank.com/business/index.html
Source: QJCP83P3.htm.2.dr	String found in binary or memory: http://www.rbcroyalbank.com/online/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbcroyalbank.com/online/rbcguarantee.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbcroyalbank.com/personal.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: http://www.rbcroyalbank.com/products/deposits/lost-stolen-card.html
Source: hashtable[1].js.2.dr	String found in binary or memory: http://www.timdown.co.uk/jshashtable/
Source: gtm[2].js.2.dr	String found in binary or memory: https://adservice.google.com/ddm/regclk
Source: gtm[2].js.2.dr	String found in binary or memory: https://adservice.google.com/pagead/regclk
Source: analytics[1].js.2.dr	String found in binary or memory: https://ampcid.google.com/v1/publisher:getClientId
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://ca.rbcwealtRoot
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://ca.rbcwealthma
Source: imagestore.dat.2.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/images/favicon.ico
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/VThe
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-ContributionsRoot
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-ContributionsbThe
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/791668-2021-TFSA--RRSP-Contributions
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/BThe
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog/ppppppp
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=dablogposts_WAR_daportlet&p_p_lifecycle=2&
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=dacontent_WAR_daportlet_INSTANCE_m3Ue9AFcy
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=daforms_WAR_daportlet_INSTANCE_tl5ILK1H86i
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=Client
Source: jim[1].htm.2.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_auth=1D90ohMr&p_p_id=dabiography_WAR_daport
Source: home[1].htm.2.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_auth=TMWNpR8f&p_p_id=dabiography_WAR_daport
Source: jim[1].htm.2.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dabiography_WAR_daportlet_INSTANCE_JiVjqxt
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dacontent_WAR_daportlet_INSTANCE_JQ9pndkXF
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dacontent_WAR_daportlet_INSTANCE_nS53xlr34
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=daforms_WAR_daportlet_INSTANCE_rYQIuDd0NJS
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dalatestblogposts_WAR_daportlet_INSTANCE_P
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/homeVThe
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://ca.rbcwealthmanagement.com/jim.seyers/xcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=Client
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://caribbean.rbcroyalbank.com/#/login
Source: gtm[2].js.2.dr	String found in binary or memory: https://cct.google/taggy/agent.js
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.eot);
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.eot?#iefix)
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.woff)
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.woff2)
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://contact.rbc.com/dsform/index.php
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/HP?session_id=3dbdf1576e4702a1943ade902dacf6fb&org_id=4rvrfbxt&nonce=8
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/HP?session_id=ae4d079d6d2c89dcff96af95b5e4da74&org_id=4rvrfbxt&nonce=8
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/ls_fp.html;CIS3SID=492C53327696F63A1FE1AC26FD3A76AD?org_id=4rvrfbxt&se
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/ls_fp.html;CIS3SID=AB6D39601ED4399EFD2F6588C0E150FB?org_id=4rvrfbxt&se
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/tags.js?org_id=4rvrfbxt&session_id=3DBDF1576E4702A1943ADE902DACF6FB&pa
Source: rbunxcgi[1].htm.2.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/tags.js?org_id=4rvrfbxt&session_id=AE4D079D6D2C89DCFF96AF95B5E4DA74&pa
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/top_fp.html;CIS3SID=492C53327696F63A1FE1AC26FD3A76AD?org_id=4rvrfbxt&s
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://d3tracking.rbc.com/fp/top_fp.html;CIS3SID=AB6D39601ED4399EFD2F6588C0E150FB?org_id=4rvrfbxt&s
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://gist.github.com/473ef579f2940dd9039f
Source: da-theme[1].css.2.dr	String found in binary or memory: https://github.com/280north/aristo).
Source: bootstrap-hover-dropdown.min[2].js.2.dr	String found in binary or memory: https://github.com/CWSpear/bootstrap-hover-dropdown/issues/55
Source: jquery.sidr.min[1].js0.2.dr	String found in binary or memory: https://github.com/artberri/sidr
Source: jquery.autocomplete[1].js.2.dr	String found in binary or memory: https://github.com/devbridge/jQuery-Autocomplete
Source: bootstrap[1].css.2.dr	String found in binary or memory: https://github.com/h5bp/html5-boilerplate/blob/master/src/css/main.css
Source: gtm[2].js.2.dr	String found in binary or memory: https://github.com/krux/postscribe/blob/master/LICENSE.
Source: jquery.transit[1].js.2.dr	String found in binary or memory: https://github.com/maxwellito/vivus
Source: bootstrap.min[1].css.2.dr	String found in binary or memory: https://github.com/twbs/bootstrap/blob/master/LICENSE)
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=492C53327696F63A1FE1AC26FD3A76AD?org_id=4rvrfbxt&
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=AB6D39601ED4399EFD2F6588C0E150FB?org_id=4rvrfbxt&
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://omni.royalbank.com/omni/olb-piloting/prd/bundle.js?1612293093
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://omni.royalbank.com/omni/preload/assets-preloader/prod/preloader.js?14
Source: gtm[2].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com
Source: gtm[2].js.2.dr	String found in binary or memory: https://pagead2.googlesyndication.com/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://privatebanking.rbcwealthmanagement.com/en/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://privatebanking.rbcwealthmanagement.com/en/?com.dotmarketing.htmlpages.language=1
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://royaltrust.rbcwealthmanagement.com/en/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://royaltrust.rbcwealthmanagement.com/en/?com.dotmarketing.htmlpages.language=1
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://secure-ds.rbcw
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://secure-ds.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudDS&u
Source: ~DF4790E109E104350B.TMP.1.dr, rbunxcgi[1].htm.2.dr	String found in binary or memory: https://secure-ds.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudDS&ui_lo
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://secure-et.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudETS&
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://secure-phn.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudPHN&amp
Source: analytics[1].js.2.dr	String found in binary or memory: https://stats.g.doubleclick.net/j/collect
Source: ruxitagentjs_ICA2SVfghjqru_10205201218101503[1].js.2.dr	String found in binary or memory: https://www.dynatrace.com/company/trust-center/customers/reports/
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google-analytics.com/gtm/js?id=
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.google.%/ads/ga-audiences
Source: gtm[2].js.2.dr	String found in binary or memory: https://www.google.com
Source: gtm[2].js.2.dr	String found in binary or memory: https://www.google.com/pagead/conversion_async.js
Source: gtm[2].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/debug/bootstrap
Source: analytics[1].js.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtag/js?id=
Source: QJCP83P3.htm.2.dr, rbunxcgi[1].htm.2.dr	String found in binary or memory: https://www.googletagmanager.com/gtm.js?id=
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.iiroc.ca/Pages/default.aspx
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbc.com/labs/index.html
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbc.com/legal/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbc.com/legal/#wealth_management
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbc.com/privacysecurity/ca/index.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbccm.com/en/
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://www.rbcds.com/
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://www.rbcds.com/.RBC
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://www.rbcds.com/gement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://www.rbcds.com/nagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributionsgement.com/j
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcglobaltrade.rbc.com/portal/PasswordLogon.jsp?organization=rbc&branding=rbc&lo
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcits.com/en/
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/cgi-bin/cs-kioskolb/ask.cgi/response/find?question=
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/cgi-bin/cs-kioskolb/ask.cgi/top10
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/customer-service/index.html?RefURL=https://www1.royalbank.com/cgi-bin/r
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/onlinebanking/remember_my_card/about.html
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/faqcontent.js?14
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/marketing-new.js?14
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/pubnotice.js?14
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/servicenotice.js?14
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/search-public/index.html?IR_INTERFACE_ID=6&question=
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcroyalbank.com/ways-to-bank/online-banking/index.html
Source: QJCP83P3.htm.2.dr, rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www.rbcwealthmanagement.com/
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbcwealthmanagement.com/ca/en
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbcwealthmanagement.com/ca/en/covid-19-preparedness
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbcwealthmanagement.com/ca/en/find-a-wealth-advisor/get-matched-with-an-advisor
Source: QJCP83P3.htm.2.dr	String found in binary or memory: https://www.rbcwealthmanagement.com/ca/en/get-in-touch
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www1.rbcbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=NS&F21=IB&F22=CN&REQUEST=
Source: {C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	String found in binary or memory: https://www1.royalbank
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=Clie
Source: ~DF4790E109E104350B.TMP.1.dr	String found in binary or memory: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&I
Source: imagestore.dat.2.dr	String found in binary or memory: https://www1.royalbank.com/favicon.ico
Source: imagestore.dat.2.dr	String found in binary or memory: https://www1.royalbank.com/uos/common/images/icons/favicon.ico?14~
Source: rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	String found in binary or memory: https://www6.rbc.com/webapp/ukv0/signin/logon.xhtml?lang=en

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49780
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49781 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49803 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49736 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 49753 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49780 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49729
Source: unknown	Network traffic detected: HTTP traffic on port 49752 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49803
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49783 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49761
Source: unknown	Network traffic detected: HTTP traffic on port 49741 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49729 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49752
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49761 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49747 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49747
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443

Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49724 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49723 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.6:49737 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 108.177.15.157:443 -> 192.168.2.6:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.3:443 -> 192.168.2.6:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.23.3:443 -> 192.168.2.6:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 104.153.58.105:443 -> 192.168.2.6:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49747 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 69.46.111.120:443 -> 192.168.2.6:49751 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49757 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 152.199.21.175:443 -> 192.168.2.6:49758 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.32.241.65:443 -> 192.168.2.6:49766 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 185.32.241.65:443 -> 192.168.2.6:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 162.247.242.18:443 -> 192.168.2.6:49803 version: TLS 1.2

System Summary:

Source: classification engine

Classification label: clean1.win@3/255@10/9

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C79ABE29-65D5-11EB-90E5-ECF4BB2D2496}.dat

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File created: C:\Users\user\AppData\Local\Temp\~DFD0860BC149CB6072.TMP

Jump to behavior

Source: C:\Program Files\internet explorer\iexplore.exe

File read: C:\Users\desktop.ini

Jump to behavior

Source: unknown	Process created: C:\Program Files\internet explorer\iexplore.exe 'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Source: unknown	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4676 CREDAT:17410 /prefetch:2
Source: C:\Program Files\internet explorer\iexplore.exe	Process created: C:\Program Files (x86)\Internet Explorer\iexplore.exe 'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4676 CREDAT:17410 /prefetch:2

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Internet Explorer\iexplore.exe

File opened: C:\Program Files (x86)\Java\jre1.8.0_211\bin\msvcr100.dll

Mitre Att&ck Matrix

Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Exfiltration	Command and Control	Network Effects	Remote Service Effects	Impact
Drive-by Compromise1	Windows Management Instrumentation	Path Interception	Process Injection1	Masquerading1	OS Credential Dumping	Peripheral Device Discovery11	Replication Through Removable Media1	Data from Local System	Exfiltration Over Other Network Medium	Encrypted Channel2	Eavesdrop on Insecure Network Communication	Remotely Track Device Without Authorization	Modify System Partition
Replication Through Removable Media1	Scheduled Task/Job	Boot or Logon Initialization Scripts	Boot or Logon Initialization Scripts	Process Injection1	LSASS Memory	File and Directory Discovery1	Remote Desktop Protocol	Data from Removable Media	Exfiltration Over Bluetooth	Non-Application Layer Protocol2	Exploit SS7 to Redirect Phone Calls/SMS	Remotely Wipe Data Without Authorization	Device Lockout
Domain Accounts	At (Linux)	Logon Script (Windows)	Logon Script (Windows)	Obfuscated Files or Information	Security Account Manager	Query Registry	SMB/Windows Admin Shares	Data from Network Shared Drive	Automated Exfiltration	Application Layer Protocol3	Exploit SS7 to Track Device Location	Obtain Device Cloud Backups	Delete Device Data
Local Accounts	At (Windows)	Logon Script (Mac)	Logon Script (Mac)	Binary Padding	NTDS	System Network Configuration Discovery	Distributed Component Object Model	Input Capture	Scheduled Transfer	Ingress Tool Transfer1	SIM Card Swap		Carrier Billing Fraud

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Screenshots

Thumbnails

This section contains all screenshots as thumbnails, including those not shown in the slideshow.

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Source	Detection	Scanner	Label	Link
https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions	0%	Avira URL Cloud	safe

Dropped Files

No Antivirus matches

Unpacked PE Files

No Antivirus matches

Domains

Source	Detection	Scanner	Link
rbcds.com	0%	Virustotal	Browse
www.google.co.uk	0%	Virustotal	Browse
sni1gl.wpc.lambdacdn.net	0%	Virustotal	Browse
bam.nr-data.net	0%	Virustotal	Browse

URLs

Source	Detection	Scanner	Label
http://www.rbcds.com/	0%	Avira URL Cloud	safe
http://cameronspear.com/blog/bootstrap-dropdown-on-hover-plugin/	0%	Avira URL Cloud	safe
https://www.rbcds.com/gement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions	0%	Avira URL Cloud	safe
http://wijmo.com/	0%	Avira URL Cloud	safe
http://getbootstrap.com)	0%	Avira URL Cloud	safe
http://www.timdown.co.uk/jshashtable/	0%	Avira URL Cloud	safe
https://ca.rbcwealtRoot	0%	Avira URL Cloud	safe
http://www.cipf.ca/HomePage.aspx	0%	Avira URL Cloud	safe
https://www.rbcds.com/nagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributionsgement.com/j	0%	Avira URL Cloud	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://cct.google/taggy/agent.js	0%	URL Reputation	safe
https://www1.royalbank	0%	Avira URL Cloud	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
https://www.google.%/ads/ga-audiences	0%	URL Reputation	safe
http://cipf.ca/	0%	Avira URL Cloud	safe
https://www.rbcds.com/.RBC	0%	Avira URL Cloud	safe
https://secure-ds.rbcw	0%	Avira URL Cloud	safe
http://www.dynamicdrive.com)	0%	Avira URL Cloud	safe

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Antivirus Detection	Reputation
rbcds.com	69.46.111.120	true	false	0%, Virustotal, Browse	unknown
stats.l.doubleclick.net	108.177.15.157	true	false		high
www.google.co.uk	172.217.23.3	true	false	0%, Virustotal, Browse	unknown
ca.rbcwealthmanagement.com	104.153.58.105	true	false		high
h-d3tracking.rbc.online-metrix.net	185.32.241.65	true	false		high
sni1gl.wpc.lambdacdn.net	152.199.21.175	true	false	0%, Virustotal, Browse	unknown
bam.nr-data.net	162.247.242.21	true	false	0%, Virustotal, Browse	unknown
www1.royalbank.com	unknown	unknown	false		high
d3tracking.rbc.com	unknown	unknown	false		high
js-agent.newrelic.com	unknown	unknown	false		high
www.rbcds.com	unknown	unknown	false		unknown
cdn.rbcgam.com	unknown	unknown	false		high
stats.g.doubleclick.net	unknown	unknown	false		high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
https://ca.rbcwealthmanagement.com/jim.seyers/blog/	false		high
http://www.rbcds.com/	false	Avira URL Cloud: safe	unknown
https://ca.rbcwealthmanagement.com/jim.seyers/	false		high
https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
http://fontawesome.io	font-awesome.min[1].css.2.dr, font-awesome.min[3].css.2.dr	false		high
https://privatebanking.rbcwealthmanagement.com/en/?com.dotmarketing.htmlpages.language=1	QJCP83P3.htm.2.dr	false		high
https://secure-ds.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudDS&u	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/marketing-new.js?14	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://royaltrust.rbcwealthmanagement.com/en/?com.dotmarketing.htmlpages.language=1	QJCP83P3.htm.2.dr	false		high
http://www.apache.org/licenses/LICENSE-2.0.txt	bootstrap.min[1].js.2.dr	false		high
https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.eot?#iefix)	QJCP83P3.htm.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=Client	~DF4790E109E104350B.TMP.1.dr	false		high
http://gist.github.com/292562	barebone[1].js1.2.dr	false		high
http://underscorejs.org	underscore-min[1].js.2.dr	false		high
http://docs.jquery.com/UI/Theming/API	da-theme[1].css.2.dr	false		high
https://www1.royalbank.com/favicon.ico	imagestore.dat.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/blog/	~DF4790E109E104350B.TMP.1.dr	false		high
https://www.rbcglobaltrade.rbc.com/portal/PasswordLogon.jsp?organization=rbc&branding=rbc&lo	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=dacontent_WAR_daportlet_INSTANCE_m3Ue9AFcy	~DF4790E109E104350B.TMP.1.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=dablogposts_WAR_daportlet&p_p_lifecycle=2&	~DF4790E109E104350B.TMP.1.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dalatestblogposts_WAR_daportlet_INSTANCE_P	~DF4790E109E104350B.TMP.1.dr	false		high
http://cameronspear.com/blog/bootstrap-dropdown-on-hover-plugin/	bootstrap-hover-dropdown.min[2].js.2.dr	false	Avira URL Cloud: safe	unknown
https://www.rbcwealthmanagement.com/ca/en/covid-19-preparedness	QJCP83P3.htm.2.dr	false		high
https://www.rbcds.com/gement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions	~DF4790E109E104350B.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://github.com/artberri/sidr	jquery.sidr.min[1].js0.2.dr	false		high
http://wijmo.com/	da-theme[1].css.2.dr	false	Avira URL Cloud: safe	unknown
http://www.rbcroyalbank.com/online/rbcguarantee.html	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbc.com/privacysecurity/ca/index.html	QJCP83P3.htm.2.dr	false		high
https://www.rbcroyalbank.com/onlinebanking/sign-in/jsincludes/servicenotice.js?14	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
http://getbootstrap.com)	bootstrap.min[1].css.2.dr, bootstrap.min[1].css0.2.dr	false	Avira URL Cloud: safe	low
http://www.timdown.co.uk/jshashtable/	hashtable[1].js.2.dr	false	Avira URL Cloud: safe	unknown
https://github.com/krux/postscribe/blob/master/LICENSE.	gtm[2].js.2.dr	false		high
https://stats.g.doubleclick.net/j/collect	analytics[1].js.2.dr	false		high
https://ca.rbcwealtRoot	{C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.woff)	QJCP83P3.htm.2.dr	false		high
https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=492C53327696F63A1FE1AC26FD3A76AD?org_id=4rvrfbxt&	~DF4790E109E104350B.TMP.1.dr	false		high
https://www.rbc.com/legal/#wealth_management	QJCP83P3.htm.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dacontent_WAR_daportlet_INSTANCE_nS53xlr34	~DF4790E109E104350B.TMP.1.dr	false		high
http://www.cipf.ca/HomePage.aspx	QJCP83P3.htm.2.dr	false	Avira URL Cloud: safe	unknown
http://getbootstrap.com/customize/?id=473ef579f2940dd9039f)	bootstrap.min[1].css.2.dr	false		high
http://www.idangero.us/sliders/swiper/	jquery.swiper[1].js.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home?p_auth=TMWNpR8f&p_p_id=dabiography_WAR_daport	home[1].htm.2.dr	false		high
https://github.com/maxwellito/vivus	jquery.transit[1].js.2.dr	false		high
http://www.rbcroyalbank.com/business/index.html	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
http://www.modernizr.com/)	bootstrap-responsive-dropdown[1].js.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/blog?p_p_id=daforms_WAR_daportlet_INSTANCE_tl5ILK1H86i	~DF4790E109E104350B.TMP.1.dr	false		high
http://www.idangero.us/swiper/	wm_sass[1].css.2.dr	false		high
https://www.rbcds.com/nagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributionsgement.com/j	{C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.rbcwealthmanagement.com/ca/en	QJCP83P3.htm.2.dr	false		high
https://www.rbcroyalbank.com/cgi-bin/cs-kioskolb/ask.cgi/response/find?question=	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://github.com/devbridge/jQuery-Autocomplete	jquery.autocomplete[1].js.2.dr	false		high
https://d3tracking.rbc.com/fp/HP?session_id=3dbdf1576e4702a1943ade902dacf6fb&org_id=4rvrfbxt&nonce=8	~DF4790E109E104350B.TMP.1.dr	false		high
https://www.rbcroyalbank.com/onlinebanking/remember_my_card/about.html	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://cct.google/taggy/agent.js	gtm[2].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	unknown
https://caribbean.rbcroyalbank.com/#/login	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www1.royalbank	{C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://ca.rbcwealthmanagement.com/jim.seyers/home	~DF4790E109E104350B.TMP.1.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dabiography_WAR_daportlet_INSTANCE_JiVjqxt	jim[1].htm.2.dr	false		high
https://www.google.%/ads/ga-audiences	analytics[1].js.2.dr	false	URL Reputation: safe URL Reputation: safe URL Reputation: safe	low
https://secure-ds.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudDS&ui_lo	~DF4790E109E104350B.TMP.1.dr, rbunxcgi[1].htm.2.dr	false		high
https://privatebanking.rbcwealthmanagement.com/en/	QJCP83P3.htm.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/blog/791668-2021-TFSA--RRSP-Contributions	~DF4790E109E104350B.TMP.1.dr	false		high
http://jqueryui.com/about)	da-theme[1].css.2.dr	false		high
http://www.rbcroyalbank.com/products/deposits/lost-stolen-card.html	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://github.com/twbs/bootstrap/blob/master/LICENSE)	bootstrap.min[1].css.2.dr	false		high
http://www.rbc.com/privacysecurity/ca/contact-us.html	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbcwealthmanagement.com/ca/en/get-in-touch	QJCP83P3.htm.2.dr	false		high
http://www.idangero.us/	jquery.swiper[1].js.2.dr, wm_sass[1].css.2.dr	false		high
http://cipf.ca/	QJCP83P3.htm.2.dr	false	Avira URL Cloud: safe	unknown
https://ca.rbcwealthmanagement.com/jim.seyers/	~DF4790E109E104350B.TMP.1.dr	false		high
https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=Clie	~DF4790E109E104350B.TMP.1.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/VThe	~DF4790E109E104350B.TMP.1.dr	false		high
http://geedmo.github.com/yamm3	wm[1].css.2.dr	false		high
http://jquery.org/license	da-theme[1].css.2.dr	false		high
https://www6.rbc.com/webapp/ukv0/signin/logon.xhtml?lang=en	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbcds.com/.RBC	~DF4790E109E104350B.TMP.1.dr	false	Avira URL Cloud: safe	unknown
https://secure-ds.rbcw	{C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat.1.dr	false	Avira URL Cloud: safe	unknown
https://www.rbcwealthmanagement.com/ca/en/find-a-wealth-advisor/get-matched-with-an-advisor	QJCP83P3.htm.2.dr	false		high
https://omni.royalbank.com/omni/olb-piloting/prd/bundle.js?1612293093	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbc.com/legal/	QJCP83P3.htm.2.dr	false		high
https://secure-et.rbcwealthmanagement.com/Membership/OpenID/Login.ashx?client_id=InvestCloudETS&	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
http://getbootstrap.com/javascript/#collapse	bootstrap-responsive-dropdown[1].js.2.dr	false		high
https://www.dynatrace.com/company/trust-center/customers/reports/	ruxitagentjs_ICA2SVfghjqru_10205201218101503[1].js.2.dr	false		high
https://h.online-metrix.net/fp/sid_fp.html;CIS3SID=AB6D39601ED4399EFD2F6588C0E150FB?org_id=4rvrfbxt&	~DF4790E109E104350B.TMP.1.dr	false		high
http://getbootstrap.com/javascript/#transitions	bootstrap-responsive-dropdown[1].js.2.dr	false		high
https://www.rbcroyalbank.com/cgi-bin/cs-kioskolb/ask.cgi/top10	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbcroyalbank.com/customer-service/index.html?RefURL=https://www1.royalbank.com/cgi-bin/r	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://contact.rbc.com/dsform/index.php	QJCP83P3.htm.2.dr	false		high
http://www.rbc.com/accessibility/	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
https://www.rbcds.com/	~DF4790E109E104350B.TMP.1.dr	false		unknown
https://d3tracking.rbc.com/fp/top_fp.html;CIS3SID=492C53327696F63A1FE1AC26FD3A76AD?org_id=4rvrfbxt&s	~DF4790E109E104350B.TMP.1.dr	false		high
http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-flexbox-f	modernizr.min[1].js.2.dr	false		high
https://ca.rbcwealthmanagement.com/jim.seyers/home?p_p_id=dacontent_WAR_daportlet_INSTANCE_JQ9pndkXF	~DF4790E109E104350B.TMP.1.dr	false		high
http://www.dynamicdrive.com)	utilities[1].js.2.dr	false	Avira URL Cloud: safe	low
https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.woff2)	QJCP83P3.htm.2.dr	false		high
https://d3tracking.rbc.com/fp/HP?session_id=ae4d079d6d2c89dcff96af95b5e4da74&org_id=4rvrfbxt&nonce=8	~DF4790E109E104350B.TMP.1.dr	false		high
https://www.rbccm.com/en/	rbunxcgi_F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&LANGUAGE=ENGLISH[1].htm.2.dr	false		high
http://blog.alexmaccaw.com/css-transitions	bootstrap-responsive-dropdown[1].js.2.dr	false		high
https://github.com/280north/aristo).	da-theme[1].css.2.dr	false		high

Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public

IP	Domain	Country	ASN	ASN Name	Malicious
104.153.58.105	unknown	Canada	30406	THINKON-NUBAVCA	false
69.46.111.120	unknown	Canada	27272	Q9-AS-CAL3CA	false
108.177.15.157	unknown	United States	15169	GOOGLEUS	false
185.32.241.65	unknown	Netherlands	30286	THMUS	false
162.247.242.21	unknown	United States	23467	NEWRELIC-AS-1US	false
172.217.23.3	unknown	United States	15169	GOOGLEUS	false
152.199.21.175	unknown	United States	15133	EDGECASTUS	false
162.247.242.18	unknown	United States	23467	NEWRELIC-AS-1US	false

Private

IP
127.0.0.1

General Information

Joe Sandbox Version:	31.0.0 Emerald
Analysis ID:	347601
Start date:	02.02.2021
Start time:	20:09:53
Joe Sandbox Product:	CloudBasic
Overall analysis duration:	0h 6m 26s
Hypervisor based Inspection enabled:	false
Report type:	light
Cookbook file name:	browseurl.jbs
Sample URL:	https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions
Analysis system description:	Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
Number of analysed new started processes analysed:	18
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled HDC enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Detection:	CLEAN
Classification:	clean1.win@3/255@10/9
Cookbook Comments:	Adjust boot time Enable AMSI Browsing link: http://www.rbcds.com/ Browsing link: https://ca.rbcwealthmanagement.com/jim.seyers/blog/ Browsing link: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi?F6=1&F7=IB&F21=IB&F22=IB&REQUEST=ClientSignin&IDP=IVC&LANGUAGE=ENGLISH&SYSTEM=DSIC Browsing link: https://www1.royalbank.com/cgi-bin/rbaccess/rbunxcgi%3FF6=1%26F7=IB%26F21=IB%26F22=IB%26REQUEST=ClientSignin%26LANGUAGE=ENGLISH Browsing link: https://ca.rbcwealthmanagement.com/jim.seyers Browsing link: https://ca.rbcwealthmanagement.com/jim.seyers/home
Warnings:	Show All Exclude process from analysis (whitelisted): MpCmdRun.exe, dllhost.exe, BackgroundTransferHost.exe, ielowutil.exe, backgroundTaskHost.exe, conhost.exe, svchost.exe TCP Packets have been reduced to 100 Created / dropped Files have been reduced to 100 Excluded IPs from analysis (whitelisted): 52.147.198.201, 40.88.32.150, 104.108.39.131, 172.217.18.104, 172.217.23.46, 216.58.207.164, 151.101.2.110, 151.101.66.110, 151.101.130.110, 151.101.194.110, 51.11.168.160, 152.199.19.161, 2.20.142.210, 2.20.143.16, 23.50.97.91, 51.103.5.186, 92.122.213.247, 92.122.213.194, 92.122.253.206, 52.155.217.156 Excluded domains from analysis (whitelisted): www1.royalbank.com.georbc.akadns.net, au.download.windowsupdate.com.edgesuite.net, arc.msn.com.nsatc.net, wns.notify.windows.com.akadns.net, a1449.dscg2.akamai.net, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, arc.msn.com, e11290.dspg.akamaiedge.net, iecvlist.microsoft.com, db5eap.displaycatalog.md.mp.microsoft.com.akadns.net, skypedataprdcoleus15.cloudapp.net, go.microsoft.com, www1.royalbank.com.edgekey.net, www.googletagmanager.com, emea1.wns.notify.trafficmanager.net, audownload.windowsupdate.nsatc.net, www.google.com, displaycatalog.mp.microsoft.com, watson.telemetry.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, prod.fs.microsoft.com.akadns.net, au-bg-shim.trafficmanager.net, www.google-analytics.com, rbcwm-framework.azureedge.net, displaycatalog-europeeap.md.mp.microsoft.com.akadns.net, client.wns.windows.com, fs.microsoft.com, www-google-analytics.l.google.com, ie9comview.vo.msecnd.net, www-googletagmanager.l.google.com, displaycatalog.md.mp.microsoft.com.akadns.net, f4.shared.global.fastly.net, ctldl.windowsupdate.com, e1723.g.akamaiedge.net, a767.dscg3.akamai.net, rbcwm-framework.ec.azureedge.net, skypedataprdcoleus16.cloudapp.net, e8484.x.akamaiedge.net, blobcollector.events.data.trafficmanager.net, go.microsoft.com.edgekey.net, cs9.wpc.v0cdn.net Report size exceeded maximum capacity and may have missing behavior information. Report size exceeded maximum capacity and may have missing network information. Report size getting too big, too many NtCreateFile calls found. Report size getting too big, too many NtDeviceIoControlFile calls found. Report size getting too big, too many NtQueryAttributesFile calls found.

Simulations

Behavior and APIs

No simulations

Joe Sandbox View / Context

IPs

No context

Domains

No context

ASN

No context

JA3 Fingerprints

No context

Dropped Files

No context

Created / dropped Files

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\6BAUBVPU\d3tracking.rbc[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	148
Entropy (8bit):	4.773312914315641
Encrypted:	false
SSDEEP:	3:D90aK1ryRtFwsCVA7HyQAqRR2EWVmRyUOfvW026nbuc9OR9qSRh3AFKb:JFK1rUFqQDAqRQwRyUMW0dD4l3Db
MD5:	9E0B63723F6CED03E4981209C6741770
SHA1:	6238A8BBF8FD9C4CF451A74946114CD3AA2982A7
SHA-256:	008F120B7B660437A677A8E85695F927FEC26F4B5A7D73CCDB94FC321C1A5AA4
SHA-512:	B0824F26076EBBD1475DB5BD384A29BB9E2ECE8DAECE96AB33FDFA3969274C48FBED7EA68F6F1FB28DB476C1659162645ACD4D1B24D4DD310A5C3026FFE2E1ED
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="ed73f20edbf2b73" value="442f85a307a34da1b78887b3392f79f7_1767813089431" ltime="2777266560" htime="30865890" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\EQAWN5DV\ca.rbcwealthmanagement[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	206
Entropy (8bit):	4.766993202953593
Encrypted:	false
SSDEEP:	6:JFK1rUFnfVqHlJR3VkQEl3j3nfIuqj7t9cL5VkQEl3Db:JsrUhMz5n63LgXft9cVn63H
MD5:	67E0B208836C986DEB92DAC70404F97C
SHA1:	B3077198EB0651C5B7C4F95FF61BF85EB4065C04
SHA-256:	AA4C17BD33FEBC7FF49764E41CED64183476FB06813D0C1FD47DD17947DED3AC
SHA-512:	8A528DD069776432E794A5E883108293AA863BED561BD7860766350D4DC4EF534E595D138C416B353BCE0BCAE5569D017F50A3E2E33BCF49B66FAA32DB86F9D7
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="tooltip" value="true" ltime="2413926560" htime="30865890" /><item name="tooltip-expiration" value="Sat, 06 Mar 2021 04:10:52 GMT" ltime="2413926560" htime="30865890" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\DOMStore\IB42RK38\www1.royalbank[1].xml Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with no line terminators
Category:	dropped
Size (bytes):	909
Entropy (8bit):	5.225725386369048
Encrypted:	false
SSDEEP:	24:WUZPnZ5UU2XD4Z5UU2XD4Zx0/aC45UU2XD4Zx0/aC4X:L1ZCUhCUhG94CUhG94X
MD5:	B4E496620DC52AB03212C420E30C1B75
SHA1:	9C6FEDD74CD62A880B58A86448C19617C1B43EAB
SHA-256:	9F63FFBDEB683BAFC33DD5964A7B3FA0B280B5C823D9336367AD5D047C8ED737
SHA-512:	50A61A78B4A5D20A7E1B2D27B1E5D9CE789C53822963A5E256D3B46C045B239BFD5A69852A8EE94F638F665C112A1BEF747594A15C3DE1316AD0CA2C571A0CAD
Malicious:	false
Reputation:	low
Preview:	<root></root><root><item name="v" value="0000000000000000000000000000000000000000000000000000000000000000000000000000000000000000" ltime="2756916560" htime="30865890" /></root><root><item name="f" value="A8ofKGR3AQAA1c8qxvTmQv375nFg8cOqz5cGk59YfcKbvveu_jAJMUxFhd1QAVQRNEq0zduywH8AAEB3AAAAAA==" ltime="2756916560" htime="30865890" /></root><root><item name="f" value="A8ofKGR3AQAA1c8qxvTmQv375nFg8cOqz5cGk59YfcKbvveu_jAJMUxFhd1QAVQRNEq0zduywH8AAEB3AAAAAA==" ltime="2756916560" htime="30865890" /><item name="ed73f20edbf2b73" value="e3c80d3a53a34869a23da92b3c9d3d1a_1767813088016" ltime="2772786560" htime="30865890" /></root><root><item name="f" value="A8ofKGR3AQAA1c8qxvTmQv375nFg8cOqz5cGk59YfcKbvveu_jAJMUxFhd1QAVQRNEq0zduywH8AAEB3AAAAAA==" ltime="2756916560" htime="30865890" /><item name="ed73f20edbf2b73" value="e3c80d3a53a34869a23da92b3c9d3d1a_1767813088016" ltime="2772786560" htime="30865890" /></root>

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\RecoveryStore.{C79ABE29-65D5-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	30296
Entropy (8bit):	1.855691813784801
Encrypted:	false
SSDEEP:	96:rJZmZaT2aq9WautaGpAfaphFR1MampTaajRa9+faXFQlX:rJZmZe2x9WXtOfcVMpZZf8sX
MD5:	3C760DC4D60CF0E16535153806547A8F
SHA1:	B4FFC401FB63D6110CEDA43736BBA9AA361F5BE7
SHA-256:	9761CF55E09F9B476EB698F71F82438C2AC83D90649CB19DE3B953ED0747524E
SHA-512:	9BA5FBD675F1D4FBE460C0F809E93FD23D8594D80A46070FC70FD8B509069C0E748A2CAB57DF75CB98A384A739F9C8704782DA02400C506B6FF0F0EC3BE8A08A
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{C79ABE2B-65D5-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	248298
Entropy (8bit):	3.3853161123005875
Encrypted:	false
SSDEEP:	3072:lXRtpGZ+4zgZ+4z/Z+4zHgZ+4zKZ+4zgZ+4zg:J
MD5:	4B09048B8453B82494D966A3229FCE58
SHA1:	2A2779D914F32FAA89A9C97E2309E2C10A891EB5
SHA-256:	F0AC85ADEE4D846DF2FB984944C437445CEFC91F4F1D760B0C7786F70DABE131
SHA-512:	3FA4778BAAC273D20142ABA062A8F477637207D0C40DC793FA656E77706CD913801FD8FFEAA16E56BEDAA64A5CAEED43E2B628E2A1326E976E3451B4C340045C
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\Recovery\High\Active\{D1C56E8A-65D5-11EB-90E5-ECF4BB2D2496}.dat Download File
Process:	C:\Program Files\internet explorer\iexplore.exe
File Type:	Microsoft Word Document
Category:	dropped
Size (bytes):	16984
Entropy (8bit):	1.5664277360969885
Encrypted:	false
SSDEEP:	48:Iwd7GcprkGwpakG4pQUGrapbSgorGQpK+UG7HpRisTGIpG:rXZcQU6iBSgoFA+fTi4A
MD5:	EFB5FE3DC4877214A5688611565685EE
SHA1:	8169413BF01D5F5BBAC1DD58840FAA628B63E79C
SHA-256:	190CAC51E1DAF6502CDEAFDD23A9E7DD5978355E19072DC75309C88059F6308C
SHA-512:	C24BF2A193C7146B46760094FFA54C80EE8EFC4EF36CCF7862EB36B8C3EA37548ACB6DEB9F14C76A92DBA551AB76684A68D38911D61AD42741AAEDDD47F92006
Malicious:	false
Reputation:	low
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................R.o.o.t. .E.n.t.r.y.....................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\AppData\Local\Microsoft\Internet Explorer\imagestore\wlm7n14\imagestore.dat Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	data
Category:	dropped
Size (bytes):	28286
Entropy (8bit):	4.8832064808743
Encrypted:	false
SSDEEP:	384:QW9PotfNe+3X5daBPZOMQV0K1/qZfeA99cIXwjX:QYu9datZORVvq4ApXeX
MD5:	ABD0DF6AE9827382D7A88B57D74305BB
SHA1:	7B87EC41321FCC181B5069DA10BEA0101C4A39AA
SHA-256:	50037E9C6C9FF6AED99D28760A68CC61111FA76754415731B5F62293DF4AE7DA
SHA-512:	2D38F101EF7DA1E344DD6A159DD4D30CA5DF8A690B1CF410EFEE3AC1A6049162D2B5547406331E7A10B7008EEA38524816A87B6BDBF073D08767A4EEBBA52B07
Malicious:	false
Reputation:	low
Preview:	S.h.t.t.p.s.:././.c.a...r.b.c.w.e.a.l.t.h.m.a.n.a.g.e.m.e.n.t...c.o.m./.d.a.-.e.p.i.c.-.t.h.e.m.e./.t.h.e.m.e.s./.d.a.-.s.l.a.t.e./.i.m.a.g.e.s./.f.a.v.i.c.o.n...i.c.o.>@........@@.... .(@......(...@......... ..........................................................................................................&...).2..U.(.x.(...)...'..(..(..&..&..&..&..&..(..&..(..(...)...(...'.o.).K..+.'............................................................................................................................................... ...).2.(.f.)...(..&..)......+...+...+.........)...)...)...)...)...)...)............+...+...+......(...&..(...)...).W..$.................................................................................................................,...).X.(...)..)...+...+......)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...)...)......+...+...&...)..(...*.C.9................................................

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.DTD Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	498
Entropy (8bit):	5.103913616294899
Encrypted:	false
SSDEEP:	12:TMbhJpIO1mcROtW/yF0T8YA+it/0zsFE/TYEGs/4w:qhJ+CTRSnF1wlwFUY6
MD5:	90BE2701C8112BEBC6BD58A7DE19846E
SHA1:	A95BE407036982392E2E684FB9FF6602ECAD6F1E
SHA-256:	644FBCDC20086E16D57F31C5BAD98BE68D02B1C061938D2F5F91CBE88C871FBF
SHA-512:	D618B473B68B48D746C912AC5FC06C73B047BD35A44A6EFC7A859FE1162D68015CF69DA41A5DB504DCBC4928E360C095B32A3B7792FCC6A38072E1EBD12E7CBE
Malicious:	false
Reputation:	low
Preview:	<?xml version="1.0" standalone="yes"?>..<!DOCTYPE document [..<!ELEMENT document (node)>.. <!ATTLIST document WMSNameSpaceVersion CDATA "2.0">....<!ELEMENT node (node)>.. <!ATTLIST node name CDATA #REQUIRED>.. <!ATTLIST node opcode ( create \| remove \| setval \| clearval \| rename \| movebefore ) #REQUIRED>.. <!ATTLIST node secure ( true \| false ) #IMPLIED>.. <!ATTLIST node type ( string \| boolean \| int32 \| binary \| int64 ) #IMPLIED>.. <!ATTLIST node value CDATA #IMPLIED>..]>..

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, UTF-8 Unicode text, with CRLF line terminators
Category:	dropped
Size (bytes):	30570
Entropy (8bit):	4.791796165556784
Encrypted:	false
SSDEEP:	192:BFV0bBPCfUd/FV0bBPCfUd/FV0bBPCfUdY:gYfXYfXYfx
MD5:	84A68822A47B6C799A5C1385F12F8A38
SHA1:	3DB8FA2ABFC30EAF965E7F49418390955D192F1E
SHA-256:	C807CF28091892886A1ABE7374C03B2480A81FDCA428EC2FD11EB1BB9DFD8758
SHA-512:	21095D759380FA2D3D79F98CD793DA82E1DB704D1556D15BA6DA7547B586B17AC441A6AAC89D0F5BD5026658677A5858A108007B10268C37A97EA6BD355C5668
Malicious:	false
Reputation:	low
Preview:	<document WMSNameSpaceVersion="2.0">.... <node name="Control Protocol" opcode="create" >.. <node name="Object Store" opcode="create" >.. <node name="RTSP" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{308786f0-8b15-11d2-b25f-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="RTSP,RTSPA,RTSPT,RTSPU,RTSPM" />.. </node> Properties -->.... </node> RTSP -->.... <node name="Sessionless Multicast" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{f9377800-f38d-11d2-b26c-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="MCAST,RTP" />.. </node> Properties --

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNS.XML.bak Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	20382
Entropy (8bit):	4.792342140217129
Encrypted:	false
SSDEEP:	96:/YkZRAF6zyHUhm77yB1pZYCEnfHrHH7B6xTGH+YCLV3zwULJEYCJWyHBt3zwFRhd:/2FV0bBPCfUd/FV0bBPCfUdY
MD5:	20BB36C2C12D38E01BE65900BA1C2B34
SHA1:	20DDB44D6DAE1A886F41E12A4CEA83DA71E15712
SHA-256:	ED1F88C63000E59165B17DF9B08AAB4859293BDFC9108003B1FB378A7DEC859A
SHA-512:	EA34C046BBC820B5C3B63132A7D437777EB186DEFA663A5350EEECE6FA77A84C64B9934A7762783AA3F36D781E0F21A2E5A7746B1566718BAFB8FBAFF49A54A6
Malicious:	false
Reputation:	low
Preview:	.<document WMSNameSpaceVersion="2.0">.... <node name="Control Protocol" opcode="create" >.. <node name="Object Store" opcode="create" >.. <node name="RTSP" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{308786f0-8b15-11d2-b25f-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="RTSP,RTSPA,RTSPT,RTSPU,RTSPM" />.. </node> Properties -->.... </node> RTSP -->.... <node name="Sessionless Multicast" opcode="create" >.. <node name="CLSID" opcode="create" type="string" value="{f9377800-f38d-11d2-b26c-006097d2e41e}" />.. <node name="Enabled" opcode="create" type="int32" value="0x1" />.. <node name="Properties" opcode="create" >.. <node name="Protocol" opcode="create" type="string" value="MCAST,RTP" />.. </node> Properties

C:\Users\user\AppData\Local\Microsoft\Windows Media\12.0\WMSDKNSD.XML Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	53
Entropy (8bit):	4.66869469064966
Encrypted:	false
SSDEEP:	3:sLRaE92JWyhHX9ovy4dduRun:sLzTyRXKvndI0
MD5:	A9B5DA9AEC61657B32393D96217165F0
SHA1:	80B5C577155ACD269B450D70F6B2CBED693EDF49
SHA-256:	9F4611369CF65B33D886489B2486FCA7B1E83E0DC998D35B15B3AA4C8478A28D
SHA-512:	0B73B232C03FFD5CE526A1EDE481A57C753D15D9EE39D4247ABFA52819B59FA676C63E30825DAF233E3139038C353DF84D652C4CE2CB71A706DDDBDFE0C70335
Malicious:	false
Reputation:	low
Preview:	<document WMSNameSpaceVersion="2.0">....</document>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BlackTie-Bold-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie family
Category:	downloaded
Size (bytes):	13367
Entropy (8bit):	7.954998639095763
Encrypted:	false
SSDEEP:	192:khpdZZGKwLVA1jGWjQOGUb242ocO+c8xfGd5vVjK99To7CHn2oasBUVu3292zNb2:khHd31qWfQUVM059O+OHnBcp92J
MD5:	F04364709EBD6CA2BF7CAA19882CEBD7
SHA1:	DE63B46A5030B5797A13E4726E605224479A0EBD
SHA-256:	D163636826FAD7AC1A9F71D0208FD0727D925405A5FB308BABCB65D98A95EA4C
SHA-512:	2AB8C6A2B058B59EB007716E9A92C37EE77A1D06204406BC2C6B8902BB1C89D5A73121C9922A40230CF7DBD97ED0E8AE3C3DC06D0D2F3B3B11454AD64596004D
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/BlackTie-Bold-webfont.eot?
Preview:	74..e3............................LP................................................B.l.a.c.k. .T.i.e.....B.o.l.d...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4.....B.l.a.c.k. .T.i.e. .B.o.l.d.....BSGP..................r`.3].3a.+0......U.D.-.%..h.`..........(Y.....h..<....hj...J...1.)..../..z...r.#.%..-.V...Aa..*..../.d.............oL...i..t&.^..]{..9.y`.j.y.F0a...K....<..`.r...4........vJ.P....+..v........n...l.S......o.0$a`......3......_TNJ.........3....p.o.6.KH...(iq.A..x..m.O.z.....i?..?3 ?C.2&..$.R...Z...Gx......<...ao..D.B.1..@.Q. ...A.......B$ .P.."o...X...l..0U.X..S........,...M..k.IV..?Q..0....".Y.@6i..G.Q.......!uW..Z.............{Q_..:{..L...."\..ELc.`.......n..q..H.w.+.9..q........a...7..\|.<.(....."v.8..U..Y..N.....\|.v.ey..y{.....&.._....^...9^..ZfP.WF...t7B+4..\|O....F...5........2p.D....C0...X..2.M...N[J:k1...A..zwK8/.....i..A..E....S..B......X...@.../x...'...............d&...p.t"p...f......V..`..Y..".yQ...8..R\|0o..2..A.s..yK..KY?.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BlackTie-Bold-webfont[2].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie family
Category:	downloaded
Size (bytes):	13367
Entropy (8bit):	7.954998639095763
Encrypted:	false
SSDEEP:	192:khpdZZGKwLVA1jGWjQOGUb242ocO+c8xfGd5vVjK99To7CHn2oasBUVu3292zNb2:khHd31qWfQUVM059O+OHnBcp92J
MD5:	F04364709EBD6CA2BF7CAA19882CEBD7
SHA1:	DE63B46A5030B5797A13E4726E605224479A0EBD
SHA-256:	D163636826FAD7AC1A9F71D0208FD0727D925405A5FB308BABCB65D98A95EA4C
SHA-512:	2AB8C6A2B058B59EB007716E9A92C37EE77A1D06204406BC2C6B8902BB1C89D5A73121C9922A40230CF7DBD97ED0E8AE3C3DC06D0D2F3B3B11454AD64596004D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/fonts/BlackTie-Bold-webfont.eot?
Preview:	74..e3............................LP................................................B.l.a.c.k. .T.i.e.....B.o.l.d...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4.....B.l.a.c.k. .T.i.e. .B.o.l.d.....BSGP..................r`.3].3a.+0......U.D.-.%..h.`..........(Y.....h..<....hj...J...1.)..../..z...r.#.%..-.V...Aa..*..../.d.............oL...i..t&.^..]{..9.y`.j.y.F0a...K....<..`.r...4........vJ.P....+..v........n...l.S......o.0$a`......3......_TNJ.........3....p.o.6.KH...(iq.A..x..m.O.z.....i?..?3 ?C.2&..$.R...Z...Gx......<...ao..D.B.1..@.Q. ...A.......B$ .P.."o...X...l..0U.X..S........,...M..k.IV..?Q..0....".Y.@6i..G.Q.......!uW..Z.............{Q_..:{..L...."\..ELc.`.......n..q..H.w.+.9..q........a...7..\|.<.(....."v.8..U..Y..N.....\|.v.ey..y{.....&.._....^...9^..ZfP.WF...t7B+4..\|O....F...5........2p.D....C0...X..2.M...N[J:k1...A..zwK8/.....i..A..E....S..B......X...@.../x...'...............d&...p.t"p...f......V..`..Y..".yQ...8..R\|0o..2..A.s..yK..KY?.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BlackTie-Solid-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie Solid family
Category:	downloaded
Size (bytes):	11162
Entropy (8bit):	7.939389649953023
Encrypted:	false
SSDEEP:	192:A3xZP/slPEvFfkq0R5fsacJoT6Jv2BXN1+BBoKxms2fGQ1fIwOJjVTeyEXV33crs:A3n/slPENB0R5s3Jo8v2ZNylKeQKwMj6
MD5:	D4D54007AD9D85A22875818D64731BF9
SHA1:	36BE76EDB679AB55616076BED5C352D79CAFA826
SHA-256:	D86003EB848C2EC377636405B3236A260EDAF7DD54B40BA43F80A7AAA35A58EA
SHA-512:	5025776B5111B8666CEEAD6FD0D925893AD968FF76A2F9E1119390D1EF2635147AFB55EE04A22A15536DD01554F6CE8BE9F4B9CBEF4134C54CEE6EB7EBF9D5EA
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/BlackTie-Solid-webfont.eot?
Preview:	.+...............................LP..........................H.....................B.l.a.c.k. .T.i.e. .S.o.l.i.d.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4.....B.l.a.c.k. .T.i.e. .S.o.l.i.d. .R.e.g.u.l.a.r.....BSGP..................gH.....%.......U.D.-.%..h.`..........(Y.....h..<....hj...J...1.)..../..z..r.#.%.:.........2....B.fY/...G...~ &;.....j........\.5......Q..>...cR..\0.....m......g....Z.V....B....j.........BJ.e-.A..1~../..,.C..6\v7^..G.....^.}....x.....;.;E ..kuX...%M)...8G.:..c.....M.+..u...nfO4.OT Oc.2.!\ ci........;..>9....5.pB.1..E.(..b...{..z..I@."..@.t?c....@..Q.[ ...5....Uc.6r.K..&..\..a.......HZ3..5.dIy.jw)%..n..hc\3...j...$D&.!J...\|...S.......K..E.1.lc!l.z........R.C.xC.*F.Q.M9.VS..=l..o?o..@..z..jy97"!h..W..d./....2..K!f..B..f0g.....~.~3.g......fX.Y.tydY..-0V.....IM....Q`.^.B...J@..R_.j...U.........k.e...2.Q...7.d."lk-c...VC.....kX)..r.nH.u1\|.R.h<...W.{u......bN6......$+.4a4...t...r.}.<...H.z.F..?FX.....".I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\BlackTie-Solid-webfont[2].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie Solid family
Category:	downloaded
Size (bytes):	11162
Entropy (8bit):	7.939389649953023
Encrypted:	false
SSDEEP:	192:A3xZP/slPEvFfkq0R5fsacJoT6Jv2BXN1+BBoKxms2fGQ1fIwOJjVTeyEXV33crs:A3n/slPENB0R5s3Jo8v2ZNylKeQKwMj6
MD5:	D4D54007AD9D85A22875818D64731BF9
SHA1:	36BE76EDB679AB55616076BED5C352D79CAFA826
SHA-256:	D86003EB848C2EC377636405B3236A260EDAF7DD54B40BA43F80A7AAA35A58EA
SHA-512:	5025776B5111B8666CEEAD6FD0D925893AD968FF76A2F9E1119390D1EF2635147AFB55EE04A22A15536DD01554F6CE8BE9F4B9CBEF4134C54CEE6EB7EBF9D5EA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/fonts/BlackTie-Solid-webfont.eot?
Preview:	.+...............................LP..........................H.....................B.l.a.c.k. .T.i.e. .S.o.l.i.d.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4.....B.l.a.c.k. .T.i.e. .S.o.l.i.d. .R.e.g.u.l.a.r.....BSGP..................gH.....%.......U.D.-.%..h.`..........(Y.....h..<....hj...J...1.)..../..z..r.#.%.:.........2....B.fY/...G...~ &;.....j........\.5......Q..>...cR..\0.....m......g....Z.V....B....j.........BJ.e-.A..1~../..,.C..6\v7^..G.....^.}....x.....;.;E ..kuX...%M)...8G.:..c.....M.+..u...nfO4.OT Oc.2.!\ ci........;..>9....5.pB.1..E.(..b...{..z..I@."..@.t?c....@..Q.[ ...5....Uc.6r.K..&..\..a.......HZ3..5.dIy.jw)%..n..hc\3...j...$D&.!J...\|...S.......K..E.1.lc!l.z........R.C.xC.*F.Q.M9.VS..=l..o?o..@..z..jy97"!h..W..d./....2..K!f..B..f0g.....~.~3.g......fX.Y.tydY..-0V.....IM....Q`.^.B...J@..R_.j...U.........k.e...2.Q...7.d."lk-c...VC.....kX)..r.nH.u1\|.R.h<...W.{u......bN6......$+.4a4...t...r.}.<...H.z.F..?FX.....".I.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\NewErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1612
Entropy (8bit):	4.869554560514657
Encrypted:	false
SSDEEP:	24:5Y0bQ573pHpACtUZtJD0lFBopZleqw87xTe4D8FaFJ/Doz9AtjJgbCzg:5m73jcJqQep89TEw7Uxkk
MD5:	DFEABDE84792228093A5A270352395B6
SHA1:	E41258C9576721025926326F76063C2305586F76
SHA-256:	77B138AB5D0A90FF04648C26ADDD5E414CC178165E3B54A4CB3739DA0F58E075
SHA-512:	E256F603E67335151BB709294749794E2E3085F4063C623461A0B3DECBCCA8E620807B707EC9BCBE36DCD7D639C55753DA0495BE85B4AE5FB6BFC52AB4B284FD
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/NewErrorPageTemplate.css
Preview:	.body..{.. background-repeat: repeat-x;.. background-color: white;.. font-family: "Segoe UI", "verdana", "arial";.. margin: 0em;.. color: #1f1f1f;..}.....mainContent..{.. margin-top:80px;.. width: 700px;.. margin-left: 120px;.. margin-right: 120px;..}.....title..{.. color: #54b0f7;.. font-size: 36px;.. font-weight: 300;.. line-height: 40px;.. margin-bottom: 24px;.. font-family: "Segoe UI", "verdana";.. position: relative;..}.....errorExplanation..{.. color: #000000;.. font-size: 12pt;.. font-family: "Segoe UI", "verdana", "arial";.. text-decoration: none;..}.....taskSection..{.. margin-top: 20px;.. margin-bottom: 28px;.. position: relative; ..}.....tasks..{.. color: #000000;.. font-family: "Segoe UI", "verdana";.. font-weight:200;.. font-size: 12pt;..}....li..{.. margin-top: 8px;..}.....diagnoseButton..{.. outline: none;.. font-size: 9pt;..}.....launchInternetOptionsButton..{.. outline: none;

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\QJCP83P3.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with CRLF, LF line terminators
Category:	downloaded
Size (bytes):	71656
Entropy (8bit):	3.7639242141130134
Encrypted:	false
SSDEEP:	1536:y6dGKVSHn/RboF5GLcb+S2d+2Em2sYCgKV43J45wdqzKqnQhQzpMtuFjaLjH+THv:y6d9SHn/RboF5GLcb+S2d+2Em2sYCgKr
MD5:	45269BCB3B561237C23F4F41877782F7
SHA1:	BDE6AF61F116730E6EEDBF0700FF1DBA00610C01
SHA-256:	2BAB5F6E36D124826C93226FEA08CD5707596EB0A13FF383DD7F5F4469B6352B
SHA-512:	86D5CBD57A1A46158B3FD65387E8E43B90705089F890BCD0C50768E1E7116267CB93AFAEABD74DFD555382AAFC354CDBA671A14C1BD35F02EF077CD26CC34BF8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/
Preview:	<!DOCTYPE html>.<html lang="en">. . . . . <head>. <meta http-equiv='X-UA-Compatible' content='IE=Edge'>. <meta charset='utf-8'>. <meta content='width=device-width, initial-scale=1' name='viewport'>. <meta http-equiv="cache-control" content="public">. <meta http-equiv="expires" content="1">. . <meta property="fb:app_id" content="455772031277726" />. <meta name="description" content="Discover the difference at RBC Dominion Securities, a trusted resource for all of your wealth management, investing and financial planning needs." />. <meta name="keywords" content="wealth management, investing, financial planning, rbc dominion securities, full-service brokerage, full-service investment wealth management firm, canada, royal bank of canada, rbc financial group" />. . . . . . .. .. . . .. .. .. . . . . <style></style>. . . . . <link rel="icon" href="/fav

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\RBCDisplay-LightItalic[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 39948, version 1.1
Category:	downloaded
Size (bytes):	39948
Entropy (8bit):	7.9868041440908915
Encrypted:	false
SSDEEP:	768:IAkyIyEMHlGB3i51SAxiOBDODF/28LNb0wxGO+6ZRP:RWMHYB3i5Dxd8FO8LNb0n+ZRP
MD5:	6FD6CDCFF8C004A17559AB16C7EA5C99
SHA1:	36A299A713450E87FAFFC23C48920E702390846E
SHA-256:	20B1683D3C6F9E1B13842164F93F42F634E1E87739925499E42A2EA3EDAD6D9D
SHA-512:	7AAD6A390BAD9FA4578C5D53511B18561BFB9E00FB7134BC27E7FAAAF7E95E07F0B8D6BCE144CFA2075D5A318EDD82DB625D3A332218A4E18813F1C7F10239D6
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/RBCDisplay-LightItalic.woff
Preview:	wOFF..............z.........................FFTM..............'.GDEF...\|...3...6.)..GPOS...(.......@...GSUB.......u...$R~W.OS/2.......R...`..W.cmap...........jKy..cvt .......R...R...Ifpgm...........s.Y.7gasp...l............glyf......s...$.FM..head.......6...6.M%.hhea.......#...$....hmtx...d........X##Xloca...`...T...TR.Nmaxp....... ... .;..name.......6...(.^..post...........^[S..prep...........j5..6.......B.._.<.........R)s.........k...~..............x.c`d``...........X..R.D....&..b.h......).....................i....x.c`fbb.a`e`a...........2.1.b``b.........^0~bvI&.#..o&...^.U^`.P.j..110m.R..........x...OHTQ..s.9*f......N......).).R..("hQ.[.A..D.R.HC..".E`...VA..+,p!J-..(..{.I.......{.......O..cY....^..V...GX..i.J....2...E.S.H.../{...CPN.I.....v`.. C...A....9n.".[4.g.&Md..#.....l.r_@/".....A.>.\|...A.......N.6h?......bl.<.-.AD..U.P.\.w.f..I7.y..;#K.LR...Of.I..!.5.2...c.....\|Vhf..5.J,.7..>w...L.$..Z.........M...O..I.w....2...F.3f.Q.c.u....R.j....vK(.7.N...g.t.s...y

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\_homepage[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5211
Entropy (8bit):	5.080207643946646
Encrypted:	false
SSDEEP:	96:5s9Y55dtijSBb04xZqi5KnzXWqGBYGDa1fzPCY1+/VCpXFgi:4E5dtBbxg14a1fzRKVCpyi
MD5:	E0BF275A0AC00FC7C14C8283CDFC0C10
SHA1:	6EB5EA51C21EC9246511066558161C6E00B10918
SHA-256:	CF6AF1479FD39C68DB23C13E0E4259EC264ED7E5C4F270B1E6024D6C21F9D617
SHA-512:	A1F1BF5058F052314AD530F70A6379B5C0229D97E246F62BA0DF7C1CBCE61541CF3B47AD5B881407F327EC1CA989BC21AC5716BD056DFA3A0FC0C86B8533CE47
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/_homepage.js
Preview:	.// mobile = Kenburs / desktop = Video BG .if (1) {. if(isMobile) {. var imageUrl = $(':hidden#backgroundLandingImage').val();. if (imageUrl !== undefined) {. $('.hero').prepend('<div class="kenburnsMobile"><img src="' + imageUrl + '" alt="Homepage image"></div>');. }. }. else {. var imageUrl = $(':hidden#backgroundLandingImage').val();. if (imageUrl !== undefined) {. $('.hero').prepend('<div class="kenburns"><div style="background-image: url('+imageUrl+');background-size:cover;"></div></div>');. }. }.} else {. var videoUrl = '_wmassets/videos/beach';. $('.hero').prepend('<video autoplay loop id="bgvid"><source src="'+videoUrl+'.mp4" type="video/mp4"><source src="'+videoUrl+'.ogv" type="video/mp4"></video>');.}..$(document).ready(function(){ ...// Initialize swipers site wide..$('.swiper-quote .arrow-left').on('click keydown', function(e){...if (e.type === 'click' \|\| (e.key && e.key.toLowerCase() === 'enter')) {... e.preventDefault();... mySwiper

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\advisor_styles[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	7221
Entropy (8bit):	4.993942329160806
Encrypted:	false
SSDEEP:	96:8p3VKvhV7wZwIGmwUlxbIBEtRLZKTJZE9q+685TQTatQ7uvGZplT/M+JC:8N4p9wZw3mwUlxbIBEdoE9qPpi+k
MD5:	1063962C9B2E151219C012A599E4B43E
SHA1:	6C480373B26C9F8183A3ED4531CD5A84F9881F3A
SHA-256:	95E88EEE7A7BBDA924218603A565C9C8A66611F821F4CC7368EE38C2E5F40504
SHA-512:	493BF0F66595382FD09FCD92DFF26D406226890933BBC12E6FFB436D6AD804363A080A4AA0BC9EF01BD82D7F20E34E87E32FCAD3B8921A4162DC45671B597F3B
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_os/css/advisor_styles.css
Preview:	/* LOGO longer image fix (only if using DS logo).. ----------------------------------------/..../ .navbar-brand .logo {.. margin-top: 0;.. width: auto;.. height: auto;.. max-width: none;.. max-height: 45px;..}..@media (max-width: 992px) {.. .navbar-brand .logo {.. max-height: 39px; .. } ..}/....../ DS secondary top bar text.. ----------------------------------------/.....navbar li.wm-ds h6 { .. margin-bottom: 0;.. font-size: 16px; .. line-height: 20px;.. font-family: "Roboto";..} ../#secondary-navigation .navbar-nav>li.wm-ds>a { .. padding: 6px 14px; ..}/......../ NAV always show background colour.. ----------------------------------------*/.....nav-white #global-navigation.headerattop,...nav-white #global-navigation.headeractive {.. background-color: #fff !important;.. box-shadow: 0 3px 6px rgba(0, 0, 0, 0.05);..}...nav-white #global-navigation {.. background-color: rgba(255, 255, 255, 0.95) !important;..}.....nav-grey #global-navigation.headerattop,...nav-g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\advisor_styles_dark[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	11118
Entropy (8bit):	5.077778686057367
Encrypted:	false
SSDEEP:	192:6wTw9wjZywZwF5/Un/nABY5zbwPr5esxMEC5nsq5zFT0wTw3wG5zfC5zl/O5d5Oo:68M4ZyMp0IBPu
MD5:	4F32211358B335A3BB993E5B611EAB98
SHA1:	2FF8B7C2C4FD62CB57049C9682CADB19FA4EB9E4
SHA-256:	305891F49B074243A8CF0B09395999304E31F2233C244431F96275797FE02F0E
SHA-512:	822333AC21469761D636D9F90AB44C250D6FB33F980A1FC1D9C2263B04435038DD35A4AFF96DDB54057D03E5FC20683E77734269F109FDF4FFDB9B31C61FD47B
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_os/css/advisor_styles_dark.css
Preview:	/* ADVISOR STYLES THEME 2 - dark grey /....../ GENERAL - global.. ----------------------------------------/....h1,..h2,..h3,..h4,..h5,..h6 {.. color: #585858;..}....blockquote {.. border-left-color: #fedf01;.. color: #6f6f6f;..}....../ GENERAL - wm styles.. ----------------------------------------/.....button.b-yellow,...button.b-dark-blue {.. border-color: #fedf01 !important;.. background-color: #fedf01 !important;.. color: #252525 !important;..}.....button.b-yellow:hover,...button.b-dark-blue:hover {.. background-color: #feef80 !important;.. border-color: #feef80 !important;..}.....button.c-grey-tint-1,...button.c-dark-blue {.. background-color: transparent !important;.. border-color: #b3b3b3 !important;.. color: #6f6f6f !important;..}.....button.c-grey-tint-1:hover,...button.c-dark-blue:hover {.. background-color: #6f6f6f !important;.. border-color: #6f6f6f !important;.. color: #fff !important;..}.....separator-pike {.. color: #fedf01;..}....../ NAV.. ----------

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\blazy.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	4132
Entropy (8bit):	5.170488761987818
Encrypted:	false
SSDEEP:	96:t6ZZwNQpCHFX4KnBTEB/IvmMGDt7vRNi4ZQA/XA:VNQpCN4KnBTEBe5w7vbi4Zz/XA
MD5:	A9073314412FCEEDF1E5414DF491AF9E
SHA1:	8E508C59F03E988582B718F7806AD49DFDAE7245
SHA-256:	4ACD357193573794FC00805F4CF4887BD0FB1856020130AAAFACCB650D72A596
SHA-512:	39D54A16B9220353F366C7A4E48EFD2E85C0C64C158A963F2E4CE2665C3265AE972A6ADAA3683C13AE8AFD885E85ABD6A9745D2648B11A01B7BBEE5EDAA082ED
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/blazy.min.js
Preview:	/!. hey, [be]Lazy.js - v1.5.2 - 2015.12.01. A lazy loading and multi-serving image script. (c) Bjoern Klinggaard - @bklinggaard - http://dinbror.dk/blazy./. (function(k,f){"function"===typeof define&&define.amd?define(f):"object"===typeof exports?module.exports=f():k.Blazy=f()})(this,function(){function k(b){var c=b._util;c.elements=v(b.options.selector);c.count=c.elements.length;c.destroyed&&(c.destroyed=!1,b.options.container&&h(b.options.container,function(a){l(a,"scroll",c.validateT)}),l(window,"resize",c.saveViewportOffsetT),l(window,"resize",c.validateT),l(window,"scroll",c.validateT));f(b)}function f(b){for(var c=b._util,a=0;a<c.count;a++){var d=c.elements[a],g=d.getBoundingClientRect();if(g.right>=e.left&&g.bottom>=e.top&&g.left<=e.right&&g.top<=e.bottom\|\|n(d,b.options.successClass))b.load(d),c.elements.splice(a,1),c.count--,a--}0===c.count&&b.destroy()}function q(b,c,a){if(!n(b,a.successClass)&&(c\|\|a.loadInvisible\|\|0<b.offsetWidth&&0<b.offsetHeight))if(c=b.getAttribute(p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\bootstrap-hover-dropdown.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	5174
Entropy (8bit):	4.1933706092141385
Encrypted:	false
SSDEEP:	96:3dsOvAhdSZ90fZHwCDw+YLWEu5JstnefU3vV:tAhda9aaxap5Q3vV
MD5:	4C29FBCB84B92D911010115C9690A279
SHA1:	35F55C2BA3CE66FA104E2BCBA1BBA30849270231
SHA-256:	29B64C87E6433C3B68148E84C17CD3B6FCF7387D2EF8EB75286439E9EED1B924
SHA-512:	8DDD858A921B6CB4CE368A8D9FDCE34D8CEA59A997EC10C9E3861FB46A87C3C09D52B2B21DEFB2C90B50BB95B6106FAEB90548CF029E84935164D6C4E23C3613
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/js/bootstrap-hover-dropdown.min.js
Preview:	/*.. @preserve.. * Project: Bootstrap Hover Dropdown.. * Author: Cameron Spear.. * Version: v2.1.3.. * Contributors: Mattia Larentis.. * Dependencies: Bootstrap's Dropdown plugin, jQuery.. * Description: A simple plugin to enable Bootstrap dropdowns to active on hover and provide a nice user experience... * License: MIT.. * Homepage: http://cameronspear.com/blog/bootstrap-dropdown-on-hover-plugin/.. */..;(function ($, window, undefined) {.. // outside the scope of the jQuery plugin to.. // keep track of all dropdowns.. var $allDropdowns = $();.... // if instantlyCloseOthers is true, then it will instantly.. // shut other nav items when a new one is hovered over.. $.fn.dropdownHover = function (options) {.. // don't do anything if touch is supported.. // (plugin causes some issues on mobile).. if (('ontouchstart' in document.documentElement) && ($(window).width() < 500)) return this; // don't want to affect chaining.... // the element we

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\bootstrap-hover-dropdown.min[2].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	5012
Entropy (8bit):	4.133422744928469
Encrypted:	false
SSDEEP:	96:9dTAIdNZX0KCaudYtI8wu88ZJZwewwb3P5:XAIdjXdX3pZswb3x
MD5:	CFCF80392D9621095D3A395A9A48323F
SHA1:	E13B6F71757998EECB4546C692C78FEFFFA5AB17
SHA-256:	FEB652391C37C4889856759458DD2824ACF6DDCA0D674D5C5F5E201BD1ED2D58
SHA-512:	979C6A8FA522E0FB0893A9DFFAA16444EF066588E8D2F2D8325BF911B295C17FA5EA034C8D84F629BE0CE7FF8C03A36A4881422E7E7D762B58BD05E219B72E91
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/bootstrap-hover-dropdown.min.js
Preview:	/*. @preserve. * Project: Bootstrap Hover Dropdown. * Author: Cameron Spear. * Version: v2.1.3. * Contributors: Mattia Larentis. * Dependencies: Bootstrap's Dropdown plugin, jQuery. * Description: A simple plugin to enable Bootstrap dropdowns to active on hover and provide a nice user experience.. * License: MIT. * Homepage: http://cameronspear.com/blog/bootstrap-dropdown-on-hover-plugin/. */.;(function ($, window, undefined) {. // outside the scope of the jQuery plugin to. // keep track of all dropdowns. var $allDropdowns = $();.. // if instantlyCloseOthers is true, then it will instantly. // shut other nav items when a new one is hovered over. $.fn.dropdownHover = function (options) {. // don't do anything if touch is supported. // (plugin causes some issues on mobile). if (('ontouchstart' in document.documentElement) && ($(window).width() < 500)) return this; // don't want to affect chaining.. // the element we really care about.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\bullet[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	447
Entropy (8bit):	7.304718288205936
Encrypted:	false
SSDEEP:	12:6v/71Cyt/JNTWxGdr+kZDWO7+4dKIv0b1GKuxu+R:/yBJNTqsSk9BTwE05su+R
MD5:	26F971D87CA00E23BD2D064524AEF838
SHA1:	7440BEFF2F4F8FABC9315608A13BF26CABAD27D9
SHA-256:	1D8E5FD3C1FD384C0A7507E7283C7FE8F65015E521B84569132A7EABEDC9D41D
SHA-512:	C62EB51BE301BB96C80539D66A73CD17CA2021D5D816233853A37DB72E04050271E581CC99652F3D8469B390003CA6C62DAD2A9D57164C620B7777AE99AA1B15
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/bullet.png
Preview:	.PNG........IHDR...............ex....PLTE...(EkFRp&@e&@e)Af)AgANjBNjDNjDNj2Vv-Xz-Y{3XyC\}E_.2j.3l.8p.7q.;j.;l.Zj.\l.5o.7q.<..aw.<..dz.E...........1..@.7..~.....9..:.....A..B..E..9..:..a..c..b..g.#M.%O.#r.#s.%y.2..4..+..-..?..@..;..p..s...G..H..M.........z`....#tRNS................................../,....mIDATx^..C..`.......S....y'...05...\|..k.X......*`.F.K....JQ..u.<.}.. ..[U..m....'r%.......yn.`.7F..).5..b..rX.T.....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\chevron-right-blue[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	406
Entropy (8bit):	5.193109089474691
Encrypted:	false
SSDEEP:	6:tI9mc4sl32/AHagugGEBNzKxmHqiLUMI47Aq0n4YOauiI6ap/76JWl7C59DDi:t412k2EXKAKuAdTP0C6CPDDi
MD5:	9A5022C7A1C25F1BC4C2A265CC3C2668
SHA1:	21814919E627013C1EC8B5FAB9D44FF54BEF7885
SHA-256:	C9513114DA2AF977BB1BF1421D54E4906BA8439ED9F036A1F3B42506204DF827
SHA-512:	915556370FEA20BAF13F187F65122A50D99476A3507D49A60E085AC978AEBF94368013706E6CFE2CA8F59F56D3EB94CC083A263F6C1A422011CB619D0EE66371
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/chevron-right-blue.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 6 10"><defs><style>.cls-1{fill:#006ac3}</style></defs><title>link_chevron</title><g id="Layer_2" data-name="Layer 2"><g id="Basic"><g id="Navigation_Misc" data-name="Navigation/Misc"><g id="Icons"><path id="icon-link-chevron_8_" data-name="icon-link-chevron (8)" class="cls-1" d="M.85 10L0 9.2l4.33-4.28L.01.82.84 0 6 4.9.85 10z"/></g></g></g></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\chevron-right-white[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	427
Entropy (8bit):	5.187077124677762
Encrypted:	false
SSDEEP:	6:tI9mc4sl32/AHagunW0BNzKxFRlmHqiLUM29b747Aq0n4YOa4KiI6a4F7/76JWlf:t412k8W0XKxFCw9b7uAdTsfdNC6CPDDi
MD5:	100B6982441A3232D161ED46E0B49321
SHA1:	EB852738D68236128E1FC55483F448F6C24497A4
SHA-256:	1C323C6269A284F42A11AB70483A7EF20003570CDE175735DA4B1E2B0D12B5A7
SHA-512:	5133B2D0A964314C4FC25C9ED120D59BAA10C51C8D3BD94E215395078A8D7CEDA5BD9F04504AA3834DEF782A21492D30E3E4601BE283A9568EBA69C1B34463C2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/chevron-right-white.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 6 10"><defs><style>.cls-1{fill:#fff}</style></defs><title>link_chevron_white</title><g id="Layer_2" data-name="Layer 2"><g id="Inverse"><g id="Navigation_Misc" data-name="Navigation/Misc"><g id="Icons"><path id="icon-link-chevron-inverse_8_" data-name="icon-link-chevron-inverse (8)" class="cls-1" d="M.85 10L0 9.2l4.33-4.28L.01.82.84 0 6 4.9.85 10z"/></g></g></g></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\combo[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	2392
Entropy (8bit):	5.381817953862614
Encrypted:	false
SSDEEP:	48:qV9PpWp+1ZrNePsrKvVc4LM8LjiqOZ24vXKNo+cnhtCTYUwhrA0HGIY:qV9PpA+1ZM/6uaJ9vx+2arOrA0mIY
MD5:	578F68F1F2C3209882928718AC6E44D7
SHA1:	5728F9CB6EA3EE448C9E1D51797B36255491BCA4
SHA-256:	3AABD72904A559AA3347088891FDFA7512972125B7058AB989DCFB87E101306C
SHA-512:	489A6CCF6AFC792E15ACAACEA6767A0761B3016C960796CFAD3B082823D466A69B0553323ECC7AF246D8EA16C4270AE225FB7035F4C99E247EE9441300606841
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/combo/?browserId=other&minifierType=&languageId=en_US&b=6101&t=1460655967000&p=/html/js&m=/aui/base-build/base-build-min.js
Preview:	/.Copyright (c) 2010, Yahoo! Inc. All rights reserved..Code licensed under the BSD License:.http://developer.yahoo.com/yui/license.html.version: 3.4.0.build: nightly./.YUI.add("base-build",function(f){var c=f.Base,a=f.Lang,b="initializer",d="destructor",e;c._build=function(B,p,z,s,t,o){var u=c._build,x=u._ctor(p,o),q=u._cfg(p,o),h=u._mixCust,m=q.aggregates,g=q.custom,k=x._yuibuild.dynamic,w,v,A,j,n,y,r;if(k&&m){for(w=0,v=m.length;w<v;++w){A=m[w];if(p.hasOwnProperty(A)){x[A]=a.isArray(p[A])?[]:{};}}}for(w=0,v=z.length;w<v;w++){j=z[w];n=j.prototype;y=n[b];r=n[d];delete n[b];delete n[d];f.mix(x,j,true,null,1);h(x,j,m,g);if(y){n[b]=y;}if(r){n[d]=r;}x._yuibuild.exts.push(j);}if(s){f.mix(x.prototype,s,true);}if(t){f.mix(x,u._clean(t,m,g),true);h(x,t,m,g);}x.prototype.hasImpl=u._impl;if(k){x.NAME=B;x.prototype.constructor=x;}return x;};e=c._build;f.mix(e,{_mixCust:function(i,h,l,k){if(l){f.aggregate(i,h,true,l);}if(k){for(var g in k){if(k.hasOwnProperty(g)){k[g](g,i,h);}}}},_tmpl:function(g

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\common[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	135559
Entropy (8bit):	5.025689867882655
Encrypted:	false
SSDEEP:	3072:GUG8MP1P0PM5EY4CWuUS97KBOv+AnqxXzC:Gr8eHhKBa+AazC
MD5:	188C258B492825B3BCD754B5F20AFAEA
SHA1:	1767DF958E74A5138A6B73CE0524E9599129B4CC
SHA-256:	067167A8D5B836DB9ACA44194F8410A50F47183939A1C9410C1D956F3B218151
SHA-512:	5FB0CC8D8040B3236BD6C04C6BF1151CD465F20F0F51ECB23431A8279BA619E90BDA9E2375341F65E62DB8C04C57D646820EB975255F53479C699A6637F88E38
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/css/common.css?14
Preview:	/* UOS Version: 2.2 - 2009-10-23 /. ./***************************************************************************/./ Common./****************************************************************************/....clear:after {content: ".";display: block;height: 0;clear: both;visibility: hidden;} .clear {display: inline-block;} / Hides from IE-mac \/ html .clear {height: 1%;} .clear {display: block;} /* End hide from IE-mac / ...firstline{margin-top:0;}..lastline{margin-bottom:0;}..divider-dash{background: url(../images/layout/divider-dash.gif) left repeat-x;margin:0 0 12px 0;font-size:1px;line-height:1px;height:1px;clear:both;}..divider-gradient{background: url(../images/layout/divider-gradient.gif) left repeat-x;margin:0 0 12px 0;font-size:1px;line-height:1px;height:17px;clear:both;}.img.icon{vertical-align:middle;}..ul.noindent{margin-left:0}.ol.noindent{margin-left:20px;margin-left:23px}.ul.bullets-arrow{}.ul.bullets-arrow li{background: url(../images/layout/bullet-link.gif) 0 .

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 778 x 450, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	23884
Entropy (8bit):	7.827898660558111
Encrypted:	false
SSDEEP:	384:W8eq4O5zcn3MKqaa8TUqDVPrOpKjAkxc1xJbfItECW0orJPtSM2/9c/DMt3pYCh2:Uq4O52cmU0PsRkoLzkW0RM2XtZYCE3
MD5:	5E430EB7E61CA7F5370567A6CE0657EE
SHA1:	5F6CA2C8FA680511E0CE7D6BE057A8B5198B813E
SHA-256:	B491D3EC5DF5B239CC4B3EA4E651242179BCAF5479ACC846E33CF60CD2B64C2A
SHA-512:	0B070AD38907746DADE9EB78B81504D207E5C48A0D05DEB0D2D59E6C37A3C25B54853757CD107BBFFDA6FE1BCA275F264232C0540A0B4F6A633A11E1351A3710
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2791671/content
Preview:	.PNG........IHDR.............O.>.....sRGB.........gAMA......a...\.IDATx^.........gw%.}.6..i.c:..z'...J.......R!.....!=...k(...i..S.)......Tv.....w+..t.t.}?..;{.u.j.;3.8.&......+p....................................................................................................................................................................................................................................................................................................................................................................................}.....ht.~.X[...k.3tMq.....7_N.....P}I!g..B.........>..p....Q..`.`TM.E....6Z.....D...I...Y9...e".+._.K%\...-..w..sm..D.8CVS?...Q..W..G...+.\....\|..Y.X...3_..>...E...?....A.hp..1..xc..g..D..N/....T.t.,....[.I......6.5?.o.-..iKqV......$x.y.sQ_._2..=.i.W.\.{.[g+....m....T.7..'xwZ1\.@.!(..Hup.q........mO./\8WuL..`.3....:...3g.1.m..x...2.......?!.i.H....$.qV.+)..q..$.e... ..;....0..(........8.6.gV.w.......!(..d...p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[2].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 778 x 450, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	40185
Entropy (8bit):	7.8903404230765695
Encrypted:	false
SSDEEP:	768:8Zm2BhTFWvHClivolTm6hjjRWtTZduNyBKK7WNoOva777777SZlmeg2gwLAf:8/7xWvxv8Tm8j1omcKsSKeg2ZK
MD5:	85A6F0792364E6DF1BB1D58735916497
SHA1:	D6FF52FF34B39B86BAE3A3F2E1710FFB25A38412
SHA-256:	3727B422D1A84BDE11C4AB34EA2F5964E5908E9E75F07256B699547B916AD5DA
SHA-512:	179050C9944388205D010BC34BE618E1FC969492E7599FFD63A7EB11EFE2BDB7334C296D9CA205407FCC67A3EF48BF86BBCE0E21AAD363FCB05187031CFAC088
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2729930/content
Preview:	.PNG........IHDR.............O.>... .IDATx^....U...tI...............]...HwKIw...4."..t...u\|o....={..9.......v...g.c.w2t(..` .. .. .. .. .. ...;..x.@..@..@..@..@.....P.3.. .. .. .. .. ........................<. .. .. .. .. ....`G.=#................#...wS................{...........................r...@..@..@..@.....Pp..%@..@..@..@..@...@(..c. .. .. .. .. .....{F(.. .. .. .. ..~G.B.................... ..3B...............;...~7..0..............'.....J.................P.).A..@..@..@..@.=.....P..@..@..@..@........M9... .. .. .. ....@(.g.. .. .. .. .. .w. ..n.1`.............pO.B.=#................#...wS................{...........................r...@..@..@..@.....Pp..%@..@..@..@..@...@(..c. .. .. .. .. .....{F(.. .. .. .. ..~G.B.................... ..3B...............;...~7..0..............'.....J.................P.).A..@..@..@..@.=.....P..@..@..@..@........M9... .. .. .. ....@(.g.. .. .. .. .. .w. ..n.1`.............pO.B.=#................#...wS................{................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[3].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 3823 x 2060, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7777381
Entropy (8bit):	7.948495164862623
Encrypted:	false
SSDEEP:	196608:E06X9sCEurkPsY2Cey6FqMd9P/w0cAIMXFQlX65Knnt88UGsAmAwuP:KtGumGCz6YKwnAIMk65c3sASI
MD5:	15D9DB9D6CF1E7FCBAC070FAAE134DCD
SHA1:	44AD5871093039CBFA3EECFB21AC431CCB82BEE0
SHA-256:	44B54635E1468037177CB243BC7932396010CE4A6EC70C121BDE376BC7135175
SHA-512:	059154F29981AB2AB3F0A77566811A3035073A1A5980E9402D03C7F193166964E8F2EDA50B1BD4C7FBE85A2D591A4F1691CFD57E520F32C3DFD724BE96637D3D
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2708619/content
Preview:	.PNG........IHDR..............9......sRGB.........gAMA......a.....IDATx^..k.,=.....{..........s...c..A...v.r"....l.>.0...^)..i..\.]U.z.O[..U.K]........}.J\|~~..._o...~......-..1..>>>nr.lS.5..ck0:.Muk,....g.j..K...&._..7h...(.......9?=..~.!O......\|m..b.n..u..Km.r......};.#._.-....Vig.........k.C.........c..S..........ZP..........~.o......,.[..=9...uV.w..kT?.8...9n.7.?..c....~}.ck....2........t..;]...-;v.. .`]..QF,.n....^<o.p...%....b...75.I....xha.5..XF.-.v..q,..I.#.....{#u.v\|.V....'......P.>..>.6.....o.....R.5.?y.X[l[......>J..'......W..z.)G.?....\.X..Q.....t..(..W..#..5ez...v...-...}......m..;.....c..'...5...I.J<....*']......z..y......C..A}J.8....>..."L.......ew.q.J..m..$..w....[..O..G.....\.......Q....q\|...~Et.F.6..x.S..+.[.......g.\|....$r7......1Z:..;...?........$.....d7..K+....}4^..L..5?.N.?.....~Fy.........NZ./..?...4r.Q.<F......;9.....{}.D..=...,.<."..y}R...~....N........j..1T.m.....5....T..r........I.y...P....:~A=........Z.J..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[4].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 778 x 450, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	29353
Entropy (8bit):	7.818047225106357
Encrypted:	false
SSDEEP:	768:diY06CtTw1wdmfZWpx4GrXC13V/3jjjoN:MH66U1ZfapG5Z3jjja
MD5:	5EE9D8D3DE602AAFE8DC14F4F617DEB2
SHA1:	9ADB8D2F4699975939AEC4FF716A85937C72D3E9
SHA-256:	0922E90B9445924188D35DAB637C9A57D7956A9DB1121C3EC463A364DD2B256B
SHA-512:	9BF95E144131FAC26396C8CB4270B4BC98C54CE950C6CA884F2FAF1F91FE9B6C582C3D2684ED3D80958EFF71E55DE11D90942AF31AF307FD17AA98FC10EA52F2
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2712724/content
Preview:	.PNG........IHDR.............O.>... .IDATx^..x.....@.$.@....$.AAAA. ..... X(.W.."X..XA...`.E...".w.........~$..f.9.......^k.wM&.....g...................@..a....H..H..H..H..H.....P.5A.$@.$@.$@.$@.$.D.B....................... .. .. .. .. ....E.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3#. .. .. .. .. ....P.].9`. .. .. .. ...L.B.3

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[5].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 777 x 515, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	33080
Entropy (8bit):	7.804928865001749
Encrypted:	false
SSDEEP:	768:1Zm2qVfwLw1uC4wxxwvpcf9dcwr2M0QbEyixMKnIW5hOwvchAHQ:1Zb+jrv2M0QEJZIWhvchX
MD5:	82F8C49BB3B8914CE0A7E5FB0A4C08F2
SHA1:	062386D395D4564EB9B4ADAC29C7F766651BF3F7
SHA-256:	7F5F0E9429A2997016CA09781E2C2AA5E964CF1011A4D91883A697A8B09E7FB8
SHA-512:	A36EE35A19DD622B669B60623E8EB93DE4612DCF2E9BCDB206F71E57AFF404EE0CAFECF703418B06AAD2E58DB2F51799E8C9A992819C72E1B97A1355509DBD7A
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2711865/content
Preview:	.PNG........IHDR.............OwR^.. .IDATx^....E../.,i..s.9.s......b....W..3....Tr.9#Yr.%.%..?.q..3;.]==.3...t.W...vU.Jvw..w.D.$@.$@.$@.$@.$@...HF...@.$@.$@.$@.$@.$...E.................@<.....$@.$@.$@.$@.$@.....$@.$@.$@.$@.$@...p%....H..H..H..H..H.+...$@.$@.$@.$@.$@.\I.. .. .. .. .. ...I..t.b6. .. .. .. .........i...H..H..H..H..t..H....H..H..H..H..H T.P$....O. .. .. .. ...I."A'(f#.. .. .. .. .P!@...f?I..H..H..H..H@'........H..H..H..H..B..EB.x..$.. .. .. .. ...(.t.b6. .. .. .. .........i...H..H..H..H..t..H....H..H..H..H..H T.P$....O. .. .. .. ...I."A'(f#.. .. .. .. .P!@...f?I..H..H..H..H@'........H..H..H..H..B..EB.x..$.. .. .. .. ...(.t.b6. .. .. .. .........i...H..H..H..H..t..H....H..H..H..H..H T.P$....O. .. .. .. ...I."A'(f#.. .. .. .. .P!@...f?I..H..H..H..H@'........H..H..H..H..B..EB.x..$.. .. .. .. ...(.t.b6. .. .. .. .........i...H..H..H..H..t..H....H..H..H..H..H T.P$....O. .. .. .. ...I."A'(f#.. .. .. .. .P!@...f?I..H..H..H..H@'........H..H..H..H..B..EB.x..$.. .. .. .. ..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\content[6].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 772 x 514, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	22336
Entropy (8bit):	7.775298719093273
Encrypted:	false
SSDEEP:	384:RnR0VZcMIYz1cYzbTtOa7Mlj5ui9XDpfIUxxUO2y0hhLBPv+68zoByCuBtckpP:RCVZcMI61BHxtouKlO5y07BX8m8mkd
MD5:	3CA2F020014141666A926175DDB63566
SHA1:	669D6E85319F0A1ABE9E09F6AE62E0F33D9DAD41
SHA-256:	AFD2E344DD1AC6AB97D4A847D56E48F9EFA970E779651B28A64AEAA94FCC5221
SHA-512:	2996F7195EAEC6D32D4FF4901BA2DC8791E454F5809AC3ED09569C4262F748C59EAA9E186E521609357A7DAED291629F45E0783AEF5B3D06D3414653F7EFA9B1
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2654331/content
Preview:	.PNG........IHDR.............q..K....sRGB.........gAMA......a...V.IDATx^....S.....]z. K.E..(.YPA,`.^.P.+.z.....k...M..-U...Dz.&......lI.I6...<O.=..K.-g~gf.....o.....p...#....."......F ....\.@...........p1......b.....................#......F ....\.@...........p1......b.....................#......F ....\.@...........p1......b.....................#......F ....\.@...........p1......b.....................#......F ....\.@...........p1......b.........................o.9...1...r..yiX......soR...G.~...7......X../+).u.`...C.e.].t...{.....%.EK.ve.J...Q)M..[.....*Q4.T)._.V/$...1.....2.{kK...L+uSf......PN:.)m.g..g..[d..#.e.1).y.kT..:...M..-[6...z_.._....W.R...\|7u.l.zT..?).....U.....vlA.(......j.A.7...xCsoR..d.....UO...2.I...C..<.r......6..@.!...K.u.....J.....w[.{..>F.z......u..s.%g.q....e..F./....t.<...._;.....+C.H.j);....V.}i.i..c.R..R...MM.....:K...M+uu.L....Y....6..u..... .^...K..$F..YSn.....t.:...c9....u.~...f.\|8./9{...K...kI;O..W.;f...;.X..w.5....Q.:...>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\cookie[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	4197
Entropy (8bit):	5.210054852170935
Encrypted:	false
SSDEEP:	96:25QDGHj6gQy/Ji+KH1b6Tx95r2gltp25rs7:25Q06hyBjKH1b6Tx9d2C2he
MD5:	8F8885EA39B91371B67489881E2CFA69
SHA1:	8B7A3D3317420929703CCA7FED900CF2C85B8AD0
SHA-256:	10571CEA5731CDDFE7D9E3517B771D62F57465F400C5BC913A3AFDF3110DCD44
SHA-512:	B813909559BEF44F30902FC2D72A2BA70A49C30F43092FFF747175AC94D63F4D8B02152D97EA59CF2D6E1000790D64A13F5BAE90DFD28FCA34CB6FACB2CAF42A
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/cookie.js?14
Preview:	function rbcSetCookie(pName,pValue,pExpires,pPath,pDomain,pSecure,pSamesite)..{.. if (pName).. {.. var vName = pName+"="+pValue;.. var vExpires = (pExpires) ? "; expires=" + pExpires : "";.. var vPath = (pPath) ? "; path=" + pPath : "; path=\/";.. var vDomain = (pDomain) ? "; domain=" + pDomain : "";.. var vSecure = "";.. var vSamesite = "";.. var vTempCookie = "";.. //console.log("UserAgent = " + window.navigator.userAgent);.. var NotSetSameSiteReturned = EdsShouldntGetSameSiteNoneFull(window.navigator.userAgent);.. //console.log("NotSetSameSiteReturned = " + NotSetSameSiteReturned);.. if (!NotSetSameSiteReturned).. {.. vSamesite = (pSamesite) ? "; SameSite=" + pSamesite : "; SameSite=None";.. //console.log("Secure = " + window.location.protocol);.. vSecure = (pSecure) ? "; Secure" : (window.location.protocol == 'https:') ? "; Secure" : "";.. }.. vTempCookie = vName+vExpires+vPath+vDomain+vSamesite+vSecure;.. //console.log("rbcSetCookie = " + vTempCookie);.. docu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\custom[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	8380
Entropy (8bit):	5.218981516461072
Encrypted:	false
SSDEEP:	96:zIZvA1D9iqflV4lWWoQjMOGDFXTwL/4ArQgigwFo1QjM2GDFWyL/4APQgigwXCTv:4vA1D9nf4FcDFXTwsASS5DFWysAGSGg/
MD5:	CC3A40ED99B4A28082A35F7BD0D1CF8F
SHA1:	71626BBA2CA23000DE85723CA1A82E14A4F28220
SHA-256:	8104C2D5971C2B41DCB1C0DE246AC31CB5413B179AC98C03552919F44EA401CC
SHA-512:	2F8A90F25AB470C3A1BEA7BF09A05041B2B92E85129621CA84DB40F563A4FB30A8F54124448BEEAAEA3BC0D39361586A77A472637F699D360020927D6555BD86
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/custom.js?14
Preview:	/********************************************.. Expand/Collapse Drop-Down Overlay Content .. ********************************************/....var dropDownOverlay_active = {content: '', opener: '' , position: -1};....function dropDownOverlay_findPosX(obj) ..{...var curleft = 0;...if (obj.offsetParent) ...{....while (obj.offsetParent) ....{.....curleft += obj.offsetLeft;.....obj = obj.offsetParent;....}...}...else if (obj.x)...{....curleft += obj.x;...}...return curleft;..}....function dropDownOverlay_findPosY(obj) ..{...var curtop = 0;...if (obj.offsetParent) ...{....while (obj.offsetParent) ....{.....curtop += obj.offsetTop;.....obj = obj.offsetParent;....}...}...else if (obj.y)...{....curtop += obj.y;...}...return curtop;..}....function dropDownOverlay_position( content, opener )..{...// need to fixate default size (MSIE problem)...content.style.width = content.offsetWidth + 'px';...content.style.height = content.offsetHeight + 'px';.......// if tooltip is too wide, shift left to

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\diff_match_patch[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	C source, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	19184
Entropy (8bit):	5.374506752111679
Encrypted:	false
SSDEEP:	384:md5pGS/hjclWY3NyG4ksNJPi37ulD7q15Yl4:mO3N94Xf607q1M4
MD5:	EAFE7B4F544D86AE86C64B29B0372950
SHA1:	E57E673C2B17FC7F2E1D1F828503F9697E794D7C
SHA-256:	4782C6158E19090ED8CE8D460406823F854369D82F61AE010D8494B41EF8CAAD
SHA-512:	20D6E2C6939D5E3B1028451053AC2AB7B71CCFFA9D40714C9C06D1C7A42555CF15C99A4FC5B1E3C74DAF667330C72D7D5082D6BD93547C9297E36B83D8A6DD78
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-web/libs/html-diff/diff_match_patch.js
Preview:	(function(){function diff_match_patch(){this.Diff_Timeout=1;this.Diff_EditCost=4;this.Match_Threshold=0.5;this.Match_Distance=1E3;this.Patch_DeleteThreshold=0.5;this.Patch_Margin=4;this.Match_MaxBits=32}.diff_match_patch.prototype.diff_main=function(a,b,c,d){"undefined"==typeof d&&(d=0>=this.Diff_Timeout?Number.MAX_VALUE:(new Date).getTime()+1E3*this.Diff_Timeout);if(null==a\|\|null==b)throw Error("Null input. (diff_main)");if(a==b)return a?[[0,a]]:[];"undefined"==typeof c&&(c=!0);var e=c,f=this.diff_commonPrefix(a,b);c=a.substring(0,f);a=a.substring(f);b=b.substring(f);var f=this.diff_commonSuffix(a,b),g=a.substring(a.length-f);a=a.substring(0,a.length-f);b=b.substring(0,b.length-f);a=this.diff_compute_(a,.b,e,d);c&&a.unshift([0,c]);g&&a.push([0,g]);this.diff_cleanupMerge(a);return a};.diff_match_patch.prototype.diff_compute_=function(a,b,c,d){if(!a)return[[1,b]];if(!b)return[[-1,a]];var e=a.length>b.length?a:b,f=a.length>b.length?b:a,g=e.indexOf(f);return-1!=g?(c=[[1,e.substring(0,g)],

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\ds-secure[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 300 x 66, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	7295
Entropy (8bit):	7.918641865834061
Encrypted:	false
SSDEEP:	192:xTsG1NBRc6Mcjk95alKlCi5Py9wiVNoRdQJ7:x4WJa9ow0i5sf
MD5:	7AFD7C0EAFBD1C9A3BB2E08C921141EB
SHA1:	E671FD7206F04F8CE032D2CC96D689107B34B666
SHA-256:	9A48BAE0722AB5F90AC86826DD097A47CC009E5D8962D140FDE24A43BCC4E2E2
SHA-512:	1CCB9D04E752572B945C8A5B5385918BD722DE3723CDF95B0CDEB94F2511F0DCF9B606A1114CFB9B736F94F2FD09390E3D41708BFBD046ED535627DF65887D21
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmassets/images/brand/ds-secure.png
Preview:	.PNG........IHDR...,...B.............tEXtSoftware.Adobe ImageReadyq.e<...$iTXtXML:com.adobe.xmp.....<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="Adobe XMP Core 5.3-c011 66.145661, 2012/02/06-14:56:27 "> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" xmp:CreatorTool="Adobe Photoshop CS6 (Macintosh)" xmpMM:InstanceID="xmp.iid:65A90C79EF8311E5A935D93122495D4C" xmpMM:DocumentID="xmp.did:65A90C7AEF8311E5A935D93122495D4C"> <xmpMM:DerivedFrom stRef:instanceID="xmp.iid:65A90C77EF8311E5A935D93122495D4C" stRef:documentID="xmp.did:65A90C78EF8311E5A935D93122495D4C"/> </rdf:Description> </rdf:RDF> </x:xmpmeta> <?xpacket end="r"?>k./*....IDATx..]..U..wf.A............Dd............]4.<D.b...1..i....... ... D."...Yd....[..>..s......;...>..Ouu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\englishBlue[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	16892
Entropy (8bit):	4.334792444361544
Encrypted:	false
SSDEEP:	384:Wn8qNVws++z10WDHBy6b5uijIJLj2AGeUrOK+:tqNVl1pYmYfV/UC7
MD5:	4114624B8FCB81CA666047E55B1936B6
SHA1:	257141ABCCC6247255D1D5906DDC641E9928F17C
SHA-256:	202C07366F2F8ECEA87BFCC88B0DC372D3DC306265D88B29E421CD1C0829DD07
SHA-512:	97B4A8BFB89BB5CC37D2793CE59DF21C65DC8E552C2EFC10AAAECDB637B8668FE3086FC4971335B53CCB100BAFC532EC9A3A054FFDC5308B1CF88B1F52527337
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/images/englishBlue.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 23.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="One_line_x2C__cmyk_x2C__positive".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 208.4882 73.2756".. style="enable-background:new 0 0 208.4882 73.2756;" xml:space="preserve">.<style type="text/css">...st0{fill:#0051A5;}...st1{fill:#FEDF01;}...st2{fill:#FFFFFF;}.</style>.<g id="Layer_2_2_">..<g>...<g>....<g>.....<g>......<g>.......<g>........<path class="st0" d="M55.4507,63.8738c0,2.3854-0.9781,3.7683-2.8868,4.5023c-7.4162,2.8605-16.1999,4.335-24.5554,4.335.........c-8.3545,0-17.138-1.4745-24.5564-4.335c-1.9078-0.734-2.8859-2.1169-2.8859-4.5023V0.5644h54.8845V63.8738z"/>........<g>.........<g>..........<path class="st1" d="M15.2854,39.145c-7.5972-4.7429-10.1085-6.8441-10.3211-9.9551...........c-0.0357-0.633,0.1073-1.6983,0.3724-2.4599l-0.7161-0.4753c-0.5742,0.9119-0.9372,

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\englishWhite[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	17598
Entropy (8bit):	4.335879935512141
Encrypted:	false
SSDEEP:	384:WvJXcmSR6wLDTn8yrm68EpijIOmtY5Us5:C9SjUyp0m6Z5
MD5:	B511396398BD3F229C649B5F30412799
SHA1:	32017FB0E13D880D3ACC3CBB7499B4BC92411E60
SHA-256:	D792EDCFA083C46F8345DA37CABBC4B938DC22588E1AA8ED0607DEAD6F22338E
SHA-512:	CE941222149B5033B92988B8DB1736CD9E5BA02C65BA7B91A1AB46F3C981DC3AE0F0B8ACE6951EDB435E64359B8ADB535731CCDAF586A8BCF81B222AD4DD905F
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/images/englishWhite.svg
Preview:	<?xml version="1.0" encoding="utf-8"?>. Generator: Adobe Illustrator 23.0.1, SVG Export Plug-In . SVG Version: 6.00 Build 0) -->.<svg version="1.1" id="One_line_x2C__cmyk_x2C__positive".. xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink" x="0px" y="0px" viewBox="0 0 210.0472 76.2803".. style="enable-background:new 0 0 210.0472 76.2803;" xml:space="preserve">.<style type="text/css">...st0{fill:#FFFFFF;}...st1{fill:#0051A5;}...st2{fill:#FEDF01;}.</style>.<g>..<g>...<path class="st0" d="M64.1223,73.1376c-1.8741,0-3.4138-1.5113-3.4138-3.4295c0-1.9089,1.5397-3.4306,3.4138-3.4306....c1.8697,0,3.4095,1.5217,3.4095,3.4306C67.5318,71.6263,65.992,73.1376,64.1223,73.1376z M64.1223,66.959....c-1.4618,0-2.6292,1.2188-2.6292,2.7491c0,1.5322,1.1674,2.7659,2.6292,2.7659c1.4555,0,2.6376-1.2337,2.6376-2.7659....C66.7599,68.1778,65.5778,66.959,64.1223,66.959z M64.3514,67.7626c0.6837,0,1.1338,0.451,1.1338,1.123....c0,0.5828-0.387,1.0538-0.8561,1.0622c0.0695,0.0631,0.1094,0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\event[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1197
Entropy (8bit):	4.984901796153209
Encrypted:	false
SSDEEP:	24:lgjpxynrNR52qU7aik2MTJ62gxGkWbl1SltrEIl8YTzXxzIZz4zL/zBV7zczE/zO:oypQFrMTJ62xNnS/VySXZIxIL7nHcE7O
MD5:	61CA2CB9752DBDA37CD6F0CDCFD29BE2
SHA1:	49256F4CBB51A3A50E90B37EE708DA1B036D6AD2
SHA-256:	5F07D979666D2F34A80843089EE665CC6A0E559606B2D73260704BD4E9ED91A2
SHA-512:	A8FE94036DCCA14F8D6BDE3D19269D0E36522B548FCF81E0F175011762A1187C9AF928D9D6DF5B70A1993B76BF188B9DD7F952775FBE77ECFCAC5BFD5896D19F
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/dom/event.js
Preview:	..event_CaptureEvents(); //Turn on when event_ActivateEvents() is used!....function event_fix(e, eNew)..{.. eNew.type = e.type;.. eNew.cursorX = e.pageX;.. eNew.cursorY = e.pageY;.. eNew.objectX = e.target.width;.. eNew.objectY = e.target.height;.. eNew.clientX = e.width;.. eNew.clientY = e.height;.. eNew.keyCode = e.which;.. eNew.button = e.which;.. eNew.modKey = e.modifiers;.. eNew.offsetX = e.x;.. eNew.offsetY = e.y;.. eNew.screenX = e.screenX;.. eNew.screenY = e.screenY;.. eNew.scrollX = 0;.. eNew.scrollY = 0;.. eNew.id = null;.. if (e.target.name).. eNew.id = e.target.name;..}....function event_CaptureEvents()..{....if (event_ListenersDone)..;..else..if (window.opener && window.opener.event_ListenersDone)..; //Do not add listeners for child because parent has them (dom only)..else.. {.. event_ListenersDone = true;.. document.captureEvents(Event.KEYDOWN);.. document.captureEvents(Event.KEYPRESS);.. document.captureEvents(Event.KEYUP);.. document.captureEvents(Event.MOUSE

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\external-link-small[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	2481
Entropy (8bit):	4.780313938954274
Encrypted:	false
SSDEEP:	48:cInVEKJTv97lzUoHg2RN4ByoQ91818+zEOhrTAJ:vEKJ5lzUoHp1BB+IAru
MD5:	A0793B972803B08736005A7616EA0994
SHA1:	DB626FCE668D8D499990FC42A375039E97B9C739
SHA-256:	776C50DABBCF9967AEF068D7FFA38E199A2B9A7E87697750A22EA70344072F32
SHA-512:	2FB529D1D353DACB229F24E38756309E1FD0705319D27F560A094B974D63C5AC0B9F74A7283AEE2272342E955F9A6CD9F887078BBF1BD22927382A01FFD8DEFA
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/icons/external-link-small.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<svg width="16px" height="16px" viewBox="0 0 16 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. Generator: Sketch 52.2 (67145) - http://www.bohemiancoding.com/sketch -->.. <title>icons/external-link/small</title>.. <desc>Created with Sketch.</desc>.. <defs>.. <polygon id="path-1" points="0 7.9999 0 0 16 0 16 7.9999 16 15.9998 0 15.9998 0 7.9999"></polygon>.. <path d="M15.5,9.5 C15.224,9.5 15,9.724 15,10 L15,15 L1,15 L1,1 L6,1 C6.276,1 6.5,0.776 6.5,0.5 C6.5,0.224 6.276,0 6,0 L1,0 C0.448,0 0,0.448 0,1 L0,15 C0,15.553 0.448,16 1,16 L15,16 C15.553,16 16,15.553 16,15 L16,10 C16,9.724 15.776,9.5 15.5,9.5 M10.0732,1 L14.2932,1 L3.7442,11.55 C3.5452,11.742 3.5402,12.059 3.7322,12.257 C3.9232,12.456 4.2402,12.461 4.4382,12.27 C4.4432,12.266 4.4472,12.261 4.4512,12.257 L15.0002,1.707 L15.0002,5.927 C15.0002,6.203 15.2232,6.427 15.5002,6.427 C15.7762,6.427 16.0002,6.203 16.00

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\forest-by-river-with-sunny-blue-sky[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2019 (Macintosh), datetime=2020:01:22 12:56:51], baseline, precision 8, 1680x810, frames 3
Category:	downloaded
Size (bytes):	673047
Entropy (8bit):	7.935772397926938
Encrypted:	false
SSDEEP:	12288:KxiDIABA3Kpn9h0r8QE9pq6ib3nbfBnY7Ep9nIeJWH6qStF+bdKx8g+19kbo:KxEFM2Pzpq6iDbfBhrJWaqSj+bQxLc
MD5:	6072228336B7000A871089743A9AFD17
SHA1:	5AEB129CCEED0DC06C59843D642F33F759D6B498
SHA-256:	B441A0086FC651FE0C5E56EA087071E91385F3A651DD92AC61C8D8822084BFA8
SHA-512:	F6E743C42158DC12797A1826E90E8C024FB1C5A302A2CD9FC50CBF23057ADC2CA57F4D92C5923B7AEE2F3968AD92BB1CB9DB3D61E532B897AC62626ACD6AA3F8
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/static/img/general/banner/forest-by-river-with-sunny-blue-sky.jpg
Preview:	......Exif..MM..............................b...........j.(...........1.....$...r.2...........i....................'.......'.Adobe Photoshop CC 2019 (Macintosh).2020:01:22 12:56:51.......................................................................&.............(.....................6...........^.......H.......H..........Adobe_CM......Adobe.d.................................................................................................................................................M...."................?..........................................................................3......!.1.AQa."q.2.....B#$.R.b34r..C.%.S...cs5....&D.TdE.t6..U.e...u..F'...............Vfv........7GWgw........................5.....!1..AQaq"..2.....B#.R..3$b.r..CS.cs4.%......&5..D.T..dEU6te....u..F...............Vfv........'7GWgw.................?.. !J...)I$.JRI.IK$.$..$.JXm.Qs.A....JJk..Gm.....#..p...R..D..N.......n..f;..;u.5ZVl.. ....$..8.9@9...g...r..K].....k%T.....>A8....z..sl.v.!.s...U

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\global[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode text, with very long lines
Category:	downloaded
Size (bytes):	14258
Entropy (8bit):	5.3497225158702255
Encrypted:	false
SSDEEP:	192:4ndz0smQxmTjH3WdZRZntMAb7pEIHtlomlLS7wEtWA9k8eCyV+LC3icBjF+QIZAd:4nh7jBIwEDG6cicBp+Ed
MD5:	1B5DFB931704FDABD4D93BEC129E14EB
SHA1:	7BCF0882FD27E436E0E01C68021DE52ED7D314D5
SHA-256:	837830BE2C2B5FF1F91698087463083489652538679DACAD7C521E39D831C086
SHA-512:	12373B836EF0BF1734205B3D941F69EC2B3AF9520CF6E9981F8763A1B77D8D26BB5D7E6810B9645C61B1C698D09E139CE91AD34AE016468BE18BE138BD28FC29
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/global.js
Preview:	/####################################/./******** BROWSER FIXES **********/./####################################*/..if (!window.console) console = {log: function() {}}; //IE fix..if (!$.support.transition) $.fn.transition = $.fn.animate; // Transit fix..if (typeof Array.prototype.forEach != 'function') { // forEach fix for IE8. Array.prototype.forEach = function(callback){. for (var i = 0; i < this.length; i++){. callback.apply(this, [this[i], i, this]);. }. };.}..$(document).ready(function(){. if (navigator.appVersion.indexOf("MSIE 9") != -1) {. $('body').addClass('ie9');. }. if (detectIE() !== false) {. $('body').addClass('ie');. }. function detectIE() {. var ua = window.navigator.userAgent;.. // Test values; Uncomment to check result ... // IE 10. // ua = 'Mozilla/5.0 (compatible; MSIE 10.0; Windows NT 6.2; Trident/6.0)';. . // IE 11. // ua = 'Mozilla/5.0 (Windows NT 6.3; Trident/7.0; rv:11.0) like Gecko';. . //

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\home[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	73675
Entropy (8bit):	5.582998063554458
Encrypted:	false
SSDEEP:	1536:8BW6DBxnEaLbsdH6xhL0rpE9tuM72vBvZrl99E60QhQCQPQdQZQJ:8BbxE6bssfD2DE60QhQCQPQdQZQJ
MD5:	D4B9F8AC30FABFD036208E494AAEBDB5
SHA1:	03E56CCDA4CC12191005E1DEC9CFC9532D0A0F16
SHA-256:	9F9D388310471B132CBDE1E99D7DC41396AD44340746F9C688AED8CB14EE43C3
SHA-512:	036ECC928487B2A2B4EA29C81508677F7CBD7FA4BD89826F1015271E3BAAFEBCE421B86118989C01EE164313B2FBA7FB38E1B04D337FB1DC7B37CAEADB8E56D2
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/jim.seyers/home
Preview:	<!DOCTYPE html> <html class="ltr" dir="ltr" lang="en-US"> <head> <meta property="themeVersionId" content="bcc785d034c0a812a3f1bc94a5bc9f87dfa7c01c1ed2c361d71bb94093ec45ce"> <meta name="keywords" content="#renderMetaKeywords"> <meta content='IE=edge' http-equiv='X-UA-Compatible'> <meta charset='utf-8'> <meta content='width=device-width, initial-scale=1 maximum-scale=1' name='viewport'> <meta property="og:title" content="Home"/> <meta property="og:site_name" content="The Seyers Group"/> <meta property="og:image" content="http://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/images/options/rbc_wealth_management_nova_scotia_cape_breton_cabot_trail.jpg"/> <meta property="og:description" content="We help you replace your current income in retirement to allow you to live life your way. The key to investing is time. The sooner you start, the greater your"/> <meta property="og:type" content="article"/> [if lt IE 9]> <script src="/da-epic-theme/themes/da-slate/_wmos/js/_ie.respond.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\info_48[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 47 x 48, 8-bit/color RGBA, non-interlaced
Category:	dropped
Size (bytes):	4113
Entropy (8bit):	7.9370830126943375
Encrypted:	false
SSDEEP:	96:WNTJL8szf79M8FUjE39KJoUUuJPnvmKacs6Uq7qDMj1XPL:WNrzFoQSJPnvzs6rL
MD5:	5565250FCC163AA3A79F0B746416CE69
SHA1:	B97CC66471FCDEE07D0EE36C7FB03F342C231F8F
SHA-256:	51129C6C98A82EA491F89857C31146ECEC14C4AF184517450A7A20C699C84859
SHA-512:	E60EA153B0FECE4D311769391D3B763B14B9A140105A36A13DAD23C2906735EAAB9092236DEB8C68EF078E8864D6E288BEF7EF1731C1E9F1AD9B0170B95AC134
Malicious:	false
Reputation:	low
Preview:	.PNG........IHDR.../...0.......#.....IDATx^...pUU..{....KB........!....F......jp.Q.......Vg.F..m.Q....{...,m.@.56D...&$d!.<..}....s..K9.....{............[./<..T..I.I..JR)).9.k.N.%.E.W^}....Po..............X..;.=.P......./...+...9./..s.....9..\|........7v.`..V.....-^.$S[[[......K..z......3..3....5 ...0.."/n/.c...&.{.ht..?....A..I{.n.....\|....t......N}..%.v...:.E..i....`....a.k.mg.LX..fcFU.fO-..YEfd.}...~."......}l$....^.re..'^X..}.?.^U.G..... .30...X......f[.l0.P`..KC...[..[..6....~..i..Q.\|;x..T ..........s.5...n+.0..;...H#.2..#.M..m[^3x&E.Ya..\K..{[..M..g...yf0..~....M.]7..ZZZ:..a.O.G64]....9..l[..a....N,,.h......5...f.y...}...BX{.G^...?.c.......s^..P.(..G...t.0.:.X.DCs.....]vf...py).........x..>-..Be.a...G...Y!...z...g.{....d.s.o.....%.x......R.W.....Z.b,....!..6Ub....U.qY(/v..m.a...4.`Qr\.E.G..a)..t..e.j.W........C<.1.....c..l1w....]3%....tR;.,..3..-.NW.5...t..H..h..D..b......M....)B..2J...)..o..m..M.t....wn./....+Wv....xkg....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\jquery.sidr.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	3676
Entropy (8bit):	5.2289388776388925
Encrypted:	false
SSDEEP:	48:ki4WUdNp8dhFRL5itWpd0YysXdgMViVIHwkrLB5+Hw8VCcUC7CFCEOEksRrY1fvh:kzPp8dNzdgIQgsQ84ceIKwNmyjZRl
MD5:	DECE5279BB6ABD803530375B77BFBD45
SHA1:	E6FB1923084C4F5D74E35DB2F6FC1044AD141556
SHA-256:	0D1BDA83F35A16B8FAC0F03A146923E93B04635FE9EDD5B98E14550427B305CA
SHA-512:	B77A42D79789FD0A2FD4F84392666F58269F29C180A45DBDCB1AD02DC05BBEFD2F705B78ACFEE238B3F44DBC36C7F8787E89789B66018BB70361C18B7C9D3EB3
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/js/jquery.sidr.min.js
Preview:	/! Sidr - v1.2.1 - 2013-11-06.. https://github.com/artberri/sidr.. * Copyright (c) 2013 Alberto Varela; Licensed MIT /..(function(e){var t=!1,i=!1,n={isUrl:function(e){var t=RegExp("^(https?:\\/\\/)?((([a-z\\d]([a-z\\d-][a-z\\d]))\\.)+[a-z]{2,}\|((\\d{1,3}\\.){3}\\d{1,3}))(\\:\\d+)?(\\/[-a-z\\d%_.~+])(\\?[;&a-z\\d%_.~+=-])?(\\#[-a-z\\d_]*)?$","i");return t.test(e)?!0:!1},loadContent:function(e,t){e.html(t)},addPrefix:function(e){var t=e.attr("id"),i=e.attr("class");"string"==typeof t&&""!==t&&e.attr("id",t.replace(/([A-Za-z0-9_.\-]+)/g,"sidr-id-$1")),"string"==typeof i&&""!==i&&"sidr-inner"!==i&&e.attr("class",i.replace(/([A-Za-z0-9_.\-]+)/g,"sidr-class-$1")),e.removeAttr("style")},execute:function(n,s,a){"function"==typeof s?(a=s,s="sidr"):s\|\|(s="sidr");var r,d,l,c=e("#"+s),u=e(c.data("body")),f=e("html"),p=c.outerWidth(!0),g=c.data("speed"),h=c.data("side"),m=c.data("displace"),v=c.data("onOpen"),y=c.data("onClose"),x="sidr"===s?"sidr-open":"sidr-open "+s+"-open";if("open"===

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\jquery.swiper[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	112743
Entropy (8bit):	4.488192924813936
Encrypted:	false
SSDEEP:	1536:REfoJmBLsZzJFGFOlFGFdApPfLN0Z1gwKlv//gKsy6DKn26:eBLINpPfcgwKlv//gl6
MD5:	56029C55ADD1EBA2A1ADD04892242BB0
SHA1:	CF92D19A26AF8B0DE4AB3C377CA23E0297A83F49
SHA-256:	764F4ADBA4DCBEAD8A46A84B4C5666DD72C1C73E351A80A8AF66DB2757F70DE7
SHA-512:	B63D0270A7C350977EC037233FD0702491BF122104600081185A2013671F880FD834D7764E66BF12218DFD1BF8DFD85E86E275883840761B93F9CA4C20C578E3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/jquery.swiper.js
Preview:	/.. Swiper 2.6.1.. * Mobile touch slider and framework with hardware accelerated transitions.. .. http://www.idangero.us/sliders/swiper/.. .. Copyright 2010-2014, Vladimir Kharlampidi.. * The iDangero.us.. * http://www.idangero.us/.. .. Licensed under GPL & MIT.. .. Released on: May 6, 2014../..var Swiper = function (selector, params) {.. 'use strict';.... /=========================.. A little bit dirty but required part for IE8 and old FF support.. ===========================*/.. if (document.body.__defineGetter__) {.. if (HTMLElement) {.. var element = HTMLElement.prototype;.. if (element.__defineGetter__) {.. element.__defineGetter__('outerHTML', function () { return new XMLSerializer().serializeToString(this); });.. }.. }.. }.... if (!window.getComputedStyle) {.. window.getComputedStyle = function (el, pseudo) {.. this.el = el;.. this.getPropertyValue

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\kelly_rivard[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	[TIFF image data, big-endian, direntries=7, orientation=upper-left, xresolution=98, yresolution=106, resolutionunit=2, software=Adobe Photoshop CC 2018 (Macintosh), datetime=2019:09:05 11:37:46], baseline, precision 8, 300x300, frames 3
Category:	downloaded
Size (bytes):	71926
Entropy (8bit):	7.852822737335156
Encrypted:	false
SSDEEP:	1536:47ana7KK+nsRUmhkFDNFnKBSusJoAmrs1qGKPcjK7QaSm1iNReETHrFPMO/yqXCK:Iana7KuiwBSucBmI1lKUVmh8rF0PK7H
MD5:	FB554601B194F0991D88AE76F43AA5DA
SHA1:	484AB055E3232D578FBDE93446FF153AFC27B4F2
SHA-256:	C7435AEA46B26980B009376E091A0BF49B6CDC16BB523132C808CB500214ED49
SHA-512:	5F9C544E71682F9FC8E4DD49613D84E21FBE29C6A1665B11F419D4A5B3393BE5450642C710CA28233D65014DC369BB598408132C5A9AC40B6DAF6D1058F529E1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/documents/images/kelly_rivard.jpg
Preview:	......JFIF..............Exif..MM.*.............................b...........j.(...........1.....$...r.2...........i..............................Adobe Photoshop CC 2018 (Macintosh).2019:09:05 11:37:46.........................,...........,....2019:09:05 11:21:37.....http://ns.adobe.com/xap/1.0/.<?xpacket begin="." id="W5M0MpCehiHzreSzNTczkc9d"?> <x:xmpmeta xmlns:x="adobe:ns:meta/" x:xmptk="XMP Core 5.4.0"> <rdf:RDF xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#"> <rdf:Description rdf:about="" xmlns:photoshop="http://ns.adobe.com/photoshop/1.0/" xmlns:xmp="http://ns.adobe.com/xap/1.0/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:xmpMM="http://ns.adobe.com/xap/1.0/mm/" xmlns:stEvt="http://ns.adobe.com/xap/1.0/sType/ResourceEvent#" xmlns:stRef="http://ns.adobe.com/xap/1.0/sType/ResourceRef#" photoshop:ICCProfile="Display" photoshop:ColorMode="3" xmp:MetadataDate="2019-09-05T11:37:46-04:00" xmp:CreateDate="2019-09-05T11:21:37-04:00" xmp:ModifyDate="2019-09-05T11:37:46-04:00"

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\keypress[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	704
Entropy (8bit):	4.011163180179082
Encrypted:	false
SSDEEP:	12:CpcxE4BdyblxRJuzUJfMs3E+Dv4MkQPwRwdniX/dLfrIzjy:CpcxpibnRQAh3E+Dm1q0/dLzIK
MD5:	AAD6FF5F5ED32AF02737303DAA022963
SHA1:	6A0A202FC9D8B8244E47BD40E853D370793AB70A
SHA-256:	AE30BCA576EA71969BA0412D414BBABB28705A9C60A694438CAA988AD40BDE93
SHA-512:	5BDEF58A15E8A120C1BA50F4922A679D348DF451EE3E9EF1E9E42ECE26D3AF4B569F20635FA980CD816754F455D8C6358C5835942FCA2E0F4A7DB8045632F837
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/javascript/keypress.js?14
Preview:	NumOnly=false;..EnterOn=false;..ie4 = (document.all)? true:false ..function keyPress(e) {..if (ie4) ..{.. var nKey=event.keyCode;..}..else..{.. var nKey=e.which;..}..if (EnterOn)..{.. if (nKey==13).. {.. if (!ie4).. {.. document.rbunxcgi.SignIn.click();.. return(false);.. }.. }..}..if (NumOnly).. {.. if (((nKey > 31) && (nKey < 48)) \|\| (nKey > 57)).. {.. return(false);.. }.. } ..} ..document.onkeypress = keyPress; ..if (!ie4) document.captureEvents(Event.KEYPRESS); ....

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\lock-small[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	1874
Entropy (8bit):	4.916603501116733
Encrypted:	false
SSDEEP:	24:2dznsRLIHrzJTv9XHCWf8roYIWvC6eaxMxeFbCVCfxqCAPxxUhbeDIEEHh6aTHg4:cTwErzJTv9yeS9hfEdeIEEOhrTA4
MD5:	05425F2C3EDBF046BE411E576EEA957E
SHA1:	07836159ADC932063290CC3AC95B77745492B8E5
SHA-256:	208BD303E33D60639DBEBDF5A93DB4F0FB2999BDA5C34BB8408679BBB8243197
SHA-512:	353F8E4EA0E42618B558BF2CDE080536FE88DA3B2440E5DA62E15DD2CF171196122CB3C02C067B3430528A6C9D25D9BE53357CF5AA1E4E0B04316AC2DA7A69BF
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/icons/lock-small.svg
Preview:	<?xml version="1.0" encoding="UTF-8"?>..<svg width="13px" height="16px" viewBox="0 0 13 16" version="1.1" xmlns="http://www.w3.org/2000/svg" xmlns:xlink="http://www.w3.org/1999/xlink">.. Generator: Sketch 52.2 (67145) - http://www.bohemiancoding.com/sketch -->.. <title>icons/lock/small</title>.. <desc>Created with Sketch.</desc>.. <defs>.. <polygon id="path-1" points="0 7.9999 0 0 16 0 16 7.9999 16 15.9998 0 15.9998 0 7.9999"></polygon>.. <path d="M3,15 L14,15 L14,8 L3,8 L3,15 Z M5.5,3.922 C5.5,2.311 6.846,1 8.5,1 C10.154,1 11.5,2.31 11.5,3.922 L11.5,7 L5.5,7 L5.5,3.922 Z M14,7 L12.5,7 L12.5,3.922 C12.5,1.756 10.71,0 8.5,0 C6.29,0 4.5,1.756 4.5,3.922 L4.5,7 L3,7 C2.448,7 2,7.448 2,8 L2,15 C2,15.553 2.448,16 3,16 L14,16 C14.553,16 15,15.553 15,15 L15,8 C15,7.448 14.553,7 14,7 Z" id="path-3"></path>.. </defs>.. <g id="Phases_1,2,3" stroke="none" stroke-width="1" fill="none" fill-rule="evenodd">.. <g id="V2.1A-Default" transform="translate(-482.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\logo_rbc-royalbank-white-en[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	5474
Entropy (8bit):	3.9172358792768645
Encrypted:	false
SSDEEP:	96:uBsbzrux9wCFwXxHfoSwLwvXKm2VOg/CtM9x9Imw1wLbrZg6O/Zg6OF:AsvruqSwhzOwim64tM9HImw1wLbr1O/E
MD5:	82ADDEB4458834BE1050A3AE7F0D5BE8
SHA1:	CBE76AD9CC0382FB195C639EA03A8BE24E0223B7
SHA-256:	4AD25CCA003756C56D16DBC0B68BC7BF4449A33AEB046EB4D0552990A2CFDB9A
SHA-512:	D0C2C7868C06C2A6989D4EDE9493D771E878C58CA1C0D88C3C68F246D55DA6CA26FD80DDC981573D17674D1353A13BF036B9F29FB8BA554EDEA28EB7DA117AF9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/logo_rbc-royalbank-white-en.svg
Preview:	<svg id="One_line_x2C__cmyk_x2C__reverse" xmlns="http://www.w3.org/2000/svg" viewBox="0 0 103.9 34.2"><style>.st0{fill:#005ab4;stroke:#fff;stroke-width:.75}.st1{fill:#fedf01}.st2{fill:#fff}@media screen and (-ms-high-contrast:active){svg{background-color:#006ac3!important}}</style><g id="Layer_2_9_"><path class="st0" d="M25.9 29.8c0 1.1-.5 1.7-1.3 2.1-3.4 1.3-7.5 2-11.4 2-3.9 0-8-.7-11.4-2-.9-.3-1.3-1-1.3-2.1V.4H26v29.4z"/><path class="st1" d="M7.2 18.3c-3.5-2.2-4.7-3.2-4.8-4.6 0-.3 0-.8.2-1.1l-.3-.2c-.3.4-.4 1-.4 1.5 0 .8.3 1.5.6 2 .5.8 1 1.2 2.3 2.2 1.4 1 2.3 2.3 2.9 3.5h.2v-1.4c1.9 1.1 3.5 2.1 4.3 3.8h.2c-.4-2-1.4-3.4-5.2-5.7zM23.5 23.9h-.2c0-1.3-1.2-1.7-2.5-1.7h-4c.1.6.2 1.4.1 2.1h-.2c-.4-3-2-4.4-4.4-6v1.3h-.2c-.6-1.4-2-2.7-3.3-3.6-.3-.2-.7-.5-1.1-.8v1.5h-.1C7 15.3 6 14.3 4.6 13c-1.5-1.4-2.2-2.2-2.5-3.2-.2-.6-.3-1-.3-1.7 0-1.1.6-2.1 1.3-2.5v.5c-.4.6-.5 1.1-.5 1.7 0 .6.1 1.2.4 1.7.9 1.6 3.8 3.7 5.6 4.9 5.7 3.8 6.9 4.5 7.8 6.6.1.2.2.5.3.9.8-.1 3.8-.6 4.4-.7.1 0 .3 0 .4-.1.5-.3.9-.7 1

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\main[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	413
Entropy (8bit):	4.557193714068406
Encrypted:	false
SSDEEP:	12:zWlCouWQW7qyWVfW59yWNfyoDvgfyWGoGl:zDn36jSfi9ygfyzy0Gl
MD5:	F611BBEDDCC6FCBB1C705A94283D0D44
SHA1:	3E7AD8F27D9EAB3CC370CE85A4C2C6EE0A2899DF
SHA-256:	72B9DB6AE97B35A4682B191890662BB3357C100BBAC53D6ECD1F172D362890D2
SHA-512:	A75F39076F8EDE5E9D19800294DB0F412DBB41533C5CA88DBFE44B7C436C6923342747F6C8F770ED13F8943D5F2482B582A34364C1C4B0E68289D5271B8E5604
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/css/main.css?browserId=other&themeId=daslate_WAR_daepictheme&minifierType=css&languageId=en_US&b=6101&t=1604023680000
Preview:	@import url(layout.css);..@import url(portlet.css);....@import url(../_wmos/css/bootstrap.css);..@import url(../_wmos/css/font-awesome.min.css);..@import url(../_wmos/css/font-black-tie.css);..@import url(../_wmos/css/flag-icon.css);..@import url(../_wmos/css/animations.css);..@import url(../_wmos/css/wm_sass.css);....@import url(../_os/css/advisor_styles.css);..@import url(../_os/css/advisor_styles_dark.css);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\meta[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2567
Entropy (8bit):	5.090895577945132
Encrypted:	false
SSDEEP:	48:DQjHS9SiS5SipSOvSsSivS5vS+vSIrfwar3RPaG0ZQPkwqs+ehiEfAMse55R+Nwn:DQjHS9SiS5SOSwSsSMSRSASivH0YqchP
MD5:	52CA69D055BE5B22727CCA9D814FFB49
SHA1:	BCD9A9A2B52D52EFAC503537918CCD4C685E2EBE
SHA-256:	FDB98AE9162AC7AA33CE1867CD7D77C1049341C7D9472F5639C5B72FFA51462C
SHA-512:	5E42C3A3AC743CD8A0805E3154519385079654BFAABD8CECC615BC8CE5C21A965180E10DB580F3EDF681FA66993517455648B83C19A16BD7D4AD0D7CAE9DBD1F
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-web/js/meta.js
Preview:	function ExtractMetaData(autoCrawl){..console.log("Running ExtractMetaData w/ autoCrawl as", autoCrawl);..var checkSum = $("meta[property='checksumHtml']").attr("content");..var pageCloneLocation = $("meta[property='pageCloneLocation']").attr("content");..var themeVersionId = $("meta[property='themeVersionId']").attr("content");..var appId = $("meta[property='app_id']").attr("content");..var pageLocale = $(".pageMetaData").attr("data-locale");..var repositoryId = $(".pageMetaData").attr("data-repoId");..var pageType = $(".pageMetaData").attr("data-pageType");..var pageId = $(".pageMetaData").attr("data-pageId");..var themeId = $(".pageMetaData").attr("data-themeId");..var themeName = $(".pageMetaData").attr("data-themeName");..var pageVersionId = $(".pageMetaData").attr("data-pageVersionId");..var pageName = $(".pageMetaData").attr("data-pageName");..var repositoryName = $(".pageMetaData").attr("data-repositoryName");..var officeName = $(".pageMetaData").attr("data-officeName");..var p

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\metacondbold-roman[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), MetaCondBold-Roman family
Category:	downloaded
Size (bytes):	28234
Entropy (8bit):	7.974833763060768
Encrypted:	false
SSDEEP:	768:TB/rGeevzKI5vbf70L4s1XOXRRUDH2G6Aw:5rOhpshyRUbUAw
MD5:	3D6FF63E7D73F6D66A0C232025D2A774
SHA1:	23994A588525B7EB9690A2E4B6080595166C0DD9
SHA-256:	B25D6E8D4ECCDE6940D933DA64BD9054F90C92443A30286A7ABCD6013BCDD5EE
SHA-512:	1E079F415CC523F2D8175865B20DD7622FFCB05BF61638BB98D10D271F75B4F15C815CE6C18088F0BF3EE496655E65DFDA2E615F5AFAD415B18C61A1DD938244
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/metacondbold-roman.eot?
Preview:	Jn..Tm............................LP/...J..@................^F.{..................&.M.e.t.a.C.o.n.d.B.o.l.d.-.R.o.m.a.n.......R.e.g.u.l.a.r.....$.V.e.r.s.i.o.n. .5...0.0.1. .1.9.9.9...$.M.e.t.a.C.o.n.d.B.o.l.d.-.R.o.m.a.n.....BSGP..................<..V..Xc.Q.....{lg.isw.\|z...k.....j.N.E{..~..mP...A4=.d".n..>.I.......SO.9...qD6...a.G.f"Jh.PNQ...H.0-...._.&.i..d.2.m.Ng..>..aPX.zHA.K[?e..K....;...1/..\@?h.)...h.....G.Lo.l...8.......@..L.3"}... +....$.z.....3.$..=....z>.dV...I...8NpD%..uD;.@....\...T.+..1 .VKb.C.Dd\h.<...5.th....LI............(.[.X....1.:...0.....3.O...)ml.F....T....#..`.SN/...lKt..%B....b.e.....h.....:....."f0..&....._'=G..$0~;c..+..-...m).j..:....h....k~..`b,k0lGK...#.F...:C.M&T....3..s.6..;.g:A..!..8...G.....W.9.<.-.U.X..........~a.e^.n..Y`.8\.]PW..R.t.0[..........AuE...9l..$Mt.9..&.:.....#:..... ..A$..,.H&.aG.Db^.../...H......0-.+.5......mM.[.%..E.s...z...#*...p..e..c8.Q..........z-..U.{....+R....PIz.P.}..Du...xPodG..>0.=.\|..qC..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\metacondbold-roman[2].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), MetaCondBold-Roman family
Category:	downloaded
Size (bytes):	28234
Entropy (8bit):	7.974833763060768
Encrypted:	false
SSDEEP:	768:TB/rGeevzKI5vbf70L4s1XOXRRUDH2G6Aw:5rOhpshyRUbUAw
MD5:	3D6FF63E7D73F6D66A0C232025D2A774
SHA1:	23994A588525B7EB9690A2E4B6080595166C0DD9
SHA-256:	B25D6E8D4ECCDE6940D933DA64BD9054F90C92443A30286A7ABCD6013BCDD5EE
SHA-512:	1E079F415CC523F2D8175865B20DD7622FFCB05BF61638BB98D10D271F75B4F15C815CE6C18088F0BF3EE496655E65DFDA2E615F5AFAD415B18C61A1DD938244
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/fonts/metacondbold-roman.eot?
Preview:	Jn..Tm............................LP/...J..@................^F.{..................&.M.e.t.a.C.o.n.d.B.o.l.d.-.R.o.m.a.n.......R.e.g.u.l.a.r.....$.V.e.r.s.i.o.n. .5...0.0.1. .1.9.9.9...$.M.e.t.a.C.o.n.d.B.o.l.d.-.R.o.m.a.n.....BSGP..................<..V..Xc.Q.....{lg.isw.\|z...k.....j.N.E{..~..mP...A4=.d".n..>.I.......SO.9...qD6...a.G.f"Jh.PNQ...H.0-...._.&.i..d.2.m.Ng..>..aPX.zHA.K[?e..K....;...1/..\@?h.)...h.....G.Lo.l...8.......@..L.3"}... +....$.z.....3.$..=....z>.dV...I...8NpD%..uD;.@....\...T.+..1 .VKb.C.Dd\h.<...5.th....LI............(.[.X....1.:...0.....3.O...)ml.F....T....#..`.SN/...lKt..%B....b.e.....h.....:....."f0..&....._'=G..$0~;c..+..-...m).j..:....h....k~..`b,k0lGK...#.F...:C.M&T....3..s.6..;.g:A..!..8...G.....W.9.<.-.U.X..........~a.e^.n..Y`.8\.]PW..R.t.0[..........AuE...9l..$Mt.9..&.:.....#:..... ..A$..,.H&.aG.Db^.../...H......0-.+.5......mM.[.%..E.s...z...#*...p..e..c8.Q..........z-..U.{....+R....PIz.P.}..Du...xPodG..>0.=.\|..qC..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\modernizr.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines
Category:	downloaded
Size (bytes):	23030
Entropy (8bit):	5.319493152828152
Encrypted:	false
SSDEEP:	384:GEMQDCHW510TpJGd+xesmAnxGKQoZWlY5y66Hh1p4XVyl0pvScB6L/EYK:GPQDkjebA8KrWy5y66HUylusL/K
MD5:	DC8117276E2EA6CA5ECB81C9791FA2C8
SHA1:	1FB8CDC9AC54A169F9A436D7ACA9EFA9A099E18A
SHA-256:	4E45643A25BCAA287FE58203DAE990D5F8FFB5D55799EB2E6EC68A81A32D2491
SHA-512:	C06A0ADAAEBCD40F0532A49AA639CACEA4CE6B6EB44DECDFEA778ED98D9483E7B5FC6CF9D5CC0784280A7126510BB1982DB952971CBDF191B112467F137A5DB1
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/external/modernizr/2.8.3/modernizr.min.js?14
Preview:	/* Modernizr 2.8.3 (Custom Build) \| MIT & BSD. * Build: http://modernizr.com/download/#-fontface-backgroundsize-borderimage-borderradius-boxshadow-flexbox-flexboxlegacy-hsla-multiplebgs-opacity-rgba-textshadow-cssanimations-csscolumns-generatedcontent-cssgradients-cssreflections-csstransforms-csstransforms3d-csstransitions-applicationcache-canvas-canvastext-draganddrop-hashchange-history-audio-video-indexeddb-input-inputtypes-localstorage-postmessage-sessionstorage-websockets-websqldatabase-webworkers-geolocation-inlinesvg-smil-svg-svgclippaths-touch-webgl-printshiv-mq-cssclasses-addtest-prefixed-teststyles-testprop-testallprops-hasevent-prefixes-domprefixes-css_backgroundposition_shorthand-css_backgroundposition_xy-css_backgroundrepeat-css_boxsizing-css_displaytable-css_lastchild-css_mediaqueries-css_positionsticky-css_regions-dom_dataset-dom_microdata-elem_time-event_deviceorientation_motion-forms_formattribute-forms_placeholder-forms_speechinput-forms_validation-fullscreen_api-ie8co

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\newsandupdates[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	4838
Entropy (8bit):	5.355860979815785
Encrypted:	false
SSDEEP:	96:rQzfq16Ao58qllxygcNgYfgngsWhZrOWSBlkT5KQrj4L6TDKuhj4o:rQzy18ylNTzzN59dp
MD5:	FA0F0D7C641E0C451360C13C9F891DE2
SHA1:	8A4AF319907CDDFE76ADA9D94AE0A45DA6772146
SHA-256:	85E67B6127D64D7415AC84E12DE5CD0564649292D59B7D8BAB00A778F59FBB8A
SHA-512:	4CC7C49448252034B980340E23E792E2C81FC947A1703436DE756D626606AAC9B2DDE3F2DDECA084E5DD7063D59857CEE905F45C606EA460F26CC9A917A2372D
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/newsandupdates.js?14
Preview:	function selectRandIndex(highnum)..{...return Math.floor(Math.random()* highnum);..}....function setupCommenceDate(datestr)..{...var date =new Date();...date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,...datestr.substring(6,8));...date.setHours(datestr.substring(8,10),datestr.substring(10,12),datestr.substring(12,14));...//date.setHours(0,0,0);...return date;..}....function setupExpiryDate(datestr)..{...var date =new Date();...date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,...datestr.substring(6,8));...date.setHours(datestr.substring(8,10),datestr.substring(10,12),datestr.substring(12,14));...//date.setHours(23,59,59);...return date;..}....function isRightDate(start,finish)..{...var now =new Date();...var startDt =new Date();...var finishDt =new Date();...if(start ==null &&finish !=null)...{....finishDt =setupExpiryDate(finish);....if(finishDt >=now).....return true;...}...else if(start !=null &&finish ==null)...{....startDt =setupCommenceDate(start);

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\nr-spa-1071.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	33066
Entropy (8bit):	5.324356526984561
Encrypted:	false
SSDEEP:	384:np4ehTqfenTqXTTNJAy4ynpzEWxpY8SgS7Y0vRZtmW1eMOQIGoJ9Cd9P4HFb+lz8:niio5jTNywBdAdmiR4RuP0F6lzEFFVD
MD5:	C4BE07D99198E723860AEEE65FD397CF
SHA1:	3963B29B5BDF4F6DFE7592BFEFD3ABD67B1BA601
SHA-256:	E0F3A0B6BB569A4C29D1BF5E034F9EC975D04B45EDFD66EBFF73ED5CF4A22447
SHA-512:	F9E78B66E5F4A159C8F0B4238475C45D10FD540F2FCBDD48822E29FE2DD7EEDFBC9A624234CF0B215FFCC6C481E0034FEED7D53ADBDD1E9FC9B17D92CCC26139
Malicious:	false
Reputation:	low
IE Cache URL:	https://js-agent.newrelic.com/nr-spa-1071.min.js
Preview:	!function(n,t,e){function r(e,o){if(!t[e]){if(!n[e]){var a="function"==typeof __nr_require&&__nr_require;if(!o&&a)return a(e,!0);if(i)return i(e,!0);throw new Error("Cannot find module '"+e+"'")}var s=t[e]={exports:{}};n[e][0].call(s.exports,function(t){var i=n[e][1][t];return r(i\|\|t)},s,s.exports)}return t[e].exports}for(var i="function"==typeof __nr_require&&__nr_require,o=0;o<e.length;o++)r(e[o]);return r}({1:[function(n,t,e){t.exports=function(n,t){return"addEventListener"in window?window.addEventListener(n,t,!1):"attachEvent"in window?window.attachEvent("on"+n,t):void 0}},{}],2:[function(n,t,e){function r(n,t,e,r){d[n]\|\|(d[n]={});var o=d[n][t];return o\|\|(o=d[n][t]={params:e\|\|{}}),o.metrics=i(r,o.metrics),o}function i(n,t){return t\|\|(t={count:0}),t.count+=1,f(n,function(n,e){t[n]=o(e,t[n])}),t}function o(n,t){return t?(t&&!t.c&&(t={t:t.t,min:t.t,max:t.t,sos:t.tt.t,c:1}),t.c+=1,t.t+=n,t.sos+=nn,n>t.max&&(t.max=n),n<t.min&&(t.min=n),t):{t:n}}function a(n,t){return t?d[n]&&d[n][t]:d

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\print[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	1492
Entropy (8bit):	4.923324027865827
Encrypted:	false
SSDEEP:	24:bU9EZQ5PBH/HOH7Qhwr5PukXir6649HMH5Zh3+/Tive4:bU9F55Po7QGrJzi26+G5sGl
MD5:	A8C6157139FF9F4E5FB83995EA7A6A57
SHA1:	22BEA1A14E7547A43124AE7FF0AB82BBF2EE5012
SHA-256:	3BA5C75DBBFEAD088F2599735C2723F2CAC7DBFD0FE10C9F5E5E43AAAE8B190A
SHA-512:	5FAC8B1BDECB95B0DF1A0AFA0C03E4807540865BBB77940DA1B690A408B3C62D29A2A8775F46FB693C11EB58F5AEBF6A8C5FABF82EDFAE757D4516CACFD3BD87
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/css/print.css?14
Preview:	/* UOS Version: 2.2 - May 4, 2009 */....body{background:#fff;background-image:none;}....ul{list-style:disc !important;margin:12px 0 !important;padding:0 !important}...ul li{list-style:disc !important;background: none !important;margin:0 0 2px 15px !important;padding:0 !important}.....#wrapper{width:auto}.....#globalheader{border-bottom:1px solid gray !important;margin:0 0 12px 0}....#globalheader-search{display:none;}....#globalheader-links{display:none;}....#globalheader-secureinfo{display:none;}......#mainnav{display:none}........#layout{padding-left:0;padding-right:0}.......#layout-column-left{display:none}..........#banner{}..........#breadcrumbarea{display:none;}..........#pagetitlearea{padding:0;margin:0 0 12px 0}............#pagetitlearea-tools{display:none;}..........#layout-column-main{width:auto !important;float:none !important;margin:0;clear:both}...........#layout-column-main .clear {height:auto !important}.......#layout-column-right{display:none}......#globalfooter-searchb

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\rbc-icons[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	3668
Entropy (8bit):	4.962310588197698
Encrypted:	false
SSDEEP:	48:QNFEVTbOrx8ajPUpVcpOrMan/BM8ECLFLZHmm785M7Xwzu/wTIK:yFEVnOrWaj8pUOrMYGYLFLn7AMYywJ
MD5:	D882ECD6B317A9FD7C3B6BC9A0B55BF2
SHA1:	064CE13985D26B9FF872A84E4E6A1501ABADAEC8
SHA-256:	F1B201FB5356D16B2859B2C59830D05B3A49A45CA2CC81324D01492ED728608D
SHA-512:	5C8258ACFAEBD78FDF6827D451236563F145EC39D88B9491DBC884CE4856DED3E33A03CAC9C49BFBF9B6E9AF459E4BE35BDA3A75435777C5F13FDC52A857F340
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/css/rbc-icons.css?14
Preview:	@font-face {. font-family: 'rbc-icons';. src: url('fonts/rbc-icons.eot?9w1q4o');. src: url('fonts/rbc-icons.eot?9w1q4o#iefix') format('embedded-opentype'),. url('fonts/rbc-icons.ttf?9w1q4o') format('truetype'),. url('fonts/rbc-icons.woff?9w1q4o') format('woff'),. url('fonts/rbc-icons.svg?9w1q4o#rbc-icons') format('svg');. font-weight: normal;. font-style: normal;.}..@font-face {. font-family: 'rbc-icons-vl';. src: url("fonts/vl/rbc-icons.eot");. src:. url("fonts/vl/rbc-icons.eot?#iefix") format("eot"),. url("fonts/vl/rbc-icons.woff2") format("woff2"),. url("fonts/vl/rbc-icons.woff") format("woff"),. url("fonts/vl/rbc-icons.ttf") format("truetype"),. url("fonts/vl/rbc-icons.svg#rbc-icons") format("svg");.}...rbc-icon {. /* use !important to prevent issues with browser extensions that change fonts */. font-family: 'rbc-icons' !important;. speak: none;. font-style: normal;. font-weight: normal;. font-variant: normal;.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\rbcdisplay-regular-webfont[1].woff Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Web Open Font Format, TrueType, length 39460, version 1.0
Category:	downloaded
Size (bytes):	39460
Entropy (8bit):	7.988130095464137
Encrypted:	false
SSDEEP:	768:LdJhfJa0SWH5oyYJYLoS9QvAX40eEWkn6utmgO1z1Tlh0BOVHoMaZVBIB:LdPJjDopJgoS9SA1eEl6utmgO1p0BO9f
MD5:	CCE9FF7A7A926D5DA398472E09381489
SHA1:	E1FFF9938D18AF78D484683C00219A441654F21E
SHA-256:	8DAF5B7FDB4CC33A16CC65A1FABA63F852C676B175FDE9660A176CD1C6934C19
SHA-512:	920221CF9B43E7088106280233ACFD89FB07730A43C26F7549F2A62D66CB362034FD600ABB414E1DAA0F22276037E89044FF1E7760806408CD790F129B5E878C
Malicious:	false
Reputation:	low
IE Cache URL:	https://cdn.rbcgam.com/assets/fonts/rbc-display/rbcdisplay-regular-webfont.woff
Preview:	wOFF.......$......W.........................FFTM................GDEF...L...3...6.Q.PGPOS..........0....GSUB.......o...$T.Y]OS/2...$...S...`..b.cmap...\...i...~.V.Acvt .......7...h0...fpgm.......p...m=..\|gasp...D............glyf...\|..k......JKHhead.......6...6..eqhhea.......!...$....hmtx...x..........dUloca.......s...z8..Rmaxp....... ... .{.+name..},.......;Q.Q.post...,.........M.:prep...8........)..Pwebf..............Y........Bn.Q._.<.........Q.........<(.......\............x.c`d``..;...K..../9.1.E......F..........<.^.........".4............x.c`f.f......j.r...a..f:..T...`...a}.......].............1L9.... 9&...@J.......H.x.u._H.Q....~.D..........C.@FF...BDdH.H."..%Y"..!..J.".....CdHy.ED.!"^...."*p=.l...~<......}.W.2.z...VUx..`J......9.8.H.V0.+1C..+.K..<...8u@.""CH.E..?4.N..C4I9.....J.'.nS.!r.1.8..E.../e...../t;...R.......(.T.B2...Qw..N.......5..h...9.\O...N.CI+ G..<.xg....8..{.{..{....>']H.{\|..Q.a.g..]...iw.{.$..T~....qZ...."..@-...A..-.6.\|9LS..k..+..S.!.....5...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\showinfonoticenew[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	5364
Entropy (8bit):	4.896001123837881
Encrypted:	false
SSDEEP:	96:rVgb6fc/qlHIHwLVGNWGlaN6CQaCSfYpz9pPxTg9pJxToM:rSbV04WG46eYpzrGt7
MD5:	D1F2155E9F597D080A00265CA1FF7FFA
SHA1:	9BD5CF95608AF695DE99BF57CDEDD2DD1B7650FC
SHA-256:	EACB9A6F38329DB36F61378BC2FDD5B3A08A003218053773E561618217BF61E4
SHA-512:	AA31C146A889D384F4B18E01C180BD0C5B7547BCAE985710FE90CAA2287DDDD4B24F76C476D9200F21B46641C4A5787FBC67DCDBC027EF6994B28F863C34F729
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/showinfonoticenew.js?14
Preview:	function setupCommenceDate(datestr)..{.. var date =new Date();.. date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,.. datestr.substring(6,8));.. date.setHours(0,0,0);.. return date;..}....function setupExpiryDate(datestr)..{.. var date =new Date();.. date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,.. datestr.substring(6,8));.. date.setHours(23,59,59);.. return date;..}....function isRightDate(start,finish)..{.. var now =new Date();.. var startDt =new Date();.. var finishDt =new Date();.. if(start ==null &&finish !=null).. {.. finishDt =setupExpiryDate(finish);.. if(finishDt >=now).. return true;.. }.. else if(start !=null &&finish ==null).. {.. startDt =setupCommenceDate(start);.. if(startDt <=now).. return true;.. }.. else if(start ==null &&finish ==null).. {.. return true;.. }.. else.. {.. startDt =setupCommenceDate(start)

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\showservicenoticenew[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	5476
Entropy (8bit):	4.932834881309524
Encrypted:	false
SSDEEP:	96:3tgb6fc/qlHIHwLVGNWGlaN6CCxy5p1E2kp5xE2Gp39pWxTC9pExTkM:3KbV04WG4P5p62kp42Gp3yAo7
MD5:	9C48CA8358F1F4FC320B91B5244735E3
SHA1:	9D9E1D8A4FAE8F88F57A02CE5BC6D48914A5FDF8
SHA-256:	2D74CA8CF137102662C6E18F06571A39B72F32BB236A29B40D17F2B8CD7B6217
SHA-512:	9249EA4667E25DD73B919F2A03068F738D2BC78D48CBC6E008F9E783C804D73EE710CB644DCD7A6DA97B0F1B8F8F0481BF3D7AF29AFEA24AF6CE5138DF920FF6
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/showservicenoticenew.js?14
Preview:	function setupCommenceDate(datestr)..{.. var date =new Date();.. date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,.. datestr.substring(6,8));.. date.setHours(datestr.substring(8,10),datestr.substring(10,12),datestr.substring(12,14));.. //date.setHours(0,0,0);.. return date;..}....function setupExpiryDate(datestr)..{.. var date =new Date();.. date.setFullYear(datestr.substring(0,4),datestr.substring(4,6)-1,.. datestr.substring(6,8));.. date.setHours(datestr.substring(8,10),datestr.substring(10,12),datestr.substring(12,14));.. //date.setHours(23,59,59);.. return date;..}....function isRightDate(start,finish)..{.. var now =new Date();.. var startDt =new Date();.. var finishDt =new Date();.. if(start ==null &&finish !=null).. {.. finishDt =setupExpiryDate(finish);.. if(finishDt >=now).. return true;.. }.. else if(start !=null &&finish ==null).. {.. startDt =setupCommenceDate(start);.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\3Y2ADQKS\utilities[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ISO-8859 text, with CRLF line terminators
Category:	downloaded
Size (bytes):	26456
Entropy (8bit):	5.113404158635683
Encrypted:	false
SSDEEP:	768:vE/7iY1p3K50xCD47GhY4HOb44vH4A0D4MhdxD1Lqd17ht14mU/y:vE/WY1p3K50xCD47GhY4HOb44vH4A0Dw
MD5:	7F08267616FC544332D0422E766236DB
SHA1:	88A26B42643C7B61BFAF0C8EECAB61FC871D1810
SHA-256:	D241615F5E2386B980D53F7004B77744928EA2DAADE075A4A734EC0154DF4867
SHA-512:	401988F884F38ADCF2B9284C231B4AA76FFBE07F38D653E73797B9D149E77EE973F3510CA4F706110B74D9D9852D24827988F25B79DFF67C78947F4B1DE019BC
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/utilities.js?14
Preview:	/* UOS Version: 2.2 - May 4, 2009 /..../*********************************************************************/../ Popups../***********************************************************************/....function popup(url) {...LeftWindowPosition = ((document.all)?window.screenLeft:window.screenX)+50;...TopWindowPosition = ((document.all)?window.screenTop:window.screenY)+5;...newwindow=window.open(url,'','width='+ w + ', height=' + h + ',left=' + LeftWindowPosition + ',top=' + TopWindowPosition + ',scrollbars=yes,resizable=yes,toolbar=no,menubar=no');...if (window.focus) {newwindow.focus()}...return false;..}....function popupHelp(url) {...LeftWindowPosition = ((document.all)?window.screenLeft:window.screenX)+50;...TopWindowPosition = ((document.all)?window.screenTop:window.screenY)+5;...newwindow=window.open(url,'','width=600,height=516,left=' + LeftWindowPosition + ',top=' + TopWindowPosition + ',scrollbars=yes,resizable=yes,toolbar=no,menubar=no');...if (window.focus) {newwindow.focu

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\3mrsa[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	10982
Entropy (8bit):	5.054232349422599
Encrypted:	false
SSDEEP:	192:kAvPGxFbnjaCSg6Sp6LyHXiPaLxtuHy6Ji69A8fqlRmAepX7RB:kAvPEFcS2ySPGr8y6w6W3mB
MD5:	4178C1587DA2B82E08A0B3C5A19B7465
SHA1:	9FFECFE4277B51810B0476FE87DA9D5F983A6D01
SHA-256:	C45D7DA627BDA03955EEECD081330ADE07A52FE1A53171D1C21631A8EAC0776C
SHA-512:	B647AEB8D7452D42EDDCF4D21AF8A0CB5C8AD4C5055E088B696C3F8770FBBA761CF38705004BC659B6CEA45CA21498E1405C3DC6198FB32299836D1ADEA36814
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/3mrsa.js?14
Preview:	// ---------------------------------------------------------------------------------..// constructor..// ---------------------------------------------------------------------------------....function s3mRSAcrypt( p, klen, N, E )..{.. this.klen = klen;.. this.pname = p;.. this.rsa = new RSAKey();.. this.rsa.setPublic( N, E );..}....// ---------------------------------------------------------------------------------..// ---------------------------------------------------------------------------------....function fn3mRSAcryptEncrypt( toCrypt )..{.. var output = this.rsa.encrypt( toCrypt );.. var olen = this.klen / 4;.. while ( output.length < olen ) output = '0' + output;.. return output ;..}....// ---------------------------------------------------------------------------------..// ---------------------------------------------------------------------------------....function fn3mNormalize( isq, type, text )..{.. var textBytes = [];.... if ( type ) text = text.trim().toUpperCase()

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\A5JYK927.htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	162
Entropy (8bit):	4.43530643106624
Encrypted:	false
SSDEEP:	3:qVoB3tUROGclXqyvXboAcMBXqWSZUXqXlIVLLP61IwcWWGu:q43tISl6kXiMIWSU6XlI5LP8IpfGu
MD5:	4F8E702CC244EC5D4DE32740C0ECBD97
SHA1:	3ADB1F02D5B6054DE0046E367C1D687B6CDF7AFF
SHA-256:	9E17CB15DD75BBBD5DBB984EDA674863C3B10AB72613CF8A39A00C3E11A8492A
SHA-512:	21047FEA5269FEE75A2A187AA09316519E35068CB2F2F76CFAF371E5224445E9D5C98497BD76FB9608D2B73E9DAC1A3F5BFADFDC4623C479D53ECF93D81D3C9F
Malicious:	false
Reputation:	low
Preview:	<html>..<head><title>301 Moved Permanently</title></head>..<body>..<center><h1>301 Moved Permanently</h1></center>..<hr><center>nginx</center>..</body>..</html>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\BlackTie-Light-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie Light family
Category:	downloaded
Size (bytes):	14417
Entropy (8bit):	7.956384707220394
Encrypted:	false
SSDEEP:	384:WUkKzuKphyuGkiD+cp+L2Y1IHG35SVl01ABoFClcbq8:WUkC7yTw6KCW5SVC1woH
MD5:	40D14C3B3E6EF38EAF887BD36387DA6F
SHA1:	206503A0DCDC2114C2E79B4D68CC8337B5D38336
SHA-256:	E29CAF583FD7BDA106DECFCD6BD9F12CD66CB7E1E41AA550A4B3863CB5059DE5
SHA-512:	30F1B96DF7EE6857D92EB0E2516F01878D293614B6D266151A125C65553E81CC20C32FA8B4A4B1C13E6657AC4947E0F561AEEE07D2D6A6B214CE4FED9F83903B
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/BlackTie-Light-webfont.eot?
Preview:	Q8..[7......................,.....LP..........................:.....................B.l.a.c.k. .T.i.e. .L.i.g.h.t.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4.....B.l.a.c.k. .T.i.e. .L.i.g.h.t. .R.e.g.u.l.a.r.....BSGP..................{..7S.7W./.......U.D.-.%..h.`..........(Y.....h..<....hj...J...1.)..../..z...r.#.%.RoJ. ......7..B..K.`m)...y._......bF.-5A..Mb.u..z. ..Z&..zc...5/.1.x\..\rk.lH..........u.l.O..?..%.._~.K.G...........b..-...8w$......O7.@.b...._.@........d0.=.....Ky"...@.U.8......?Y.o....<.u<.x....../`....v...#.n'.+H.Fhe..G..bz:.. ....L( ....&^.....\8...`..I......,.......ef.....Nn...m,..K....=...z..8O..1..0{.S..>...4..`....C..a-.)....y.@.\.7...4%B.....+PC.d,\\|Q./.s....v8..h..@c.O.A^C.Z.i.Hv..:.G.......7....=Pg.E.r.%.uA.wZ...g.+...q...p...(_#...=`S.^.^#.....o.R.i.w...-"B.D......HQ.1.>.?4...L..(.<..e......E.]...\.P{...4..Q.FhY..(.J...+..y.ySP........}..}.$6Q.T...CB.Ztmr..v\|....{.V..A....r)....w..+.5......t.@.DY...L..Vh.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\BlackTie-Regular-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Black Tie family
Category:	downloaded
Size (bytes):	14076
Entropy (8bit):	7.953841177052304
Encrypted:	false
SSDEEP:	192:2OJuSlUL6QOP8i89xzyFHyWDVNPF3C13eUg49uRg2tKN4gJKCP:2OJuSlUaexzyFxPk1rg4MRP
MD5:	5132EDACE080F173376DB5A1BC65F447
SHA1:	B52C0D4A3566C5E07DADA880B0B58885FB53AD13
SHA-256:	7092F9E859F1CE99D5B5EFA9F97ADF35A2D930D0009A02C9C684081BA6FD05A6
SHA-512:	4834F515A876A296CC6A4005F20D79C183727A5BDF14DD42ADF032C1267E36E179CECC808B0BB6377008D1047AEF84A4C7571456C02BBE87F1C08F0BD632CE68
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/BlackTie-Regular-webfont.eot?
Preview:	.6...6............................LP........................G.\.....................B.l.a.c.k. .T.i.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .1...0...0. .2.0.1.4...".B.l.a.c.k. .T.i.e. .R.e.g.u.l.a.r.....BSGP..................x\|.6..6...>......U.D.-.%..h.`..........(Y.....h..<....hj...d.g..s.S...$_.....$. .K-..Y..}....eC;.....bu........Q.1.....L.....]MX.\{....\8.j...D%p..K..7..\|.X =r..K.b.g..U\Z.5...FG..6TZ........$_.....".....{..D.8r.Z'....o2.x.G.&...."../G..F.....e..........na..8h.!..$..[A....`/.HZ.....B`S...A..............\|.....Q;.........P..X..`R.aB.0.%.....s.W.iL.CiI.AY,...0.+...dg.....Zo..jP.@d............:...yJN].G...<.1.4n.....E..n.C...%>.-..9nU4........Se.&04.%1.....1.hY.Gek.`Y.Y...A(.o.l%..'.........@.....@.2....:B....p4.....67s..\.... b... .....'...s...P..."...4)..S.g@...M........>.............)....B......C.xh.......N0@A.n3.o...`S..8.8R..$G....G.y!2%.s.....m.......<.^0..'.C...KyKr..2l".#m.7...P.%.J.9...Z...W..\.9..B...$\|.FT.l..u.gS...8.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\ErrorPageTemplate[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2168
Entropy (8bit):	5.207912016937144
Encrypted:	false
SSDEEP:	24:5+j5xU5k5N0ndgvoyeP0yyiyQCDr3nowMVworDtX3orKxWxDnCMA0da+hieyuSQK:5Q5K5k5pvFehWrrarrZIrHd3FIQfOS6
MD5:	F4FE1CB77E758E1BA56B8A8EC20417C5
SHA1:	F4EDA06901EDB98633A686B11D02F4925F827BF0
SHA-256:	8D018639281B33DA8EB3CE0B21D11E1D414E59024C3689F92BE8904EB5779B5F
SHA-512:	62514AB345B6648C5442200A8E9530DFB88A0355E262069E0A694289C39A4A1C06C6143E5961074BFAC219949102A416C09733F24E8468984B96843DC222B436
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/ErrorPageTemplate.css
Preview:	.body..{...font-family: "Segoe UI", "verdana", "arial";...background-image: url(background_gradient.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;...color: #575757;..}....body.securityError..{...font-family: "Segoe UI", "verdana" , "Arial";...background-image: url(background_gradient_red.jpg);...background-repeat: repeat-x;...background-color: #E8EAEF;...margin-top: 20px;...margin-left: 20px;..}....body.tabInfo..{...background-image: none;...background-color: #F4F4F4;..}.. ..a..{...color: rgb(19,112,171);.font-size: 1em;...font-weight: normal;...text-decoration: none;...margin-left: 0px;...vertical-align: top;..}....a:link, a:visited..{...color: rgb(19,112,171);...text-decoration: none;...vertical-align: top;..}....a:hover..{...color: rgb(7,74,229);...text-decoration: underline;..}....p..{...font-size: 0.9em;..}.....h1 /* used for Title */..{...color: #4465A2;...font-size: 1.1em;...font-weight: normal;...vertical-align

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Liferay[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	6555
Entropy (8bit):	5.197501033319263
Encrypted:	false
SSDEEP:	96:lyprowL/NaG7J5a/ksoq8ZGJb54uP/mkz7gAgOda6n4GU8hpAnU:IJlL9xZ+GuP/Rc9OH4GU8hpn
MD5:	716379C44F85717C177B9821383E3AA9
SHA1:	2E56C68A5171461B8066CDF688BA188040F786B4
SHA-256:	D2D7336DFDB44E1DE5E7FAEF6EDBF02F6C2E618FF007AAF8FA7788B9EEC6BF10
SHA-512:	B5917CC3DD7A1D1BBD605473C05A0F49B33E04BEEDA2C316123A8D24266CD9D55D919B1D84B06F7394CAD3C94096829EA4D5C9665DB67055EE4FF7D51566AA47
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-web/js/Liferay.js
Preview:	if("undefined"==typeof da)var da={};"undefined"==typeof da.appSettings&&(da.appSettings={},da.appSettings.get=function(a,b){return da.appSettings[a][b]},da.appSettings.set=function(a,b,c){da.appSettings[a][b]=c});."undefined"==typeof da.userPermissions&&(da.userPermissions={},da.userPermissions.hasPermission=function(a,b){return _.isUndefined(da.userPermissions[a])?!1:0<=da.userPermissions[a].indexOf(b)?!0:!1},da.userPermissions.setPermissions=function(a,b){da.userPermissions[a]=b},da.userPermissions.addPermission=function(a,b){void 0===da.userPermissions[a]&&(da.userPermissions[a]=[]);da.userPermissions[a].push(b)});da.liferay={};_.isUndefined(window.console)&&(console={});._.isUndefined(console.log)&&(console.log=function(){});_.isUndefined(console.info)&&(console.info=function(){});_.isUndefined(console.error)&&(console.error=function(){});_.isUndefined(console.warn)&&(console.warn=function(){});.da.liferay.addPortletListener=function(a,b,c,e){console.log("da.liferay.addMarketingCon

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\Roboto-Medium[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Roboto Medium family
Category:	downloaded
Size (bytes):	21364
Entropy (8bit):	7.9664840416164155
Encrypted:	false
SSDEEP:	384:zI8SG7HTFTmbpKuHJQNLAjMxz/5aoebcWMnnkxRRswW/E7hh:zI8X3FIpKuHJgLAwxz/oolWMnkFsxMth
MD5:	4D9F3F9E5195E7B074BB63BA4CE42208
SHA1:	1517F4B6E1C5D0E5198F937557253AAC8FAB0416
SHA-256:	714646396932C3ED852F6946B0149AD7FE3EACA63EB0F507ABD4742AFA3F1AC1
SHA-512:	A8709B6F3F8922E561D99F573DF127058317E7DC9B03111CE7B43C4A6CA328B897DEBFB24D502B90830EAF08F7C3B3E45CBB75DBFAA715A2EC24633FA2E90151
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/Roboto-Medium.eot?
Preview:	tS..~R............................LP....[ .P .......... ...O...U....................R.o.b.o.t.o. .M.e.d.i.u.m.....R.e.g.u.l.a.r...,.V.e.r.s.i.o.n. .1...1.0.0.1.4.1.;. .2.0.1.3....R.o.b.o.t.o. .M.e.d.i.u.m. .R.e.g.u.l.a.r.....BSGP..................t..2..2..,H....xZW.h[qJ.x"c.r,g,E.&..C...........@...0.VF0.i.......^cX.#&.6......C>c\|....w".be\|..M0..fq4...D..r:UMyl.:...3.r..B.....jm.. ..i.6-.pai.d......}8.P ....M._.'..W`.3m..,.Y.B.....\?...&1...1 .M..'......ug......N.KO..`A..K...W.2..ss...C.....b.H.w...}iJ7.@.......+........NJ)..S...d)o.4U.I.5......Z.x3.cL...\|.=....g...~..bA..5...p....mR.....?&.n..... ....R..:....p.I.M..;l......2..f (...V...A~{.X.C..!.<.@%.....Sa&....P.b.6.D.d-.4.X......0w..L..q.1.@.V..#..;.k.,.(.G..(.....q..v..z...F)G.XLDHm.3.e....6.......43U.-/hg`..T..8l.@~#"q.K...&U'4)...&...p..S."..zU...Z...H.w..Vk...U^d..;...r...G.<Hh.T..)...%...........:.@.(#.....X. /....P......,.#...B.b...mD......L...$..{.t...p........... ...v.MJ.I5...RO.[e

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\SubmissionFormUtil[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	3816
Entropy (8bit):	5.539994575820145
Encrypted:	false
SSDEEP:	96:GkwnAmM/G/yK57aGXIC0agf106g0vd99MjUQrO6q:Gkwtyk+GXP1gf1pgsIjUQrO6q
MD5:	E10FF01AA3EB774FBECEEB51C44F58ED
SHA1:	D5A586392E52C3BD498F6E9A064484B01836E6A5
SHA-256:	F35CFDB65E11F4C2C56EF5AF33D03A01DC27AD3ACCD2C92F20A7CE44A966C292
SHA-512:	196F2CD988DF5717AB200E5B1011974F7B21E2DF3D49737BB10C11479E0F5E036D703F7F5DB832B1EFE5AA97AD00639C40A473CDBD8EB3A5A3CA351CAB6F343D
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-web/js/SubmissionFormUtil.js
Preview:	da.jQuery=da.jQuery\|\|$;da.submissionForm=da.submissionForm\|\|{};da.submissionForm.REQUIRED_SELECTION="da-required-selection";da.submissionForm.REQUIRED_TEXT="da-required-text";.da.submissionForm.submitForm=function(a){console.log("Submitting form:",a+".");for(var b=da.jQuery(".submissionFormRow"),c=0;c<b.length;c++)for(var f=da.jQuery(b[c]).find("[type\x3d'checkbox'],[type\x3d'radio'],[class *\x3d'da-form-input-']"),d=0;d<f.length;d++)(!da.jQuery(f[d]).has("name")\|\|_.isEmpty(da.jQuery(f[d]).attr("name"))\|\|_.isUndefined(da.jQuery(f[d]).attr("name")))&&da.jQuery(f[d]).attr("name","Unlabeled"+c);b=$("#"+a.formId).serializeArray();b.length&&"javax.faces.ViewState"==b[b.length-.1].name&&b.pop();var c=window.location.search.split("?"),e;c[1]&&c[1].split("\x26").filter(function(a){-1<a.indexOf("lang\x3d")&&(e=a)});console.log(b);b={type:"POST",url:"/delegate/services/repositories/"+a.repositoryId+"/forms/"+a.submissionFormId+"/submission?submittedFromRepositoryId\x3d"+a.submittedFromRepository

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a5ebc62b7d[1].gif Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	GIF image data, version 89a, 1 x 1
Category:	dropped
Size (bytes):	24
Entropy (8bit):	2.459147917027245
Encrypted:	false
SSDEEP:	3:CUXJ/lH:Dl
MD5:	BC32ED98D624ACB4008F986349A20D26
SHA1:	2D3DF8C11D2168CE2C27E0937421D11D85016361
SHA-256:	0C9CF152A0AD00D4F102C93C613C104914BE5517AC8F8E0831727F8BFBE8B300
SHA-512:	71ACC6DA78D5D5BF0EEA30E2EE0AC5C992B00EFEC959077DFE0AB769F1DBBD9AF12D5C5C155046283D5416BEB606A9EF323FB410E903768B1569B69F37075B4E
Malicious:	false
Reputation:	low
Preview:	GIF89a.......,..........

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\a5ebc62b7d[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	dropped
Size (bytes):	57
Entropy (8bit):	4.31817604175005
Encrypted:	false
SSDEEP:	3:U3KTDWuvMiqVkMWVrfUh:HnNukMWVr8h
MD5:	79F2D634CE67570918939DF10A075576
SHA1:	BA47B7DACB11250F9B1B3974B34954B188E3ECAD
SHA-256:	D10C94B6CDB747904BAEE9070F003BB45849DA46F8100B1320F286C21CBCAAA1
SHA-512:	155FAB1EC68F300DDCB948D024995539C721A2AB0FD89C220F0EFFA68C3863507CBEF806F087F5C84EAB38D4C53DA94BC893894E8FC9DED388DACFE3244E182E
Malicious:	false
Reputation:	low
Preview:	NREUM.setToken({'stn':1,'err':1,'ins':1,'cap':0,'spa':1})

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\animations[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	9546
Entropy (8bit):	4.79019866335192
Encrypted:	false
SSDEEP:	192:7mWT+E1vdi5/AdN8T4sD16gyQ2vRDvqJCntSi69Si6mFZRR:7mWFsV
MD5:	C334D33B5456C3254F5538DD8F247B5A
SHA1:	7ED2D8A41B02DCA8B6B5DC5C09C5A4A9581AE4EF
SHA-256:	7E6833BFB76D0A22BBDA9889863AD224BA098ACA633EE707AA3B90B56677AE34
SHA-512:	59D9693C11D9E2880CA3B3332AB2343BF61A3B44B3392D80DA794F154F278CD6D77941D054CB3CBA8D23481912D9FF206A1A0566DF282E5762B70944EE78A2EF
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/css/animations.css
Preview:	@charset "UTF-8";....@-webkit-keyframes bracket-reveal {.. from { width: 0 }.. to { width:20em }..}....@-moz-keyframes bracket-reveal {.. from { width: 0 }.. to { width:20em }..}.......leftBig {.. opacity:1; .. -webkit-animation:leftBig ease-in 1; .. -moz-animation:leftBig ease-in 1;.. animation:leftBig ease-in 1;.. .. -webkit-animation-fill-mode:forwards; .. -moz-animation-fill-mode:forwards;.. animation-fill-mode:forwards;.. .. -webkit-animation-duration:1.3s;.. -moz-animation-duration:1.3s;.. animation-duration:1.3s;..}....@media only screen and (max-width:991px) {.. .leftBig {.. opacity:1; .. -webkit-animation:none; .. -moz-animation:none;.. animation:none;.. .. -webkit-animation-fill-mode:none; .. -moz-animation-fill-mode:none;.. animation-fill-mode:none;.. .. -webkit-animation-duration:0s;.. -moz-animation-duration:0s;.. animation-duration:0s;.. }..}.......upBig {.. opacity:

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\barebone[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	329937
Entropy (8bit):	5.493306481426275
Encrypted:	false
SSDEEP:	3072:Ac90X+dbGA2yC8B5xOljwNjR99rYnxDH2X4oNfX/pBXQOuFPBoQQ231h1tM7TMXX:p0X1NyHOhejRoDs/jXQO8Zor26gH
MD5:	6B0470C1F4DD37E77E31EA90F2E26034
SHA1:	B61369B2489033A4E17C22A6DE5799078AD9C04E
SHA-256:	D864F7D66944479216B0654C5324C938E6243B6ADD1EEEBF10247EA086411C98
SHA-512:	82A3627B9418D0A1873A57533A900733E9F9C61807B56C2A0597DCC810649B3CCA5B8A8CA8DDAE4AC21ABAF0BEA5151C6C2CF55D8AE177224883893BB9A1D0F9
Malicious:	false
Reputation:	low
Preview:	if(typeof YUI!="undefined"){YUI._YUI=YUI}var YUI=function(){var c=0,f=this,b=arguments,a=b.length,e=function(h,g){return(h&&h.hasOwnProperty&&(h instanceof g))},d=(typeof YUI_config!=="undefined")&&YUI_config;if(!(e(f,YUI))){f=new YUI()}else{f._init();if(YUI.GlobalConfig){f.applyConfig(YUI.GlobalConfig)}if(d){f.applyConfig(d)}if(!a){f._setup()}}if(a){for(;c<a;c++){f.applyConfig(b[c])}f._setup()}f.instanceOf=e;return f};(function(){var p,b,q="3.4.0",h=".",n="http://yui.yahooapis.com/",t="yui3-js-enabled",l=function(){},g=Array.prototype.slice,r={"io.xdrReady":1,"io.xdrResponse":1,"SWF.eventHandler":1},f=(typeof window!="undefined"),e=(f)?window:null,v=(f)?e.document:null,d=v&&v.documentElement,a=d&&d.className,c={},i=new Date().getTime(),m=function(z,y,x,w){if(z&&z.addEventListener){z.addEventListener(y,x,w)}else{if(z&&z.attachEvent){z.attachEvent("on"+y,x)}}},u=function(B,z,y,w){if(B&&B.removeEventListener){try{B.removeEventListener(z,y,w)}catch(x){}}else{if(B&&B.detachEvent){B.detachE

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\blog[1].htm Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode text, with very long lines, with no line terminators
Category:	downloaded
Size (bytes):	83299
Entropy (8bit):	5.553570795503737
Encrypted:	false
SSDEEP:	1536:nBb6DBxnEawbsTH6zhLXQdn08V3FkteqgzObsZKl2GYE6JQzQUQoQZQE:nB4xEnbsuBUOUE6JQzQUQoQZQE
MD5:	31D0FC444CB8959D6712D2B07E934FF8
SHA1:	665F2BF5314F72851A35F212CD40EFF23E795D5E
SHA-256:	D823AADF28DA1030730625E24503EEFE4F45943CBAB51BD58E45385910DCF884
SHA-512:	678A1DF7B856742CC58D528864B299168C2F9F6BB7DB42C5970C53A3AC688AD8CBE2900FC4157932BEB4A0777BC39B95C9F0DB620ECFD715117AA94650B055EC
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/jim.seyers/blog/
Preview:	<!DOCTYPE html> <html class="ltr" dir="ltr" lang="en-US"> <head> <meta property="themeVersionId" content="bcc785d034c0a812a3f1bc94a5bc9f87dfa7c01c1ed2c361d71bb94093ec45ce"> <meta name="keywords" content="#renderMetaKeywords"> <meta content='IE=edge' http-equiv='X-UA-Compatible'> <meta charset='utf-8'> <meta content='width=device-width, initial-scale=1 maximum-scale=1' name='viewport'> <meta property="og:title" content="Jim's Thoughts"/> <meta property="og:site_name" content="The Seyers Group"/> <meta property="og:image" content="http://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/images/options/rbc_wealth_management_nova_scotia_cape_breton_cabot_trail.jpg"/> <meta property="og:description" content=""/> <meta property="og:type" content="article"/> [if lt IE 9]> <script src="/da-epic-theme/themes/da-slate/_wmos/js/_ie.respond.min.js"></script> <script src="/da-epic-theme/themes/da-slate/_wmos/js/_ie.html5.js"></script> <![endif]--> <noscript> <style> .javascript { display

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap-responsive-dropdown[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	8064
Entropy (8bit):	4.899349483505791
Encrypted:	false
SSDEEP:	96:MN3s89NAf5ehAoaK6Ly3ogwk8C+HFMX4XJt0e8Z3N31KOYKu2jCyI:MW89mf5Uj8C+lMX4f0JdypK3jC
MD5:	E77ADFD6A3FFA56845F3753B3EBAA530
SHA1:	5E410B5E74B4F510460158CE79C2B61B56CBEEC0
SHA-256:	9C0BFDED927BF7822CBA12609C97042DCF9490DBF993E9F1C2A434CA9BCE304A
SHA-512:	D90D474AA8BC01F3A9342C8440FA9349B9F8A369C61EFDD763FA53628ABE8FC4178AF7324D7C35EA95447B99DABB0A176AB848331855432C014B41BF60933BFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/js/bootstrap-responsive-dropdown.js
Preview:	/* ========================================================================.. * Bootstrap: collapse.js v3.3.6.. * http://getbootstrap.com/javascript/#collapse.. * ========================================================================.. * Copyright 2011-2015 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. * ======================================================================== */......+function ($) {.. 'use strict';.... // COLLAPSE PUBLIC CLASS DEFINITION.. // ================================.... var Collapse = function (element, options) {.. this.$element = $(element).. this.options = $.extend({}, Collapse.DEFAULTS, options).. this.$trigger = $('[data-toggle="collapse"][href="#' + element.id + '"],' +.. '[data-toggle="collapse"][data-target="#' + element.id + '"]').. this.transitioning = null.... if (this.options.parent) {.. this.$parent = this.getParent().. } else {.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap.min[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	122540
Entropy (8bit):	5.095991350869987
Encrypted:	false
SSDEEP:	768:ayPGxw/jc/QWlJxtQZIuiHlncmzI4I8OAduFKbv2ctm2Bm8JP+eckOvS1Fs:Uw/o1wIuiHlncm28lDbzzPux
MD5:	5D5357CB3704E1F43A1F5BFED2AEBF42
SHA1:	08DF9A96752852F2CBD310C30FACD934E348C2C5
SHA-256:	31FBD99641C212A6AD3681A2397BDE13C148C0CCD98385BCE6A7EB7C81417D87
SHA-512:	7537E07BFCE0A0C6293FB41B1F2E2058C106B1BB1D65E097CFB8AB22D8DC0B7B0F505B5FD24B856C3CFF8B11BB02B4F19838CB5C399ECC7B9B78D8A4C8A195C9
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/external/bootstrap/3.3.5/css/bootstrap.min.css?14
Preview:	/!. Bootstrap v3.3.5 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). //! normalize.css v3.0.3 \| MIT License \| github.com/necolas/normalize.css */html{font-family:sans-serif;-webkit-text-size-adjust:100%;-ms-text-size-adjust:100%}body{margin:0}article,aside,details,figcaption,figure,footer,header,hgroup,main,menu,nav,section,summary{display:block}audio,canvas,progress,video{display:inline-block;vertical-align:baseline}audio:not([controls]){display:none;height:0}[hidden],template{display:none}a{background-color:transparent}a:active,a:hover{outline:0}abbr[title]{border-bottom:1px dotted}b,strong{font-weight:700}dfn{font-style:italic}h1{margin:.67em 0;font-size:2em}mark{color:#000;background:#ff0}small{font-size:80%}sub,sup{position:relative;font-size:75%;line-height:0;vertical-align:baseline}sup{top:-.5em}sub{bottom:-.25em}img{border:0}svg:not(:root){overflow:hidden}figure{margin:1em 40px}hr

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap.min[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	downloaded
Size (bytes):	36145
Entropy (8bit):	5.126893947779175
Encrypted:	false
SSDEEP:	768:NowbpwPPIiIrPZXaoSnqFVR1bLjoOiA6hldCEfsDP:DNiA6JYDP
MD5:	1FD996986A25A6815BF41956F5546AA8
SHA1:	F0911595B674B15070DF52ED28ECBEBFC9ECEFF7
SHA-256:	03F03491992AFDD1A4F5D0A18AEFDC50A60D2E0B095FAB1DC90D900FB581FA4D
SHA-512:	E66DBFCB0FBFD9618FE92BCA7E023EFFBD0E9DA31B25C2CA94F84CA96457F1B6EE0EACBBCDAA98410C199AAC911ACF0A1747CF043600527B1E68052F43787712
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/application/themes/rbc/js/bootstrap.min.js
Preview:	/!. Bootstrap v3.3.4 (http://getbootstrap.com). * Copyright 2011-2015 Twitter, Inc.. * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE). /../!. * Generated using the Bootstrap Customizer (http://getbootstrap.com/customize/?id=473ef579f2940dd9039f). * Config saved to config.json and https://gist.github.com/473ef579f2940dd9039f. */.if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");+function(t){"use strict";var e=t.fn.jquery.split(" ")[0].split(".");if(e[0]<2&&e[1]<9\|\|1==e[0]&&9==e[1]&&e[2]<1)throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher")}(jQuery),+function(t){"use strict";function e(e){return this.each(function(){var i=t(this),n=i.data("bs.alert");n\|\|i.data("bs.alert",n=new o(this)),"string"==typeof e&&n[e].call(i)})}var i='[data-dismiss="alert"]',o=function(e){t(e).on("click",i,this.close)};o.VERSION="3.3.4",o.TRANSITION_DURATION=150,o.prototype.close=function(e){function i(){a.detach

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\bootstrap[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	assembler source, ASCII text, with very long lines, with CRLF line terminators
Category:	downloaded
Size (bytes):	134653
Entropy (8bit):	5.056677608537529
Encrypted:	false
SSDEEP:	768:y5IdAIE3O3atxHpDReKoao+iquiARNTNU44DMIMWTn5eBOiHc3gpuw7kFWr738lv:dAICbgputO8lVYNI98fNLenvv
MD5:	2A0D848179ACE94D724F5567DC0F447B
SHA1:	3087C2E9D0AC063689CC5B08D3334865E38F44A3
SHA-256:	0F01E3215B2B5954CFA4E1112FD69AD69476BF3FF95194D53A32F2C556FD990E
SHA-512:	50ADAF910127D4E185616A62E5837173AE735519A6E82B2755250BC88DA0456642D66BC74B28A66AE5E9A97DF68D48C685980F94FBE8C2DFB4C1C4D0C2A1B67B
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/css/bootstrap.css
Preview:	/!.. Bootstrap v3.3.4 (http://getbootstrap.com).. * Copyright 2011-2015 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. /..../!.. * Generated using the Bootstrap Customizer (http://getbootstrap.com/customize/?id=473ef579f2940dd9039f).. * Config saved to config.json and https://gist.github.com/473ef579f2940dd9039f.. /../! normalize.css v3.0.2 \| MIT License \| git.io/normalize */..html {.. font-family: sans-serif;.. -ms-text-size-adjust: 100%;.. -webkit-text-size-adjust: 100%;..}..body {.. margin: 0;..}..article,..aside,..details,..figcaption,..figure,..footer,..header,..hgroup,..main,..menu,..nav,..section,..summary {.. display: block;..}..audio,..canvas,..progress,..video {.. display: inline-block;.. vertical-align: baseline;..}..audio:not([controls]) {.. display: none;.. height: 0;..}..[hidden],..template {.. display: none;..}..a {.. background-color: transparent;..}..a:active,..a:hover {.. outline: 0;..}..abbr[title] {.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\business-women-working-at-table-thumb[1].jpg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	JPEG image data, baseline, precision 8, 449x299, frames 3
Category:	downloaded
Size (bytes):	96345
Entropy (8bit):	7.976327067186156
Encrypted:	false
SSDEEP:	1536:ijQGxvabhxDqtyw07ck/2A/gt9PlR+whKni7bJSxSxOUcPQ3SJF3faL/jDnSsUpp:yhWZqtycSMxfnSkxOvhJEDSh4IFF/tB
MD5:	3B51F6DF1019C61B2E4F5545E959D45B
SHA1:	8F636D58743EC71FF9CA52A9FD1C8FE24BC60AC8
SHA-256:	2346179D3F1FC559C7E7DE1078625D02B52D9987123CB53AB125BF310D59771E
SHA-512:	BB97FDE2B41574BB5A14936609743CF8F8A4294DEA831FF58407B653AFAA5118A60C7B359A8B64D58B7068DB2A42CE88127AE65678D497CB2004C488D13548FD
Malicious:	false
Reputation:	low
IE Cache URL:	https://www.rbcds.com/static/img/general/thumb/business-women-working-at-table-thumb.jpg
Preview:	.............................................................................................................................................9....Adobe.d...........+.................................................................................................!.1..A.."Qa#2q...B...$R....3b....CSr....4Ucs....TVWXu.....%&'5Ddh...............................!..1A.Qa.."q.2......B..#3Rbr....$4S..C.5....%Tc.ds..............?....)..H\....}<.\|8..Z..Q...Ey......b>....U.Ny..O.(......E.Nr.....z.!eh.,n6.9..$......s....p..%.z.p...x8...7@..(.^.9....~#..........1o..."...#...=~ZI..n.x..0..q...N.......v9.....@..F..1...#....{c..jS...\.N..g.)^B.s..q..h:.7.QY.....pT.e....D).$.Y$.3..s.~.}VQ...H[.....>.s....[a]..i.w..Oa.Eo.J_K..e].............9...?.i.RA......Q.ij.z~C..o.H....2=G....n...._s..w.e:.^F._....d...J.....I%.C#..;i....Z.@y..P..N.......i.r/.2_.y........^.v.\|....t.,.z..>.i%*.8...'Y:}F1..~..A6.U....>.k........M+.......(.EX......3..{.O.8....t........h.'.E...........0

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\canada[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	836
Entropy (8bit):	4.804145231153266
Encrypted:	false
SSDEEP:	12:t416Cu9W0wpwBqg4ZdHb8V6ujKJyeeu3lmeI2StjQYjIAAzXuE/3i:t416BkpjgUdHb8V6uj0euVw2StjQYGeP
MD5:	4F5467954B31D310B4CC4D7B8391AECD
SHA1:	F9335FF0F90A75FD106396BE45150370AF7D8B97
SHA-256:	78920A7468B87496F5D9D3E5EC2BAE5BA070C741C6D71EB1E7B3214A92BB353C
SHA-512:	F493CD1A1F13E4E5CA491F8D35A8042E48A4B31CD4358EED5473727A2004353B43772A5F314F312841798C8AED84EBF3A623DA460166B75FB5282CCA3A42B481
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/flags/canada.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 42 20"><defs><style>.cls-1{fill:red}.cls-2{fill:#fff}</style></defs><title>flag_canada</title><g id="Layer_2" data-name="Layer 2"><g id="Layer_1-2" data-name="Layer 1"><path class="cls-1" d="M0 0h42v20H0z"/><path class="cls-2" d="M10.5 0h21v20h-21z"/><path class="cls-1" d="M21 1.88l-1.43 2.54c-.16.28-.45.25-.75.1l-1-.51.77 3.91c.16.71-.36.71-.62.41l-1.84-1.94-.29 1a.35.35 0 0 1-.41.23l-2.29-.46.6 2.08c.13.46.23.66-.13.78l-.82.37 3.94 3a.48.48 0 0 1 .18.51l-.34 1.1c1.36-.15 2.57-.37 3.93-.51a.39.39 0 0 1 .32.31l-.18 3.95h.66l-.1-3.94c0-.13.18-.33.3-.32 1.36.14 2.57.36 3.93.51l-.34-1.08a.48.48 0 0 1 .18-.51l3.94-3-.82-.41c-.36-.12-.26-.31-.13-.78l.6-2.08-2.29.46a.35.35 0 0 1-.41-.23l-.29-1-1.81 1.95c-.26.31-.78.31-.62-.41L24.22 4l-1 .51c-.29.15-.58.18-.75-.1"/></g></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\check[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with very long lines
Category:	dropped
Size (bytes):	124787
Entropy (8bit):	5.349722364625303
Encrypted:	false
SSDEEP:	768:kOeylwXjtTx3NSuxfv49IQYrsKenkNP53qgzhy5QEEL1z98J4z7F:TekusKee3qgzau98J4XF
MD5:	1B9C35C86B990A9E107638C7A880F010
SHA1:	4C90D56C204957359927983AE7229B3DBD94E85B
SHA-256:	C8289183BAF4216CA3E19E1BB8D7FE769CDA849E5530301413F8D14762A3F333
SHA-512:	3064AB6D3281E0D2178A11A604E98FC8DA8733EE543F9ECFB3B8EC18A2ECDAB0495ACB10EB0C8B0EB5026E6435622E2AB855300B78A02FE98D26723D9835E5D8
Malicious:	false
Reputation:	low
Preview:	var td_1l=td_1l\|\|{};td_1l.td_0e=function(td_U,td_u){var td_z=[""];var td_j=0;for(var td_X=0;td_X<td_u.length;++td_X){td_z.push(String.fromCharCode(td_U.charCodeAt(td_j)^td_u.charCodeAt(td_X)));td_j++;if(td_j>=td_U.length){td_j=0;.}}return td_z.join("");};td_1l.td_2j=function(td_a){this.td_c=td_a;this.td_d="";this.td_f=function(td_Y,td_Z){if(0===this.td_d.length){var td_d=this.td_c.substr(0,32);var td_H="";for(var td_A=32;td_A<td_a.length;.td_A+=2){td_H+=String.fromCharCode(parseInt(td_a.substr(td_A,2),16));}this.td_d=td_1l.td_0e(td_d,td_H);}return this.td_d.substr(td_Y,td_Z);};};td_1l.td_1b=function(td_T){if(td_T===null\|\|td_T.length===null){return null;.}var td_O=null;try{var td_s="";var td_p=[];var td_g=String.fromCharCode(48)+String.fromCharCode(48)+String.fromCharCode(48);var td_i=0;for(var td_D=0;td_D<td_T.length;++td_D){if(65+td_i>=126){td_i=0;}var td_W=(td_g+td_T.charCodeAt(td_i++)).slice(-3);.td_p.push(td_W);}var td_q=td_p.join("");td_i=0;for(var td_D=0;td_D<td_q.length;++td_D){

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\chevron[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 16 x 8, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	149
Entropy (8bit):	5.705948294704785
Encrypted:	false
SSDEEP:	3:yionv//thPl93tBV1+4RthwkBDsTBZtSyyq3+dCtK5xjjp:6v/lhPrnDspqq3+dC4fjjp
MD5:	D7D592E60A7A4709C5E423BE0D72D0BF
SHA1:	A62478F76B0E90B3D9D13436C53914A9D693109F
SHA-256:	463C807898D95421F1D1B08AA1CF30873AA2CFEEC128F65946107A2D27700F5B
SHA-512:	41F3DE1257D2BDEAF447F5655F80C4F5E6DC0F81BF87A04AA3802B737098B1ADACC54EF0A79FE8AEE09A9C380C419FB6E528B0757ED962D505BD1CBC12DF0126
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/images/dropdown/chevron.png
Preview:	.PNG........IHDR..............v......tEXtSoftware.Adobe ImageReadyq.e<...7IDATx.b```h...db.^0h.D39.`h&.....1..f\|.....!$kF6..f.....#?........IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\close-blue[1].svg Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	SVG Scalable Vector Graphics image
Category:	downloaded
Size (bytes):	440
Entropy (8bit):	5.09092234445648
Encrypted:	false
SSDEEP:	6:tI9mc4sl3GagugGEBN5BSmHqiLUMI47Aq0n4YWAHEiIKAFb/74R0siqFt206QzKF:t41G2EDxKuAdTWAHEiPAFbMWsd4eDDi
MD5:	6EAC16CDA46F88C8844574192566CAE7
SHA1:	015CBE7A1FE7EADE0C8DFF7C1443452754493A05
SHA-256:	F072F948A69FA01073E7561FFC54019409436FFF0DEEE7C868CA670B2F4B849B
SHA-512:	E4B7FF0AF6D6267D08C21947604070BA242DAD61ED4DA16ED9AE4D00F8FC7C824C9F13E13E622084EB07D64F862F8E986BF42A9D729CBA06A753696FC4E66944
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/images/icons/close-blue.svg
Preview:	<svg xmlns="http://www.w3.org/2000/svg" viewBox="0 0 20 20"><defs><style>.cls-1{fill:#006ac3}</style></defs><title>close</title><g id="Layer_2" data-name="Layer 2"><g id="Basic"><g id="Navigation_Misc" data-name="Navigation/Misc"><g id="Icons"><path id="icon-close_20_" data-name="icon-close (20)" class="cls-1" d="M20 .68L19.32 0 10 9.32.68 0 0 .68 9.32 10 0 19.32l.68.68L10 10.68 19.32 20l.68-.68L10.68 10 20 .68z"/></g></g></g></g></svg>

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\combo[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text, with no line terminators
Category:	downloaded
Size (bytes):	270
Entropy (8bit):	4.633391056061998
Encrypted:	false
SSDEEP:	6:GJCRoJCAQmsNJCAQ69gmI4R6TR6MHAR6dJR6zJCO47sBot+:GJCR4CTFCT66gRyRrgR+RMCO4O5
MD5:	9BB8833770AC737143752F455DCFE3B0
SHA1:	2DA23B6A90BDBB36C8A58D70F5873C12678A76D2
SHA-256:	FC6E0AF6C09EE55282F65C73154602835554B1996A4EB7690715B1989BBDB507
SHA-512:	6262491AE2A60E9443676A1D4138B5B80E4EF203359FC18A38528AF94E5DD59F6B1C82DC4C17F8912002DC47BA950047B3DFDE32E921D09A3584C37CB15B2B79
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/combo/?browserId=other&minifierType=&languageId=en_US&b=6101&t=1460655967000&p=/html/js&m=/aui/widget-base/assets/skins/sam/widget-base.css
Preview:	.yui3-widget-hidden{display:none}.yui3-widget-content{overflow:hidden}.yui3-widget-content-expanded{-moz-box-sizing:border-box;-webkit-box-sizing:border-box;-ms-box-sizing:border-box;box-sizing:border-box;height:100%}.yui3-widget-tmp-forcesize{overflow:hidden!important}

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\content[1].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 774 x 447, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	30631
Entropy (8bit):	7.7856338207869005
Encrypted:	false
SSDEEP:	768:tiOZKW8iE1zgjdCSawdB0HOpDn7M6xXh3WMWgO53KJ8888888XM:0W8iEECSa84adXkXgjx
MD5:	472CA92EEE17F5C484DE1299710325F1
SHA1:	BD66138E80E514C8D744279B48FBB1DA57BC740B
SHA-256:	63D63E26F4287A9B0748469E7D1BBA674BC9EA4044007DB2AF1F366B45949333
SHA-512:	F0DCFE816F7CE6C67130212A8175B6DA5391D9B4B26E90FF10A3A12E283A15B73FC2D240D43A6274FDCECBFF1AB7061E299833A532EEF9A687D520BBDF6CC4BD
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2729920/content
Preview:	.PNG........IHDR...............@.. .IDATx^...TU.._.w.....Y.KP@Q.........,@D..P..a.n...Z:..{q.......sg...g.t...s....{..s..?... .. .. .. .. ....@....c. .. .. .. .. ...0.B................0..................................... .S",.....................................`..................0%.2................0..................................... .S",.....................................`..................0%.2................0..................................... .S",.....................................`..................0%.2................0..................................... .S",.....%p....q.>.H...eN.o......w......8.F.KW.R...)w.T.xp...nS.d.({...L..-...=O......0a..6]cU.......K........I.6...W..^.{...[.}.>....U.....z....>...'...'o...'..^6........~yKg..[..P.TI(S...A9....p....GL.:.. C..7...3....h..z..y.a..w...o?,O.v..A#.R./wP.....>........i..1.x..F...RT.HZ....a..)_...SA..1?%.b.Sr.U...e..E\|f[.u..<.\...^.[..j.........E.....19=.4..'a...L:y.j..g6..%...h....nZ

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\content[2].png Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 160 x 160, 8-bit/color RGBA, non-interlaced
Category:	downloaded
Size (bytes):	53544
Entropy (8bit):	7.992526585033423
Encrypted:	true
SSDEEP:	768:NP8LyKdxQYSo+5nhCpf4bSMRqNSWkHg1QPFGuol8J/KotNJkHlnjUY:N8ZTUnhs4bVRQS+QPFG9OhNJkpwY
MD5:	B901DB41CAC7DA8AA51FBE4E8FFBBD64
SHA1:	245AAD2E983BE0A814BBB436586B974E8B651D6B
SHA-256:	764577B37AFDC6FA35C3C07378EFA76DCD3884FB370BBCA55469F93EAB08283E
SHA-512:	3035EE8B9554991280F8249DFA135FE6B318CFFC479EC07B1B05D36FD8225AD6BCFE63C571C1DB392683ED200CD0EB39DBA4104ED8B0B40D33AF94EC5A28CABB
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/delegate/services/file/2732599/content
Preview:	.PNG........IHDR...............g-.. .IDATx^t.Y.dWv..r..7.5....F7...).5..,....._...ClR.e..v....Mj`P.H..E....l.1...P...y\|U.._..9..u...y....Q...p..}.^{..I..o..0..d2. ..@B........\|"....>.....=.c<....~\|....o{....F.H ..SC>..DR?#L.1=.@..s...{..=_..r..I"..g...........@. ..>.>.~..!.......6F...H..Z...y...3.!?'...w..r.g.%.E.....2wy)$0...pml..}....]t.t.\{>.]'.Y...}J%Sv......Ek....RZ.q"..u.....zOw....\|...-...o\....7...d7p...........D......c.O.-pd..5L.5t..,..w[8.%...../.}.[,...7....h1..D.b..#.M.........3h{......=.6[t.f.2.op~}.!&.i...).Qn.G.._..'..i.2^....l.......{..).\.k.\wc..v.....[9.........{..(n.=..4....87A..8.G....7.d..]_,.....D.e.L...01.].[d.\|...s...`.......Er^.;S^.?......... AO.DJ..;.Y....k...=.B...m..q..#..sYx]Ig.....D.......Z.3.>.B.{.o..5.{1...z.w...[3o@qcr!-...h...\...7.x...%&..>#.\|.rV'....N..R..Y...r.n.L.}..n.{....]......+.@...x`w.....J*D........"O.w..:4N.Z.!.....w.B......2.].X.d..^\|$.$..>\|....4: c7.mh.A.]...!\...c.7DJ..{.~..JL<.mj.s.4

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\dnserror[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	HTML document, UTF-8 Unicode (with BOM) text, with CRLF line terminators
Category:	downloaded
Size (bytes):	2997
Entropy (8bit):	4.4885437940628465
Encrypted:	false
SSDEEP:	48:u7u5V4VyhhV2lFUW29vj0RkpNc7KpAP8Rra:vIlJ6G7Ao8Ra
MD5:	2DC61EB461DA1436F5D22BCE51425660
SHA1:	E1B79BCAB0F073868079D807FAEC669596DC46C1
SHA-256:	ACDEB4966289B6CE46ECC879531F85E9C6F94B718AAB521D38E2E00F7F7F7993
SHA-512:	A88BECB4FBDDC5AFC55E4DC0135AF714A3EEC4A63810AE5A989F2CECB824A686165D3CEDB8CBD8F35C7E5B9F4136C29DEA32736AABB451FE8088B978B493AC6D
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/dnserror.htm?ErrorStatus=0x800C0005&DNSError=1460
Preview:	.<!DOCTYPE HTML>..<html>.. <head>.. <link rel="stylesheet" type="text/css" href="NewErrorPageTemplate.css" >.. <meta http-equiv="Content-Type" content="text/html; charset=UTF-8">.. <title>Can’t reach this page</title>.. <script src="errorPageStrings.js" language="javascript" type="text/javascript">.. </script>.. <script src="httpErrorPagesScripts.js" language="javascript" type="text/javascript">.. </script>.. </head>.... <body onLoad="getInfo(); initMoreInfo('infoBlockID');">.. <div id="contentContainer" class="mainContent">.. <div id="mainTitle" class="title">Can’t reach this page</div>.. <div class="taskSection" id="taskSection">.. <ul id="cantDisplayTasks" class="tasks">.. <li id="task1-1">Make sure the web address <span id="webpage" class="webpageURL"></span>is correct</li>.. <li id="task1-2">Search for this site on Bing</li>..

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\down[1] Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	PNG image data, 15 x 15, 8-bit colormap, non-interlaced
Category:	downloaded
Size (bytes):	748
Entropy (8bit):	7.249606135668305
Encrypted:	false
SSDEEP:	12:6v/7/2QeZ7HVJ6o6yiq1p4tSQfAVFcm6R2HkZuU4fB4CsY4NJlrvMezoW2uONroc:GeZ6oLiqkbDuU4fqzTrvMeBBlE
MD5:	C4F558C4C8B56858F15C09037CD6625A
SHA1:	EE497CC061D6A7A59BB66DEFEA65F9A8145BA240
SHA-256:	39E7DE847C9F731EAA72338AD9053217B957859DE27B50B6474EC42971530781
SHA-512:	D60353D3FBEA2992D96795BA30B20727B022B9164B2094B922921D33CA7CE1634713693AC191F8F5708954544F7648F4840BCD5B62CB6A032EF292A8B0E52A44
Malicious:	false
Reputation:	low
IE Cache URL:	res://ieframe.dll/down.png
Preview:	.PNG........IHDR...............ex....PLTE....W..W..W..W..W..W..W..W..W..W..W..W..W.U..............W..W.!Y.#Z.$\.'].<r.=s.P..Q..Q..U..o..p..r..x..z..~.............................................b.............................................................................................................................................................................................................$..s...7tRNS.a.o(,.s....e......q*...................................F.Z....IDATx^%.S..@.C..jm.mTk...m.?\|;.y..S....F.t...,.......D.>..LpX=f.M...H4........=...=..xy.[h..7....7.....<.q.kH....#+....I..z.....'.ksC...X<.+..J>....%3BmqaV...h..Z._.:<.Y_jG...vN^.<>.Nu.u@.....M....?...1D.m~)s8..&....IEND.B`.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\event[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	exported SGML document, ASCII text, with CRLF line terminators
Category:	downloaded
Size (bytes):	10028
Entropy (8bit):	5.0601765478213165
Encrypted:	false
SSDEEP:	192:QabLdFSjRbJFStp3ZCYcqE7ZbuR7W16l7U7nQ+KdQgN3ZJVtBnTFJ2vS7lqM+yIc:QabLdFSN2tp3ZCJqE7ZbuR7W16l7U7n2
MD5:	6F3D2EA9F6BABE5D5C76A8EE657E38E3
SHA1:	EC87ECAE49148C46B400715B5155DCDC7F92E84C
SHA-256:	8D3F4AE7F18161C78BFDB9FBD3EFDD9406FD7ABEFFBD9EFDBC0D1746DB18E0C0
SHA-512:	575F4927985A04CA3172E04FE1BCFEC82CFB81DE25B743AC6A9245DDD5407E8D8B14C0C545A1B4F047FA4901A173F38591ADF8A47D7E1A6BAC178104EA8770D3
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/event.js?14
Preview:	..if (browser_NS4)..browser_Path =browser_PathNS4;..else..if (browser_IE)..browser_Path =browser_PathIE;..else..if (browser_DOM)..browser_Path =browser_PathDOM;..else..if (browser_IE4)..browser_Path =browser_PathIE;..else..if (browser_IE4M)..browser_Path =browser_PathIE;..else..browser_Path =browser_PathIE;..document.write("<SCR" + "IPT LANGUAGE='JavaScript1.2' SRC='" + browser_Path + "event.js' TYPE='text/javascript'><\/SCR" + "IPT>");..event_OnLoadArray =new Array();..event_OnUnloadArray =new Array();..event_OnFocusFormArray =new Array();..event_OnBlurFormArray =new Array();..event_OnFocusArray =new Array();..event_OnBlurArray =new Array();..event_MouseDownArray =new Array();..event_MouseUpArray =new Array();..event_MouseOverArray =new Array();..event_MouseMoveArray =new Array();..event_DblClickArray =new Array();..event_KeyPressArray =new Array();..event_KeyUpArray =new Array();..event_KeyDownArray =new Array();..event_ValidationArray =new Array();..event_CurrentField =null;..ev

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\favicon[1].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 4 icons, 64x64, 32 bits/pixel, 32x32, 32 bits/pixel
Category:	downloaded
Size (bytes):	32988
Entropy (8bit):	3.8050563023677704
Encrypted:	false
SSDEEP:	384:2W9PotfNe+3X5daBPZOMKV0K1/YZfeAD9cI:2Yu9datZO7VvY4AD
MD5:	D63D84BB622C2762367E34F6F4C2E29D
SHA1:	8A13F1B53DD707999C634CD2008FE4C159149FA9
SHA-256:	859B8D4EC15CAE867394E0F214764F18C826AC99CE3DC8AF92F8BC3DAD79F5AC
SHA-512:	634A4F54BE3BBD0306EF5CE3B50919B21499CB481FD22E54E437A97815858BBFE8AB6CCD4DF41FD7BED4659CDB669FE5FC4F013EE2413E4B205BE51E0A7B4401
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/images/favicon.ico
Preview:	......@@.... .(@..F... .... .(...n@........ .(....P........ .(....Y..(...@......... ..........................................................................................................&...).2..U.(.x.(...)...'..(..(..&..&..&..&..&..(..&..(..(...)...(...'.o.).K..+.'............................................................................................................................................... ...).2.(.f.)...(..&..)......+...+...+.........)...)...)...)...)...)...)............+...+...+......(...&..(...)...).W..$.................................................................................................................,...).X.(...)..)...+...+......)...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(...)...)......+...+...&...)..(....C.9......................................................................................m$....T.)...)..+...+...*...(...(...(...(...(...(...(...(...(...(...(...(...(...(...(

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\favicon[2].ico Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	MS Windows icon resource - 1 icon, 16x16, 24 bits/pixel
Category:	downloaded
Size (bytes):	894
Entropy (8bit):	3.7538571494290682
Encrypted:	false
SSDEEP:	24:tJaNnfoW/QyHFFrNg9TUUUUUUUUUUUUU/:XOfoW1HFFr2S
MD5:	318790DAB1F2FC38B31D1E9D2F61938B
SHA1:	20149F8C9F8BD610AC75DA7F9B34C60F1D1F38B5
SHA-256:	D2CB7CC01A7895378CB9C907C3F912085F2EA7F2FA14AABB5F7638B631C6EC0B
SHA-512:	CBA7D53AE4732D2EDF91F46AABE979353A80E46D0E79F2186E08A974F914B6A93DD7438E7AC0B362F79A4FABBA8B891B59238B64214B3F31174949A4CAE5363C
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/images/icons/favicon.ico?14
Preview:	..............h.......(....... ...........@...........................................................................qq.?..3..3..3..3..3..3.f3&YLL................?..3..?..?..3..L..?..3..L..?..3.L3&.............3..L&.....?......?....r.3.f3..............3..L&.....L.....L....3..3.f3..............3..L&....Y.?.....f.3...f...3.f3..............3..3..3..3.rY?.L3.3.Y.rL.f?..YrYh3..............3..3..3....ff?.?.&...?..3.?..ffYf3..............3..Y33...?.rf?....L&rrLf.L3..&..j3..............3.L...3....L.r.3.?..3..Y.r&..?..f3..............3..3.&...L&.L&...rYf?........ffYf3..............3.?...?.3.....&.....?..3.....rY3f3..............3.rY3rY?.?.frY...L...3..3..3..3.f3..............3..L&.L3.3..Y?L.fL...3..3..3..3.f3..............3.Y.ftY?&.....3..3...3..3..3..3.f3..............3..3.Y.f.L&.3..3..3..3..3..3..3..~......................................................................

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\fira-sans-v8-latin_latin-ext-300[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), Fira Sans Light family
Category:	downloaded
Size (bytes):	50887
Entropy (8bit):	7.977260019567643
Encrypted:	false
SSDEEP:	768:t2srfLPTcSiBvgY67nTsDGb8m9vtuinPYzM77CYM12YQ3VBKoMBGttbooJWyjG4j:t2srLoNBvgjTsD81SM63Mr5ltXzd
MD5:	A42B5B54572F6E5D8E9C2D13D2BD1E8B
SHA1:	3A72C57083ABE217BD76453BC07CBD453FF2D15F
SHA-256:	AFE7198C0ACAC6727AA37A0BB0C6C6B1B54D65A4A9408B5F44A8A63CEE2B0F86
SHA-512:	2E2C9A590D0CFF2E85216E692438C3DD43F1A2675F10749D7944154560BA6058FE888937B4B762ED130C4AB60FD1E8AC5B063DDBAF1D712A6B00001427D447E2
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/css/fonts/fira-sans/fira-sans-v8-latin_latin-ext-300.eot?
Preview:	............................,.....LP/.. ............... ....D.......................F.i.r.a. .S.a.n.s. .L.i.g.h.t.....R.e.g.u.l.a.r.....V.e.r.s.i.o.n. .4...2.0.3.....F.i.r.a. .S.a.n.s. .L.i.g.h.t.....BSGP..................^..............`.g.iSzwxy&U:.47.6tH8(b..9"..`...J. 6.`4...dv.wt......+TW.^.=M8^!.c............=^.N..5...G7.._..6...!h.go=E9_.JV.......M,.....l....d{5.K.E...Qv..E......6...u..o1=I......`.x.$.J..E.W.......Y.P.......Ov...R.;.n.nh..Bt=..., ..A.\|..M..>..o.Dd..:.W0f{...0.....Eg..w.0..by.YD.Dw....Z...m2...y.&...(..x.."..B.....>..g!.....*8o=c.I..w.x.%\....D.h-^.-`.Z..+.B7_P.`..?........a...>%.M0...Hk...!}z%..._.5...dIN.......l.6..9..a.@]$L.OV".1a.w3.....6p2T .#l....<.%.x....0z4.Fx...[p.%.2N....a?.....~P..@1)M...I.^.(.....j...`...d..9....8..P...$.v........a.2......K.O.u.Z)..l...l".....mD..,.YD.e...1zO..{.xe..O.-..&..QK{.s%.Rc}.u..g.._A.,.....Y.j.E...0H..t.e......Y.....r.T%2#...y..P.........Z#...i.D:#...9;$k.....w#.....).X.h..$....4lQ.

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\fontawesome-webfont[1].eot Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	Embedded OpenType (EOT), FontAwesome family
Category:	downloaded
Size (bytes):	56006
Entropy (8bit):	7.982832242681074
Encrypted:	false
SSDEEP:	768:tF0fRcvIjbMAUAu6xtp2p1PTtr12qy7OY+s3kNGQQpVovprhqouP/Y8o0z8ez4VF:/0Cg35P9sPBr1k2sU+wprk2ldTKk7
MD5:	7149833697A959306EC3012A8588DCFA
SHA1:	0183979056F0B87616CD99D5C54A48F3B771EEE6
SHA-256:	E511891D3E01B0B27AED51A219CED5119E2C3D0460465AF8242E9BFF4CB61B77
SHA-512:	3D0D435310306C977BFA7FAF3BE358E7184A27D7F83688131D295378F6EE0FE053AFAA0C1E5FBC9C00EB24787E8239F4B0D4D7B339B5576E3C4B1FE741906415
Malicious:	false
Reputation:	low
IE Cache URL:	https://ca.rbcwealthmanagement.com/da-epic-theme/themes/da-slate/_wmos/fonts/fontawesome-webfont.eot?
Preview:	..................................LP..........................$.....................F.o.n.t.A.w.e.s.o.m.e.....R.e.g.u.l.a.r...$.V.e.r.s.i.o.n. .4...2...0. .2.0.1.3...&.F.o.n.t.A.w.e.s.o.m.e. .R.e.g.u.l.a.r.....BSGP..................~.........`......Y.D.M.F..x...>........)[..1.H..-A)F...1..../.S7.U.'.&a..;a.#71.^...wR.. .P...r...o....b..R.6....l..n._Up.!........b......h.,7z..U.........].)..WF..(...VH..# ....j.2..l.Q..T&...j..9.._..[."L......... aA.ynF.......e.....Ga.1E. a.b.0....8zSA..-.......=7..Ex..Cr....06.,..R~>..cI:.S..`5..n.(TefX`...@..A...L...=.C.=..e.<.'f.sH.'.e.i/"x. ..X@l.W.!b..8R.8.j.a.eFUkL.....I....'.Z.......@..I.3H...p.GH.......@Yi@..i..S.w.0...b..@Xoy..{..f...h..U..h..L....l...... N.1{....)e.T....0R..n...../S.c.PV..z6%f}.4.C...&....W..'.,.A.......@Q%....F.`.Th.]...3......X)@.VZ=F.Y.\'S.Ngx...,...'........b.R.m.....j...[.b..0A....NM.$...X.m....YQ....v..a..iT3...CT...#...8EFM2*.....+$.I.)>.7..=...+...b..t_.:.>RfH.U.6b.....[..~Y%,.3j...

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\fonts.Roboto[1].css Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ASCII text
Category:	downloaded
Size (bytes):	2363
Entropy (8bit):	5.051523997326608
Encrypted:	false
SSDEEP:	48:UOWampFVLyXcAcGa3b/OLaxackVLyMLcM0cbaUBbVOgr+J+FguNvgNKgQgogq:UOWampFVLysxZr/OLahkVLyM4MdmU1Vn
MD5:	B8991D6464AB3123FFCE6D4C937EB1A0
SHA1:	0208D46FCDBEB1667653A583EFBA7108454EB525
SHA-256:	76FEBA3194D8795F4E92F171A59D7365F1845533E2F935738C4DC27E1977D113
SHA-512:	09C14AD308B1775F2F0F1D4BE3FCDE84C8F9E170CDB19FB5745B05BDBC9A496CA44A82EF5CAA3EE36F2A86F17BED1C8360D38A7912AA173C190C1F7381F5230B
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/3m/css/fonts/fonts.Roboto.css?14
Preview:	@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 300;. src: url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.eot'); /* IE9 Compat Modes /. src: local('Roboto Light'), local('Roboto-Light'),. url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.eot?#iefix') format('embedded-opentype'), / IE6-IE8 /. url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.woff2') format('woff2'), / Super Modern Browsers /. url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.woff') format('woff'), / Modern Browsers /. url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.ttf') format('truetype'), / Safari, Android, iOS /. url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-300.svg#Roboto') format('svg'); / Legacy iOS /.}.@font-face {. font-family: 'Roboto';. font-style: normal;. font-weight: 400;. src: url('/uos/3m/css/fonts/Roboto/roboto-v18-latin_latin-ext-regular.eot'); / IE9 Compat Mo

C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\IE\9QTQHWWN\header_dates[1].js Download File
Process:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
File Type:	ISO-8859 text
Category:	downloaded
Size (bytes):	604
Entropy (8bit):	4.992709834096425
Encrypted:	false
SSDEEP:	12:AMomDPXvIbPfi6J6z2Dt0qQkIy9rl6zYyDUBSVwAjQXq03:GmDKHlJVDtYkPrIzYyvwEQZ
MD5:	563E211CBF8D209807CDE3081E61C027
SHA1:	27AFE688D419CF541E47385770DD27978FBE041B
SHA-256:	52959D41A6AA710709B4C41BA59EF90D167A8F523585BB69EA07092288030D78
SHA-512:	8FEE27402CCB5A4C4A0D5F2C77FA631D40C3E14E3331137ADAAEE7E42B5D715BDCD29BAA823CE8F77B29164FE28024F624746A2A340DF9188558F89B7EEA3FFB
Malicious:	false
Reputation:	low
IE Cache URL:	https://www1.royalbank.com/uos/common/javascript/header_dates.js?14
Preview:	function dates_currentDate(lang ).{.var monthName =new Array("January","February","March","April","May","June","July","August","September","October","November","December" );.var sep =' ';.if(lang =="FRENCH" ).{.var monthName =new Array("janvier","f.vrier","mars","avril","mai","juin","juillet","ao.t","septembre","octobre","novembre","d.cembre" );.var sep =' ';.}.var d =new Date().var day =d.getDate().var mon =monthName[d.getMonth()].var year =d.getFullYear()..if(lang =="FRENCH" ).{. document.write(day + sep + mon + sep + year );.}.else.{. document.write(mon + sep + day + ',' + sep + year );.}..}.

Static File Info

No static file info

Network Behavior

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Feb 2, 2021 20:10:45.678822041 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.680417061 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.829056025 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.829085112 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.829161882 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.829216957 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.834912062 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.835102081 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.985783100 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.985800982 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987108946 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987132072 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987148046 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987164021 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987175941 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.987193108 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.987235069 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.987270117 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.988035917 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.988064051 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.988143921 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.988157034 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.988171101 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.988193035 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.988205910 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:45.988226891 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:45.988265991 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.023201942 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.029866934 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.039140940 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.172432899 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:46.172565937 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.188483953 CET	443	49723	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:46.188610077 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:46.216392994 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038367987 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038397074 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038418055 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038438082 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038491011 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038496017 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038513899 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038537025 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038559914 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038562059 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038583994 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038608074 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038618088 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038646936 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038655043 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.038674116 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.038707018 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.188652992 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188677073 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188688993 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188705921 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188728094 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188744068 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.188852072 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.188937902 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.249191999 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.249866009 CET	49723	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.251624107 CET	49728	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.252444983 CET	49729	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.253429890 CET	49730	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.255399942 CET	49731	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.396040916 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403045893 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403084040 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403110027 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403141022 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403171062 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403192997 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403197050 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403223991 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403250933 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403263092 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403280020 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403296947 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403306007 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403331995 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403333902 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403363943 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403373957 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403393984 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403397083 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403415918 CET	443	49728	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403429031 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403443098 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403454065 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403470039 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403491020 CET	443	49729	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403517008 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403532982 CET	49728	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403542995 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403553009 CET	49724	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403575897 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403585911 CET	49729	443	192.168.2.6	104.153.58.105
Feb 2, 2021 20:10:50.403605938 CET	443	49724	104.153.58.105	192.168.2.6
Feb 2, 2021 20:10:50.403615952 CET	49724	443	192.168.2.6	104.153.58.105

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class
Feb 2, 2021 20:10:45.602797031 CET	192.168.2.6	8.8.8.8	0xcee4	Standard query (0)	ca.rbcwealthmanagement.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.547909975 CET	192.168.2.6	8.8.8.8	0x1419	Standard query (0)	stats.g.doubleclick.net	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.895001888 CET	192.168.2.6	8.8.8.8	0x5670	Standard query (0)	www.google.co.uk	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:54.921695948 CET	192.168.2.6	8.8.8.8	0xbda7	Standard query (0)	js-agent.newrelic.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:55.211549997 CET	192.168.2.6	8.8.8.8	0xb8b4	Standard query (0)	bam.nr-data.net	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:01.886123896 CET	192.168.2.6	8.8.8.8	0xee1b	Standard query (0)	ca.rbcwealthmanagement.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:03.943464994 CET	192.168.2.6	8.8.8.8	0x449	Standard query (0)	www.rbcds.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:06.033993006 CET	192.168.2.6	8.8.8.8	0x4d1d	Standard query (0)	cdn.rbcgam.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:26.520071030 CET	192.168.2.6	8.8.8.8	0x439c	Standard query (0)	www1.royalbank.com	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:27.082710028 CET	192.168.2.6	8.8.8.8	0x958a	Standard query (0)	d3tracking.rbc.com	A (IP address)	IN (0x0001)

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class
Feb 2, 2021 20:10:45.665524006 CET	8.8.8.8	192.168.2.6	0xcee4	No error (0)	ca.rbcwealthmanagement.com		104.153.58.105	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.617660046 CET	8.8.8.8	192.168.2.6	0x1419	No error (0)	stats.g.doubleclick.net	stats.l.doubleclick.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:10:53.617660046 CET	8.8.8.8	192.168.2.6	0x1419	No error (0)	stats.l.doubleclick.net		108.177.15.157	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.617660046 CET	8.8.8.8	192.168.2.6	0x1419	No error (0)	stats.l.doubleclick.net		108.177.15.155	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.617660046 CET	8.8.8.8	192.168.2.6	0x1419	No error (0)	stats.l.doubleclick.net		108.177.15.154	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.617660046 CET	8.8.8.8	192.168.2.6	0x1419	No error (0)	stats.l.doubleclick.net		108.177.15.156	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:53.963340044 CET	8.8.8.8	192.168.2.6	0x5670	No error (0)	www.google.co.uk		172.217.23.3	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:54.969542980 CET	8.8.8.8	192.168.2.6	0xbda7	No error (0)	js-agent.newrelic.com	f4.shared.global.fastly.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:10:55.262692928 CET	8.8.8.8	192.168.2.6	0xb8b4	No error (0)	bam.nr-data.net		162.247.242.21	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:55.262692928 CET	8.8.8.8	192.168.2.6	0xb8b4	No error (0)	bam.nr-data.net		162.247.242.18	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:55.262692928 CET	8.8.8.8	192.168.2.6	0xb8b4	No error (0)	bam.nr-data.net		162.247.242.20	A (IP address)	IN (0x0001)
Feb 2, 2021 20:10:55.262692928 CET	8.8.8.8	192.168.2.6	0xb8b4	No error (0)	bam.nr-data.net		162.247.242.19	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:01.933900118 CET	8.8.8.8	192.168.2.6	0xee1b	No error (0)	ca.rbcwealthmanagement.com		104.153.58.105	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:04.009102106 CET	8.8.8.8	192.168.2.6	0x449	No error (0)	www.rbcds.com	rbcds.com		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:11:04.009102106 CET	8.8.8.8	192.168.2.6	0x449	No error (0)	rbcds.com		69.46.111.120	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:06.138046026 CET	8.8.8.8	192.168.2.6	0x4d1d	No error (0)	cdn.rbcgam.com	rbcwm-framework.azureedge.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:11:06.138046026 CET	8.8.8.8	192.168.2.6	0x4d1d	No error (0)	scdn11fbd.wpc.7f22e.lambdacdn.net	sni1gl.wpc.lambdacdn.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:11:06.138046026 CET	8.8.8.8	192.168.2.6	0x4d1d	No error (0)	sni1gl.wpc.lambdacdn.net		152.199.21.175	A (IP address)	IN (0x0001)
Feb 2, 2021 20:11:26.605667114 CET	8.8.8.8	192.168.2.6	0x439c	No error (0)	www1.royalbank.com	www1.royalbank.com.georbc.akadns.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:11:27.143364906 CET	8.8.8.8	192.168.2.6	0x958a	No error (0)	d3tracking.rbc.com	h-d3tracking.rbc.online-metrix.net		CNAME (Canonical name)	IN (0x0001)
Feb 2, 2021 20:11:27.143364906 CET	8.8.8.8	192.168.2.6	0x958a	No error (0)	h-d3tracking.rbc.online-metrix.net		185.32.241.65	A (IP address)	IN (0x0001)

HTTP Request Dependency Graph

www.rbcds.com

Code Manipulations

Statistics

Behavior

• iexplore.exe
• iexplore.exe

Click to jump to process

System Behavior

Analysis Process: iexplore.exe PID: 4676 Parent PID: 792

General

Start time:	20:10:42
Start date:	02/02/2021
Path:	C:\Program Files\internet explorer\iexplore.exe
Wow64 process (32bit):	false
Commandline:	'C:\Program Files\Internet Explorer\iexplore.exe' -Embedding
Imagebase:	0x7ff721e20000
File size:	823560 bytes
MD5 hash:	6465CB92B25A7BC1DF8E01D8AC5E7596
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Analysis Process: iexplore.exe PID: 4692 Parent PID: 4676

General

Start time:	20:10:42
Start date:	02/02/2021
Path:	C:\Program Files (x86)\Internet Explorer\iexplore.exe
Wow64 process (32bit):	true
Commandline:	'C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE' SCODEF:4676 CREDAT:17410 /prefetch:2
Imagebase:	0x1210000
File size:	822536 bytes
MD5 hash:	071277CC2E3DF41EEEA8013E2AB58D5A
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	low

Show Windows behavior

File Activities

Show Windows behavior

Registry Activities

Disassembly

Description:	Adversaries may gain access to a system through a user visiting a website over the normal course of browsing. With this technique, the user's web browser is typically targeted for exploitation, but adversaries may also use compromised websites for non-exploitation behavior such as acquiring Application Access Token .
Tactics:	Initial Access
Data Sources:	Network device logs, Network intrusion detection system, Packet capture, Process use of network, SSL/TLS inspection, Web proxy
Platforms:	Linux, macOS, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Data loss prevention, File monitoring
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	API monitoring, DLL monitoring, File monitoring, Named Pipes, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Binary file metadata, File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system. Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	API monitoring, PowerShell logs, Process command-line parameters, Process monitoring
Platforms:	macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	File monitoring, Process command-line parameters, Process monitoring
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Malware reverse engineering, Netflow/Enclave netflow, Packet capture, Process monitoring, Process use of network, SSL/TLS inspection
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use a non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Host network interface, Netflow/Enclave netflow, Network intrusion detection system, Network protocol analysis, Packet capture, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may communicate using application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	DNS records, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Files may be copied from an external adversary controlled system through the command and control channel to bring tools into the victim network or through alternate protocols with another tool such as FTP. Files can also be copied over on Mac and Linux with native tools like scp, rsync, and sftp.
Tactics:	Command and Control
Data Sources:	File monitoring, Netflow/Enclave netflow, Network protocol analysis, Packet capture, Process command-line parameters, Process monitoring, Process use of network
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading ...

Warning!

Analysis Report https://ca.rbcwealthmanagement.com/jim.seyers/blog/2791668-2021-TFSA--RRSP-Contributions

Overview

General Information

Detection

Signatures

Classification

Analysis Advice

Startup

Malware Configuration

Yara Overview

Sigma Overview

Signature Overview

Phishing:

Compliance:

Spreading:

Networking:

System Summary:

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

Contacted IPs

Public

Private

General Information

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASN

JA3 Fingerprints

Dropped Files

Created / dropped Files

Static File Info

No static file info

Network Behavior

TCP Packets

DNS Queries

DNS Answers

HTTP Request Dependency Graph

Code Manipulations

Statistics

Behavior

System Behavior

Analysis Process: iexplore.exe PID: 4676 Parent PID: 792

General

File Activities

File Created

File Written

File Read

Registry Activities

Key Created

Key Value Created

Key Value Modified

Analysis Process: iexplore.exe PID: 4692 Parent PID: 4676

General

File Activities

File Created

File Written

File Read

Registry Activities

Key Created