{ "type": "Domain", "indicator": "s.properties", "general": { "sections": [ "general", "geo", "url_list", "passive_dns", "malware", "whois", "http_scans" ], "whois": "http://whois.domaintools.com/s.properties", "alexa": "http://www.alexa.com/siteinfo/s.properties", "indicator": "s.properties", "type": "domain", "type_title": "Domain", "validation": [], "base_indicator": { "id": 3162389335, "indicator": "s.properties", "type": "domain", "title": "", "description": "", "content": "", "access_type": "public", "access_reason": "" }, "pulse_info": { "count": 11, "pulses": [ { "id": "6a135614ee83fa05ff58af66", "name": "Validated: Cybercrime - #Alberta Compromise", "description": "Validated: Cybercrime - UofA BEC/ATO -> UAlberta Alfresco & Edmonton Police Compromise (HR Files) & TX - 05.24.26 - edit", "modified": "2026-05-24T19:48:36.416000", "created": "2026-05-24T19:48:36.416000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Government", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 60, "FileHash-SHA1": 59, "FileHash-SHA256": 1097, "IPv4": 397, "domain": 341, "hostname": 407 }, "indicator_count": 2561, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "7 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a10a079d3a0831710f3a0ab", "name": "Catastrophic DataBreach confirmed - UAlberta & Edmonton Police Services - 05.22.26", "description": "BEC/ATO (reported) and unauthorized use & abuse of Stolen Identity/Access/Credentials from the University of Alberta has been demonstrated as the cause of catastrophic Data-Breaches across the ualberta[.]ca domain and Edmonton Police Services (EPS).\nData is comprehensive, includes HR Records, PII/PHI, employment data, addresses, contact information.", "modified": "2026-05-22T18:29:13.092000", "created": "2026-05-22T18:29:13.092000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 61, "FileHash-SHA1": 60, "FileHash-SHA256": 1032, "IPv4": 393, "domain": 340, "hostname": 387 }, "indicator_count": 2473, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0bff94564a0098e02ab37d", "name": "Alfresco Archive // b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6 - 05.19.26", "description": "The full list of Edmonton police officers, officers and staff, as part of the city's Police Complaints Commission (PCC), has been released.", "modified": "2026-05-19T06:16:59.932000", "created": "2026-05-19T06:13:40.134000", "tags": [ "UAlberta", "Edmonton", "Edmontonpolice", "EPS", "YEG" ], "references": [ "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127/iocs", "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark", "b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 58, "FileHash-SHA1": 57, "FileHash-SHA256": 952, "IPv4": 393, "URL": 200, "domain": 340, "hostname": 367 }, "indicator_count": 2367, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "12 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "14 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a09b3b462c09a8bf0daa85b", "name": "Credit: Disable_Duck [\"UAlberta alfresco management\"]", "description": "", "modified": "2026-05-17T12:25:24.282000", "created": "2026-05-17T12:25:24.282000", "tags": [ "note", "home", "lucene paths", "json descriptor", "lucene path", "company home", "actividades", "pageuser", "sie knnen", "sie auf", "link klicken", "recente", "u kunt", "attivit", "possibile", "activits", "vous", "report", "web link", "cvs report", "link", "chs placement", "chs student", "placement", "team", "google form", "university", "alberta", "automation", "please", "following", "followers", "ihnen", "mitarbeitern", "mitarbeiter", "hello", "foreign visitor", "fvca", "human resource", "fvca assessment", "incomplete", "regards", "klik", "wachtwoord", "mijn profiel", "klik op", "hoogachtend", "alfresco", "bonjour", "cliquez sur", "nous", "pour ce", "mon profil", "changer", "invito", "caro", "fare", "password", "il mio", "cambia password", "per rifiutare", "cordiali saluti", "my profile", "change password", "konto", "sie erstellt", "passwort", "wir legen", "ihnen nahe", "passwort bei", "anmeldung zu", "ndern", "gehen sie", "mmm yyyy", "nome utente", "nombre", "contrasea", "para hacerlo", "mi perfil", "atentamente", "account", "alfresco share", "hola", "haga", "los datos", "y seleccione", "si desea", "click", "einladung von", "hallo", "sie eingeladen", "site", "klicken sie", "konto fr", "alfresco client", "kofax index", "inhaltselement", "zur site", "gren alfresco", "pledged gift", "office", "advancement", "datetime", "university vpn", "date", "shared", "support", "auxiliary", "process", "priority", "medium high", "pay action", "sincerely", "uofa ecm", "link um", "aufgaben stehen", "verfgung", "prioritt", "niedrig mittel", "hoch", "klicken", "aufgabe zu", "il seguente", "disponibile", "priorit", "bassa media", "alta", "clicca", "clicca su", "la tche", "tre rcupre", "basse moyenne", "leve", "cliquez", "cordialement", "prioriteit", "laag gemiddeld", "hoog", "la siguiente", "prioridad", "media alta", "saludos", "kb content", "links content", "content url", "download url", "webdav url", "ttulo", "descripcin", "ninguno", "ninguna", "creador", "creado", "modificador", "modificado", "tamao", "webdav", "titre", "aucun", "aucune", "modificateur", "modifi", "taille", "ko liens", "du contenu", "dossier du", "url webdav", "titolo", "nessuno", "nessuna", "creato", "modificato", "dimensioni", "kb link", "al contenuto", "cartella", "ingen", "beskrivelse", "tittel", "opprettet", "modifikator", "modifisert", "strrelse", "lenker for", "innhold mappe", "descrio", "nome", "nenhum", "nenhuma", "criador", "criado", "tamanho", "geen", "beschrijving", "titel", "maker", "gemaakt", "gewijzigd", "grootte", "contenturl", "downloadurl", "beschreibung", "url zum", "keiner", "keine", "ersteller", "erstellt", "bearbeiter", "gendert", "kb links", "download", "navigatebrowse", "pagesite", "readme file", "yesno", "user name", "main", "function", "log debug", "record", "sample rm", "import", "njson", "forms", "sites", "documenttype", "commonfolder", "error", "value", "jsonfile", "service", "false", "moving", "prop", "null", "bearer", "uappol", "uappol function", "contentid", "param", "id var", "call", "post request", "json", "config", "coveo", "uappol metadata", "content id", "and not", "loads", "update", "uploader", "inbox", "rnrn", "create", "contenteml", "inbox folder", "number", "normal", "textpart", "backup", "createchildren", "backupname", "childlist", "name", "content", "array", "write", "childname2", "childname3", "childname4", "reviewgroup", "groupsite", "starting", "started", "delete email", "command", "found", "create content", "resources", "unknown command", "globals", "var title", "rnrncopyright", "copyright", "csvtoarray", "regexp", "jsonstr", "daily", "review", "az09", "format", "hrsfilescanner", "hrs document", "fromscanner", "not type", "matches1", "employee id", "third", "tempfilename", "ldap", "version", "this", "file share", "folder", "trimlr", "namearr", "personid", "document name", "ales file", "scanned", "shared drive", "last", "document type", "document", "advising notes", "debug", "debugstr", "schedule", "descriptorpath", "web service", "inbound rule", "web services", "collaborator", "groupeveryone", "check", "index", "taskassignee", "taskenddate", "filename", "localisotime", "startdatetime", "timeperiod", "uofa edrms", "author", "descommonnode", "nomatch", "iddocumenttype", "siteid", "span", "path", "term", "core", "cap report", "template", "object", "cap mail", "dev testing", "application", "aps status", "cap generate", "monthly report", "extension", "alfresco locale", "september", "pm mdt", "school", "didx", "json response", "cap final", "rebcapiddict", "finalcapiddict", "aps process", "trigger", "chsdocument", "message", "func", "msgstr", "emailobj", "emailtemplate", "emailsubject", "sitepath", "chs docs", "studentfiles", "faculty", "true", "chssiteid", "type", "aspect", "chsdocs", "nodeidx", "find", "expired", "chs school", "defunc", "facultykey", "program", "spasite", "ldapperson", "parent name", "securitytype", "formsengg", "limit", "enggfilescanner", "stuccid", "csv file", "studdept", "supccid", "supdept", "cosupccid", "relocation", "fgsr", "records site", "fgsr doc", "department", "start fgsr", "department doc", "completion of", "oral hlth", "form", "application for", "report of", "admission", "master", "music", "unknown", "comp", "class", "leave", "supervisor", "currentline", "return", "studentid", "superccid", "revdate", "code", "apstaskproperty", "converttocsv", "aps guideline", "aps task", "newdata", "hyperlink", "certificate", "first", "info", "procid", "filecontentstr", "query sort", "create header", "person id", "subject title", "node", "studentccid", "yyyymmdd", "lookupjson", "propidx", "input date", "iso format", "folder level", "query", "duedate", "test java", "dailyschedule", "upload", "ro adm", "workflow", "offset", "adm workflow", "data length", "startindex", "json object", "aps group", "acs site", "user", "getgroupid", "am mst", "acsaps group", "user sync", "january", "start january", "february", "start february", "december", "start december", "march", "start march", "am mdt", "consumer march", "aps student", "april", "start april", "june", "start june", "pm mst", "ro backscan", "edrmsteam", "group", "group december", "aps ro", "copy file", "aps api", "maxfile", "creator", "rand", "hrsbs", "july", "august", "hrsbssyncccids", "zhrroleuserresp", "edrms", "ccids", "prefix", "createdirectory", "directory", "actionreason", "safefilename", "employeeclass", "carry", "csv data", "host", "bachelor", "college level", "mike", "propname", "maxitems", "currjson", "fvca status", "important", "prod", "manual data", "doctoratephd", "medicine", "nodename", "employeeccid", "managerccid", "employeeid", "workingtitle", "regtempdescr", "findkey", "email", "new document", "doctypelabel", "competitive bid", "bid exception", "pcm competitive", "and aspect", "competitive", "nodes", "bid update", "acommonfolder", "formspcm", "peoplesoft", "no data", "qaselectednode", "qaselected", "qanotselected", "qa folder", "preqa", "qa var", "documentcount", "passcount", "qadocument", "qa selected", "moved", "attempts", "accepted", "rm file", "plan", "rm filing", "min to", "rm system", "batch", "time limit", "rmcfg", "string", "already", "load", "valid", "graddate", "uathdep", "ccid", "title", "abstract", "embargo", "datestr", "searchresult", "alfresco afa", "admissions", "student case", "files", "and type", "institution", "inst", "json config", "institution not", "if file", "logger", "needle", "xmlstr", "staus", "document linkn", "getlogfile", "documentlist", "xml field", "not found", "addaspect", "move aspect", "duplicate file", "makes", "to max", "checks", "workflow name", "workflow link", "emplid", "due daten", "total afa", "not path", "afabundling", "change", "not aspect", "logs", "ephesoft", "document moved", "epehsoft", "xmlsourcenode", "batchsize", "filemappingpdf", "entry", "move file", "getcsvfile", "batchprocess", "logging", "completed", "document link", "groupn", "created date", "stdapl", "person", "workflow desc", "json file", "list", "lastmonth", "daily qa", "default", "qastartdate", "query language", "finished", "afa bundle", "transcriptarr", "lucene query", "qacounter", "rrfgroupname", "uaroemplid", "uaropriority", "uaroduedate", "documentlistarr", "uarmm", "profile", "courseauditform", "status", "jile", "searchmatchmove", "logfoldername", "backscanreview", "smfstr", "rosm", "converter", "shortxml", "failedcsvfolder", "xml file", "qaoperatorindex", "qaoperatorlabel", "script", "suresh", "aws promotion", "file", "tasks", "bundlingprop", "tasktype", "grps2", "uarotasktype", "comments", "test", "ro scripts", "xmlnode", "shortdescr", "xmlcont", "firstname", "orgid", "middlename", "lastname", "middle", "final", "script started", "to now", "received date", "first name", "receiveddatestr", "dateofbirthstr", "getdefination", "2005 aug", "dropbox", "foldercreate", "scan doc", "officiality", "search match", "running script", "materialextid", "studentref", "ceeb", "materialcode", "memo", "jsoncontent", "ro document", "paperfileutils", "afaconfig", "ro workflow", "paperfileconfig", "applicationjson", "formsrso", "targetfile", "property name", "pinames today", "addp", "science addp", "addp move", "ro code", "scifilescanner", "desconfnode", "grabnodeprop", "copy", "consumer", "initiators", "hiring", "consigno", "offer letter", "match", "apsmaster", "match2", "reappointment", "expiry date", "today", "finaldate", "task info", "psperson", "complete basic", "hiring info", "employee", "resultdata", "delegategroup", "delegate group", "verify", "bind", "aps appointment", "trevor report", "sfsussl", "drawdown", "refund", "reporttype", "var document", "shareurl", "newgroup", "parentgrp", "group created", "var logfile", "rule folder", "site running", "report on", "get site", "foldername", "create file", "reportlogslogs", "reportlogs", "ist site", "running report", "count", "tran", "var csvfile", "result length", "processid", "process id", "delimiters", "quoted", "standard", "starting name", "morechildren", "pdf var", "length", "newname", "fiscal", "docnamearr", "filenode", "calendar year", "versionhistory", "new doc", "web deployed", "var startdate", "startdate", "maxcount", "prevmonth", "monthcount", "application id", "delete", "get path", "if node", "search length", "arra y", "if csv", "version history", "graduate", "graduate folder", "children", "graduate file", "searchmatchdob", "career", "appl nbr", "jan04 now", "counter", "thesis", "runyear", "spring", "service log", "everything", "this determine", "thesis deposit", "archival", "problem", "filepath", "md import", "arraytocsv", "found document", "start", "food", "yumna", "start kofax", "kofax", "admin", "subject", "sample email", "execute", "koafx", "apasresponseid", "merge", "recruitment", "transcripts", "review request", "admindate", "requesteddate", "approveddate", "approvereject", "getemailbody", "taskid", "sendemail", "request status", "siteconsumer", "sitemanager", "eval", "acshost", "global env", "config file", "apsprod", "params", "alloc", "checkpath", "newpath", "adding entity", "surnamechar", "adding person", "jsonfunction", "text", "syntaxerror", "arraytoxml", "xml related", "change xml", "xmltoarray", "xmlutil", "common folder", "random2digit", "maxlimit", "jsonarchive", "very", "returns", "sitecontext", "arrcounter", "node id", "items", "array length", "therecord", "award sponsor", "rso project", "res0012345", "iso88591", "util function", "project id", "proposal id", "doc name", "newdocname", "prod url", "199899", "property", "typeprop", "barcode", "accepts", "parent", "xmlfilename", "siteconfigjson", "qabatchgrp", "signeddate", "ephdocumenttype", "json document", "qapercentage", "entity", "broker", "add error", "getexecutetime", "qaoperator", "retain title", "idnumber", "assocname", "metaarr", "fund report", "csvcontent", "input folder", "doc00c200004txg", "xmlfile", "node1", "node2", "540am", "240pm", "metadata", "var folder", "filter", "mappedobj", "09azaz", "conditionval", "foldercondition", "file name", "xmlfileobj", "alfresco prop", "setup error", "formatjson", "id property", "move", "getrandomnumber", "result", "newdoctype", "no title", "clioacs update", "clio", "patch", "system overview", "system", "overview", "purpose", "aims", "objectives", "prerequisites", "total", "expected effort", "domain", "urls", "dept param", "department name", "done", "submit form", "saving", "label", "input", "approvers", "information", "user group", "request", "group request", "users", "single family", "edmonton ab", "coverage", "common law", "step workflow", "care", "dental benefits", "direct", "web scripts", "get http", "documentation", "web script", "http method", "http", "apis", "development", "knowledge", "java", "empty argument", "e1234", "im system", "lookupentity", "configfilename", "namespace", "searchterm", "access", "jsonuser", "alfresco search", "page search", "expires", "signer", "reason", "utf8", "stripcharacter", "pull hiring", "getapsdbid", "save", "processsetidset", "saved", "returndata", "boolean", "start building", "varname", "fill", "time click", "initiated all", "submissions", "all submissions", "process landing", "page", "initiators all", "maps initiated", "post doc", "student term", "start form", "middle name", "email address", "retype", "cell", "phone no", "fellow", "secureorigin", "expand", "thank", "here", "please check", "aps list", "pang", "subset", "display", "args", "task", "username", "save form", "data need", "cdkey", "checkdict", "item", "column", "anchor", "multi", "tasks filter", "search", "trigger aps", "process api", "apsprocess", "authentication", "webscript", "getapsperson", "process info", "initsavestatus", "step0statusfail", "signer1", "signer2", "appointment", "taskjson", "groupapiaccess", "checkapiuser", "fgsrpr", "psaudit", "statusname", "unsuccessful1", "apptreappt", "emplobject", "caps aps", "cap epsb", "applicant", "form submitted", "board review", "form applicant", "school district", "start date", "cap application", "home help", "pdfa format", "larger", "upload file", "please click", "uofacap", "applications", "jstr", "processjson", "invalid url", "associate dean", "edmonton public", "october", "elk island", "reutrn false", "mapdoctypeurl", "doctype", "cap document", "doctypes", "doctypemap", "schools", "public schools", "foip", "edmonton area", "epsb", "capid", "server", "aps user", "groupcapadmin", "assignuser", "cap ea", "successfully", "please wait", "successfully ea", "apsservice", "apsserviceprod", "requireddate", "bibliography", "reb approval", "letter", "cprbls", "ahsrespect", "ahscon", "immformdocs", "picvsc", "whmis", "condissi", "hspnet", "conphoto", "conclin", "college", "health", "submission date", "effective date", "expiration date", "chs admin", "student view", "typekey", "placementdocs", "warning", "jobj", "abraniuk", "wendy", "terry harris", "directorhrsbs", "level", "holiday pay", "part time", "payroll", "salariedreg aux", "cheat", "paramname", "getallurlparams", "hrsbs config", "data dictionary", "field", "responsejson", "workflowid", "workflow id", "context", "event", "statusevent", "uaesign", "success", "permission", "progress report", "postdoctoral", "sorry", "deptjson", "fgsr student", "process status", "select", "currentuser", "reports", "student ccid", "populated", "invalid student", "supervisor ccid", "co supervisor", "due date", "freedom", "report process", "fgsr forms", "list fgsr", "report fgsr", "report sorry", "review process", "fgsr supervisor", "thesis programs", "programs", "please enter", "student id", "submit button", "var taskid", "var currentuser", "review sorry", "raheel", "added", "urlorigin", "need", "raheel var", "elmid", "commentkeyarr", "override", "menu", "colour bar", "mdphd", "absence", "completion", "mbameng", "mbamsc", "meng", "jason", "acs property", "available", "subdoctype", "test person", "test effective", "modelnodepath", "sitename", "metadatamap", "sitefile", "google addon", "gtagra", "gta gra", "zhreformengresp", "id otherwise", "university home", "indicate", "monday", "tuesday", "wednesday", "thursday", "friday", "na note", "services", "please contact", "documentname", "time", "docs", "documentlink", "employee ccid", "conflict", "task assigned", "ist coi", "declaration", "jsonobj3", "parse", "stringify", "grouplist", "json post", "taskfilter", "applies", "assigntogroup", "retrieves", "assignee", "queries", "expects", "uri args", "json containing", "applyfilter", "assignment", "avm folder", "avm store", "store id", "fullpath", "store", "storeid", "avm stores", "search term", "blog query", "category", "api call", "returns json", "cached data", "keylabel", "rest", "ldap query", "resultstr", "jsonoutput", "campusid", "jsonobj", "suresh joshee", "raheel bhojani", "desrochers", "first check", "set message", "materialkey", "acommonfolderid", "hasaccess", "siteconfig", "unprocesseddata", "savemetadata", "getcustomscript", "sitetitle", "error occured", "afa admission", "afas", "change log", "date name", "description", "ebeaton script", "tfrith", "afa main", "runasuser", "afas name", "afa paper", "file test", "utility enter", "does", "student", "bad query", "parameters", "add all", "or condition", "batch ids", "case files", "batchid", "afns", "agricultural", "anaesthes", "life", "environmental", "anaesthesiology", "uappol content", "deanaheed", "programyear", "province", "agreementtype", "safety manual", "mtis", "cree", "blackfoot", "nakota sioux", "iroquois", "dene", "treaties", "first nations", "next", "refresh", "site viewer", "facetkey", "sortparameter", "textjavascript", "public site", "viewer access", "acs cron", "job error", "alfrescos", "unauthorized", "enter", "bear tracks", "main department", "choose", "library", "john", "reviewer", "embargodate", "actiondate", "convocation", "graduation", "nodeid", "thesis status", "match result", "match list", "name dob", "view", "searchcriteria", "main function", "method", "chs upload", "stuln", "filetype", "stuid", "chs agreement", "health sciences", "recreation fomd", "dentistry fomd", "fomd", "therapy fomd", "consent for", "disclosure of", "alberta freedom", "protection", "privacy act", "alberta health", "chs form", "intake", "tasks dashlet", "doccd", "val2", "a my", "view error", "view warning", "keyword search", "refresh list" ], "references": [ "old-AlfrescoToolkit.conf", "AlfrescoToolkit.info", "AlfrescoToolkit.conf", "activities-email_es.ftl", "activities-email_ja.ftl", "activities-email_de.ftl", "activities-email_nl.ftl", "activities-email.ftl", "activities-email_it.ftl", "activities-email_fr.ftl", "CAP-notify-monthly-report.ftl", "chs-commentUpdate.ftl", "chs-studentUploadNotification.ftl", "chs-Invalid.ftl", "chs-studentExpireSoon.ftl", "chs-studentExpired.ftl", "following-email.html_it.ftl", "following-email.html_fr.ftl", "following-email.html_ja.ftl", "following-email.html_nl.ftl", "following-email_de.html.ftl", "following-email_fr.html.ftl", "following-email_ja.html.ftl", "following-email_it.html.ftl", "following-email_nl.html.ftl", "following-email.html.ftl", "following-email.html_de.ftl", "fvca-reminder-email.ftl", "fvca-corrections-email.ftl", "invite-email_nl.html.ftl", "invite-email-add-direct.html.ftl", "invite-email-add-direct.html_fr.ftl", "invite-email_fr.html.ftl", "invite-email_it.html.ftl", "invite-email-add-direct.html_es.ftl", "invite-email-add-direct.html_de.ftl", "invite-email_ja.html.ftl", "invite-email-add-direct.html_nl.ftl", "new-user-email.html.ftl", "new-user-email_de.html.ftl", "invite-email-add-direct.html_ja.ftl", "invite-email-moderated.html.ftl", "new-user-email_fr.html.ftl", "new-user-email_it.html.ftl", "new-user-email_ja.html.ftl", "new-user-email_es.html.ftl", "new-user-email_nl.html.ftl", "invite-email-add-direct.html_it.ftl", "new-user-email_nl.html", "invite-email.html_nl.ftl", "invite-email.ftl", "invite-email_es.html.ftl", "invite-email.html.ftl", "invite-email_de.html.ftl", "invite_user_email.ftl", "kofaxFailedEmailTemplate.ftl", "notify_user_email.ftl", "notify_nl.htm", "notify_user_email_es.html.ftl", "notify_user_email_de.html.ftl", "notify_user_email_ooa_failed.ftl", "notify_user_email.html.ftl", "notify_user_email_it.html.ftl", "notify_user_email_e-transcript_failed.ftl", "notify_user_email_ja.html.ftl", "notify_user_email_fr.html.ftl", "notify_user_email_nl.html.ftl", "OOA-notify-email-template.ftl", "ADV-notify-terms-types.ftl", "appt-final-reminder.ftl", "appt-halfway-reminder.ftl", "sfs-wf-email.html.ftl", "sfs-wf-completed-email.html.ftl", "payActionDecision.html.ftl", "departmentAdhocTask.html.ftl", "wf-email.html_de.ftl", "wf-email.html.ftl", "wf-email_it.html.ftl", "wf-email_fr.html.ftl", "wf-email_nl.html.ftl", "wf-email_ja.html.ftl", "wf-email.html_fr.ftl", "wf-email.html_nl.ftl", "wf-email_es.html.ftl", "wf-email.html_ja.ftl", "wf-email.html_it.ftl", "wf-email_de.html.ftl", "wf-email.html_es.ftl", "emailbody_textplain_alfresco.ftl", "emailbody_textplain_alfresco_es.ftl", "emailbody_textplain_alfresco_fr.ftl", "emailbody_textplain_alfresco_it.ftl", "emailbody_textplain_alfresco_ja.ftl", "emailbody_textplain_alfresco_nb.ftl", "emailbody_textplain_alfresco_pt_BR.ftl", "emailbody_textplain_alfresco_nl.ftl", "emailbody_textplain_alfresco_ru.ftl", "emailbody_textplain_alfresco_zh_CN.ftl", "emailbody_textplain_share.ftl", "emailbody_textplain_share_de.ftl", "emailbody_textplain_share_es.ftl", "emailbody_textplain_share_it.ftl", "emailbody_textplain_share_ja.ftl", "emailbody_textplain_share_nb.ftl", "emailbody_textplain_share_nl.ftl", "emailbody_textplain_share_ru.ftl", "emailbody-alfresco-textplain.ftl", "emailbody-share-textplain.ftl", "emailbody_textplain_alfresco_de.ftl", "emailbody_textplain_share_zh_CN.ftl", "emailbody_textplain_share_fr.ftl", "emailbody_textplain_share_pt_BR.ftl", "uofa-pc-model.xml", "uofa-pllc-model.xml", "uofa-science-model.xml", "uofa-rso-model.xml", "uofa-set-model.xml", "uofa-sfs-model.xml", "uofa-slate-model.xml", "uofa-uappol-model.xml", "advext-model.xml", "assocModel.xml", "adv-model.xml", "cbsr-model.xml", "dynamicSecurityMarksModel", "ephesoft-educational.xml", "facopr-model.xml", "fgsr-model.xml", "faculty-model.xml", "psAudit-model.xml", "FVCA.xml", "roDocProcessing-model.xml", "ro-model.xml", "fgsr-thesis-deposit.xml", "security-group-model.xml", "ua-audit-generic-model.xml", "ua-dummy.xml", "calendar-year-model.xml", "ua-error-model.xml", "uafgsrsup-model.xml", "uaqa-model.xml", "transcript-model.xml", "uAlbertaWorkflowGeneral.xml", "uarmm-supplement-scanning.xml", "uarm-rma-filing-model.xml", "ua-search-model.xml", "ro-search-match.xml", "uatraining.xml", "uofa-ales-model.xml", "uofa-arts-model.xml", "uofa-aps-model.xml", "uofa-base-model.xml", "uawfh-model.xml", "uofa-augustana-model.xml", "uofa-business-model.xml", "uarmTempModel.xml", "uofa-cap-model.xml", "uofa-chs-model.xml", "uofa-chs-agreements-model.xml", "uofa-common-model.xml", "uofa-education-model.xml", "tamis-model.xml", "uofa-engg-coop-model.xml", "uofa-engg-model.xml", "uofa-fo-model.xml", "uofa-extension-model.xml", "uofa-esign-model.xml", "uofa-hrsbs-model.xml", "uofa-law-model.xml", "uofa-caps-model.xml", "uofa-hrs-model.xml", "uofa-native-studies-model.xml", "uofa-pllc-model.json", "uofa-rso-model.json", "uofa-pc-model.json", "uofa-native-studies-model.json", "uofa-slate-model.json", "uofa-uappol-model.json", "uofa-science-model.json", "uofa-workflowGeneral.json", "uofa-sfs-model.json", "adv-model.json", "advext-model.json", "assocModel.json", "calendar-year-model.json", "facopr-model.json", "cbsr-model.json", "ephesoft-educational.json", "faculty-model.json", "faculty-model.xml.json", "rma-model.json", "fgsr-model.json", "FVCA.json", "psAudit-model.json", "ro-aug-model.json", "ro-search-match.json", "tamis-model.json", "security-group-model.json", "fgsr-thesis-deposit.json", "transcript-model.json", "ro-model.json", "ua-audit-generic-model.json", "uafgsrsup-model.json", "uaqa-model.json", "uarmm-supplement-scanning.json", "uAlbertaWorkflowGeneral.json", "ua-error-model.json", "uofa-ales-model.json", "ua-search-model.json", "uarmTempModel.json", "uofa-aps-model.json", "uawfh-model.json", "uofa-arts-model.json", "uofa-cap-model.json", "uofa-chs-agreements-model.json", "uofa-augustana-model.json", "uofa-base-model.json", "uofa-chs-model.json", "uofa-engg-coop-model.json", "uofa-common-model.json", "uofa-engg-model.json", "uofa-extension-model.json", "uofa-hrsbs-model.json", "uofa-fo-model.json", "uofa-education-model.json", "uofa-law-model.json", "uofa-hrs-model.json", "uofa-esign-model.json", "uofa-business-model.json", "faculty-of-science-site.json", "FandO-Organizations.json", "FandO-Programs.json", "fgsr-awards.json", "fgsr-category-list.json", "fgsr-exam-list.json", "fgsr-official-list.json", "fgsr-programOfStudy.json", "fgsr-site.json", "fo-emergency-response-manual.json", "graduate-student-records-site.json", "fo-site.json", "fo-utilities.json", "hrs-benefits.json", "hrsbs-action-reasons.json", "graduate-student-records-v2-site.json", "hrsbs-doc-list.json", "hrsbs-file-structure.json", "hrsbs-owner-details.json", "hrsbs-functionalroles.json", "hrsbs-function-module.json", "hrsbs-review-month.json", "hrsbs-security-class.json", "hrsbs-site.json", "hrs-employeeApprovedDeductions.json", "hrs-bulkId.json", "hrsbs-review-cycle.json", "hrs-employmentFinancial.json", "hrs-personalInformation.json", "hrs-pension.json", "hrs-security-list.json", "hrs-leaves.json", "Institutions.json", "ist-site.json", "hrs-site.json", "my-site-site.json", "law-security-list.json", "native-studies-doc-list.json", "fgsr-credential-list.json", "law-doc-list.json", "native-studies-security-list.json", "office-of-advancement-record-types.json", "office-of-advancement-site.json", "pcm-category.json", "pllc-doc-list.json", "ro-academic-pre-pro-programs.json", "pllc-security-list.json", "ro-acad-group.json", "ro-admitType.json", "ro-applicant-type.json", "ro-campusSolutionsTerm.json", "hrsbs-employee-class.json", "pllc-site.json", "ro-indigenous-type.json", "ro-doctypes.json", "pcm-site.json", "ro-official.json", "ro-org-desc.json", "ro-related-record-types.json", "ro-relationship-to-institution.json", "ro-search-match-status.json", "ro-authenticity.json", "ro-slate-folio-material-non-school-scope.json", "ro-slate-institution-material.json", "ro-slate-folio-material-school-scope.json", "ro-method-receipt.json", "ro-slate-institutions.json", "ro-test-id.json", "rso-accounts-receivable-accounts-payable-doc-type.json", "rso-agreements-doc-category.json", "rso-bulk-scan-doc-type.json", "rso-cfi-purchasing-doc-type.json", "rso-cfi-financials-doc-type.json", "rso-financial-reconciliation-doc-type.json", "rso-financial-reporting-doc-type.json", "rso-financials-doc-type.json", "rso-mask.json", "rso-site.json", "rso-sponsor-names.json", "science-doc-list.json", "science-security-list.json", "school-of-business-site.json", "sfs-ussl-report-status.json", "staff-training-site.json", "student-financial-services-doc-list.json", "student-financial-services-site.json", "student-records-bulk-load-testing-site.json", "student-records-training-site.json", "student-records-site.json", "student-transcripts-site.json", "rso-forms-form-type.json", "support-documentation-site.json", "test-site-site.json", "uappol-category-heirarchy.json", "uappol-type.json", "uappol-site.json", "uoda-faculties.json", "academic-department.json", "adv-correspondence-type.json", "uoda-departments.json", "advsearch.json", "ales-security-list.json", "ales-doc-list.json", "arts-doc-list.json", "arts-security-list.json", "augustana-security-list.json", "augustana-site.json", "augustana-legacy-transcript-doc-list.json", "rso-activation-report-doc-type.json", "business-doc-list.json", "business-security-list.json", "bulkload-testing-site.json", "cap-site.json", "caps-school-board-list.json", "cbsrsite-site.json", "cbsrsite-sopTypes.json", "cbsr-study.json", "cbsr-worksheetType.json", "augustana-doc-list.json", "chs-ag-type.json", "chs-agreements-site.json", "chs-campus-list.json", "chs-degProgram-list.json", "chs-emailNotification.json", "chs-document-status.json", "chs-faculty-list.json", "chs-programYear-list.json", "chs-program-list.json", "canada-provinces-list.json", "demo-site-site.json", "education-doc-list.json", "department.json", "education-security-list.json", "chs-stuEmailNotification.json", "college-of-health-sciences-site.json", "chs-provinces-list.json", "engineering-coop-doc-list.json", "engineering-coop-security-list.json", "engineering-co-op-site.json", "engineering-doc-list.json", "extension-doc-list.json", "extension-security-list.json", "facopr-planTypes.json", "facopr-supportinDocField.json", "faculty-of-ales-site.json", "engineering-security-list.json", "faculty-of-education-site.json", "faculty-of-extension-site.json", "faculty-of-native-studies-site.json", "faculty-of-law-site.json", "faculty-of-arts-site.json", "faculty-of-engineering-site.json", "my_docs_inline.ftl", "my_docs.ftl", "my_spaces.ftl", "recent_docs.ftl", "translatable.ftl", "readme.ftl", "show_audit.ftl", "general_example.ftl", "my_summary.ftl", "doc_info.ftl", "localizable.ftl", "recordsCustomModel.xml", "imapConfig.json", "rm_event_config.json", "rmScriptThrowError.js", "report_rmr_transferReport.html.ftl", "report_rmr_destructionReport.html.ftl", "report_rmr_holdReport.html.ftl", "notify-records-due-for-review-email.ftl", "record-rejected-email.ftl", "record-superseded-email.ftl", "onCreate_supersedes.js", "rma_isClosed.js", "PaperFileconfig.json", "MyTasks-config.json", "AFAconfig.json", "roDocumentTypes.json", "uappol-upload-rule.js", "uappolCreateFolderRule.js", "uappolCreateFolder.js", "uappol-api.js", "uappol-functions.js", "command-utils.js", "backup and log.js", "backup.js", "example test script.js", "test return value.js", "start-pooled-review-workflow.js", "command-processor.js", "command-search.js", "alfresco docs.js", "append copyright.js", "createDepartmentJSON.js", "hrsDaily.js", "hrsFolderCreateSchedule.js", "hrsScanned.js", "hrsCreateFolder.js", "hrsFolderCreateRule.js", "hrsFileShareFolder.js", "alesCreateFolderRestricted.js", "alesCreateFolderSchedule.js", "alesBulkShareFolder.js", "alesFileScanned.js", "alesCreateFolder.js", "alesDaily.js", "alesFileShareFolder.js", "alesCreateFolderConfidential.js", "alesCreateAdvisingNotes.js", "alesFolderCreateSchedule.js", "deployWebServiceDescriptor.js", "taskReportCSV-Appointment-prod.js", "artsFileScanned.js", "artsCreateFolderRule.js", "artsCreateFolder.js", "artsCreateFolderRestricted.js", "augCreateFolderRestricted.js", "augCreateFolder.js", "businessCreateFolderRule.js", "businessCreateFolder.js", "businessCreateFolderSchedule.js", "businessBulkShareFolder.js", "businessFileShareFolder.js", "businessCreateFolderRestricted.js", "businessDaily.js", "businessCreateAdvisingNotes.js", "businessFileScanned.js", "CAPSendMonthlyReportEmail.js", "CAPGenerateMonthlyReport.js", "CapFinalReportSubmit.js", "chsCreateFolderRule.js", "chsEmailOnUpdateComment.js", "chsReport.js", "EmailNotifCHSStudent.js", "SetExpiryDate.js", "chsCreateFolder.js", "chsFacultyReport.js", "chsAgreementCreateFolderRule.js", "chsAgreementCreateFolder.js", "scheduleJobTest.js", "every52MinPastHour.js", "every46MinPastHourBetween4PM12PM.js", "every57MinPastHour.js", "every47MinPastHourBetween4PM12PM.js", "everyDay4H30MinAM.js", "everyDay7H45MinAM.js", "every10MinStartingAt5MinPastHour.js", "every38MinPastHourBetween4PM12PM.js", "every20MinStartingAt15MinPastHour.js", "everyDay2H05MinAM.js", "every2MinStartingAt1MinPastHour.js", "everyDay1H05MinAM.js", "everyDay12H30MinAM.js", "everyDay7H30MinPM.js", "every30MinStartingAt19MinPastHour.js", "every30MinStartingAt11MinPastHour.js", "everyDay2H35MinAM.js", "every30MinStartingAt26MinPastHour.js", "every16MinPastHour.js", "everyDay1H45MinAM.js", "everyDay2H45MinAM.js", "every29MinPastHour.js", "every22MinPastHour.js", "everyDay11H30MinPM.js", "educationCreateFolderRule.js", "educationCreateFolder.js", "educationCreateAdvisingNotes.js", "enggCoopCreateFolderRestricted.js", "enggCoopCreateFolderRule.js", "enggCoopBulkUpload.js", "enggCreateFolderRule.js", "enggCreateFolderRestricted.js", "enggCreateFolder.js", "engineeringCreateAdvisingNotes.js", "enggCoopCreateFolder.js", "enggFileScanned.js", "enggCoopFileScanned.js", "extensionFileScanned.js", "extensionCreateFolder.js", "extensionCreateFolderRule.js", "fgsrCreateGuidelineAPSProcessFromCSV.js", "fgsrDocRestructure.js", "fgsrMigrationScript.js", "fgsrDocRelocation.js", "fgsrCreateFolderFromCSV.js", "guideline-reports.js", "fgsrMigrationScript-withTerminationLogic.js", "modfiyOrUpdatePropertyfromCSV.js", "fgsr-case-file-report.js", "fgsrCreateAPSProcessFromFolder.js", "fgsrCreateFolder.js", "fgsrCopyMetadataToFolderLevel.js", "fgsrCreateAPSProcessFromCSV.js", "foCreateFolder.js", "foCreateFolderRule.js", "Script1.js", "Script2.js", "scheduleRunEvery2-10PM.js", "scheduleRunEvery5PMTo10PM.js", "scheduleRunEvery30Minutes.js", "scheduleRunEvery60Minutes.js", "scheduleRunEveryday3PMto11PM.js", "scheduleRunEveryday12AMto6AM.js", "scheduleRunEvery20Minutes.js", "scheduleRunEvery2AM.js", "acsToApsUserUpdate.js", "2024-01-13-log.txt", "2024-01-15-log.txt", "2024-01-20-log.txt", "2024-01-21-log.txt", "2024-01-22-log.txt", "2024-01-23-log.txt", "2024-02-04-log.txt", "2024-02-05-log.txt", "2024-02-06-log.txt", "2024-02-07-log.txt", "2024-02-08-log.txt", "2024-01-14-log.txt", "2024-01-18-log.txt", "2024-01-11-log.txt", "2024-01-16-log.txt", "2024-01-19-log.txt", "2024-01-26-log.txt", "2024-01-28-log.txt", "2024-01-30-log.txt", "2024-01-12-log.txt", "2024-01-29-log.txt", "2024-01-27-log.txt", "2024-01-31-log.txt", "2024-01-24-log.txt", "2024-02-09-log.txt", "2024-02-02-log.txt", "2024-01-09-log.txt", "2024-02-03-log.txt", "2024-01-05-log.txt", "2024-01-06-log.txt", "2024-01-04-log.txt", "2024-02-01-log.txt", "2024-01-07-log.txt", "2024-01-08-log.txt", "2024-02-10-log.txt", "2024-02-11-log.txt", "2024-02-12-log.txt", "2024-02-13-log.txt", "2023-12-31-log.txt", "2024-02-15-log.txt", "2024-02-16-log.txt", "2024-02-14-log.txt", "2024-02-18-log.txt", "2024-02-20-log.txt", "2024-01-17-log.txt", "2024-02-19-log.txt", "2024-01-10-log.txt", "2024-02-23-log.txt", "2024-02-25-log.txt", "2024-02-21-log.txt", "2024-01-25-log.txt", "2024-02-28-log.txt", "2024-02-22-log.txt", "2024-02-29-log.txt", "2024-03-02-log.txt", "2024-03-03-log.txt", "2024-02-26-log.txt", "2024-03-04-log.txt", "2024-03-06-log.txt", "2024-03-07-log.txt", "2024-03-05-log.txt", "2024-03-08-log.txt", "2024-03-09-log.txt", "2024-03-11-log.txt", "2024-03-10-log.txt", "2024-03-12-log.txt", "2024-03-13-log.txt", "2024-03-14-log.txt", "2024-03-15-log.txt", "2024-03-16-log.txt", "2024-03-17-log.txt", "2024-03-18-log.txt", "2024-03-20-log.txt", "2024-03-21-log.txt", "2024-03-22-log.txt", "2024-03-19-log.txt", "2024-03-23-log.txt", "2024-03-01-log.txt", "2024-03-26-log.txt", "2024-03-25-log.txt", "2024-03-28-log.txt", "2024-03-29-log.txt", "2024-03-27-log.txt", "2024-03-24-log.txt", "2024-03-30-log.txt", "2024-04-02-log.txt", "2024-04-03-log.txt", "2024-03-31-log.txt", "2024-04-05-log.txt", "2024-04-06-log.txt", "2024-04-07-log.txt", "2024-04-08-log.txt", "2024-04-09-log.txt", "2024-04-04-log.txt", "2024-04-11-log.txt", "2024-04-12-log.txt", "2024-04-13-log.txt", "2024-02-17-log.txt", "2024-04-01-log.txt", "2024-04-16-log.txt", "2024-04-15-log.txt", "2024-04-10-log.txt", "2024-04-17-log.txt", "2024-02-24-log.txt", "2024-04-14-log.txt", "2024-04-19-log.txt", "2024-04-21-log.txt", "2024-04-22-log.txt", "2024-04-23-log.txt", "2024-04-24-log.txt", "2024-04-26-log.txt", "2024-04-25-log.txt", "2024-04-29-log.txt", "2024-04-30-log.txt", "2024-05-01-log.txt", "2024-05-02-log.txt", "2024-05-03-log.txt", "2024-05-04-log.txt", "2024-05-05-log.txt", "2024-05-06-log.txt", "2024-04-28-log.txt", "2024-05-07-log.txt", "2024-04-18-log.txt", "2024-05-08-log.txt", "2024-05-09-log.txt", "2024-05-10-log.txt", "2024-05-12-log.txt", "2024-05-14-log.txt", "2024-05-11-log.txt", "2024-05-16-log.txt", "2024-04-27-log.txt", "2024-05-17-log.txt", "2024-05-15-log.txt", "2024-05-18-log.txt", "2024-05-20-log.txt", "2024-05-21-log.txt", "2024-05-19-log.txt", "2024-05-22-log.txt", "2024-05-23-log.txt", "2024-05-25-log.txt", "2024-05-24-log.txt", "2024-05-26-log.txt", "2024-05-27-log.txt", "2024-05-28-log.txt", "2024-05-29-log.txt", "2024-05-30-log.txt", "2024-06-02-log.txt", "2024-05-13-log.txt", "2024-06-01-log.txt", "2024-05-31-log.txt", "2024-04-20-log.txt", "2024-06-03-log.txt", "2024-06-04-log.txt", "2024-06-05-log.txt", "2023-12-30-log.txt", "2023-12-01-log.txt", "2024-02-27-log.txt", "2023-12-29-log.txt", "gtaGraProcessToCSV.js", "gtaGraProcessToCSV-2AM.js", "hrs-benefit-report.js", "westCanDocumentMove.js", "hrsbsReviewCycleReport.js", "hrsbsCreateFolderRule.js", "HRSBS-SyncCCIDs.js", "hrsbsCreateFolder.js", "FVCA-data-import.js", "FVCA-manual-property-update.js", "istPerformanceReviewCreateFolder.js", "lawCreateFolderRestricted.js", "lawFileScanned.js", "lawCreateFolder.js", "lawCreateFolderRule.js", "nativeStudiesCreateFolderRestricted.js", "nsFolderCreateSchedule.js", "nativeStudiesCreateFolder.js", "nativeStudiesCreateFolderRule.js", "ADV-notify-type-mapping.json", "OOA-notify-email.js", "ADV-notify-terms-types.js", "pcm-grab-competitive-noderefs.js", "pcm-update-competitive-noderefs.js", "pcmCreateFolder.js", "psUpdateAlfrescoDepartment.js", "pllcCreateFolder.js", "qaProcess.js", "qaRelease.js", "rmOOABackgroundInformationFiling.js", "rmFilingDoc.js", "rmSearchmatchNomatchFiling.js", "rmFilingConfig.json", "thesisDestructionReport.js", "rmThesis.js", "add_document_type_ro.js", "updateSearchMatchStatus.js", "searchmatchFullDob.js", "createROReconciliationReports.js", "eTranscriptInstList.js", "folder-create-ro.js", "augTranscript.js", "addTimeStamp.js", "missingDocumentList-csv.js", "roAddAspectAndMoveAFA.js", "myTaskDownload.js", "roAddAspectAndMoveTranscript.js", "roAddBundlingAspect.js", "roAddSearchMatchAspect.js", "roCopyEphesoftMetadataXML.js", "roBatchScript.js", "addSearchMatchDocumentType.js", "roCreateEducationalCSV.js", "roCopyOlderScannedDocument.js", "roDocumentListAPLSTD.js", "roCopyOlderScannedDocumentAdHoc.js", "roEtranscriptReport.js", "roDailyQA.js", "roEtranscriptsBundleTest.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "roFolderCreateLDAPLookup.js", "roEtranscriptsBundle.js", "roAddComment.js", "roCopyEphesoftMetadataScanned.js", "roMoveCompleted.js", "roMoveCompletedBackScan.js", "roMoveCompletedSearchMatch.js", "roEtranscriptPDFConverter.js", "roScanningMetadata.js", "roScript1.js", "RORoutingWorkflowUtil.js", "roScript3.js", "roScript2.js", "roScanningMetadataBackScan.js", "roScript7.js", "roScript6.js", "roScript9.js", "roScript1BackScan.js", "roSearchMatchNoMatchReport.js", "roSearchMatchQuery.js", "RONotification.js", "roSlateDocumentExport.js", "roTagAndFileRenderedPDFs.js", "roScript4.js", "roScript5.js", "roScript8.js", "createSlateFolioMaterialDropdown.js", "createSlateApplicationsCSV.js", "LaunchWorkflowUtils.js", "PaperFileUtils.js", "GenerateSponsornamesAndPinames.js", "rsoCreateFolder.js", "sciCreateFolderConfidential.js", "sciCreateFolderPublic.js", "sciCreateFolder.js", "sciCreateFolderRestricted.js", "scienceASDocumentImport.js", "sciFileADDPFileTypes.js", "sciFileShareFolder.js", "sciFileScanned.js", "sciBulkShareFolder.js", "copy-signed-offer-letter.js", "dept-config.js", "reappointment-generate-schedule.js", "reappointment-reminder-schedule.js", "reappointment-generate-process.js", "manual-generate-script.js", "reappointment-reminder-process.js", "reminder-email-util.js", "reappointment-tracking-schedule.js", "reappointment-tracking-process.js", "appointment-report.js", "appointment-report-schedule.js", "manual-tracking-script.js", "sfsCreateFolder.js", "sfsWorkflowStatus.js", "security-group-user.js", "createReportPermissionsFoldersInASite.js", "siteMembersReport.js", "createReportRecursiveGroupsAndUsersInASite.js", "search-responses.js", "advChangeDocumentType.js", "addFolderMetadata.js", "advChangeDocumentType_confidential.js", "consignOInitiatorOfferLetterChange.js", "advChangeDocumentType_background.js", "transcriptResponse.js", "change-fgsr-pdf-file-name-with-date.js", "copy-fgsr-to-graduate-students-records.js", "ADVDonationCalendarToFiscal.js", "document-query.js", "deletingCompletingWorkflow.js", "eTranscriptTemp.js", "eTranscript-bundled-02-jan.js", "eTranscriptVersionModifierFix.js", "fixCheckout.js", "removeDonationGrp.js", "eTranscriptVersioningFix.js", "move-fgsr-folder.js", "search-match-dob-add.js", "thesisDepositArchival.js", "moveThesesForTransfer.js", "eraReportGeneration.js", "kofaxMetadataMerge.js", "kofaxMetadataMergeMissing.js", "generic2min.js", "kofaxSendEmail.js", "PeopleSoft-eTranscript-XML-PDF.js", "startBenefitWorkflow.js", "peoplesoftMetadataMergeMissing.js", "securityWorkflowUtil.js", "startPayActionWorkflow.js", "startDepartmentAdhocApprovalWorkflow.js", "convertTranscript.js", "CreateTranscriptUserMemberships.js", "startTwoStepWorkflow.js", "fix_employee_names.js", "env.js", "folderCreateUtil.js", "folderCreateUtilAA.js", "generalSchedule.js", "JSON.js", "xmlUtil.js", "addPersonAspect.js", "addTimeStampRandomFileName.js", "archiveDocument.js", "luceneUtil.js", "util.js", "archivedItems.js", "getProjectDetails.js", "ADVChangeAuthor.js", "ADVcalendarToFiscal.js", "symplexUtils.js", "advBatchProcessing.js", "advChangeDocumentName.js", "ADVEphesoftMove.js", "advCreateFolderScheduled.js", "advErrorMessageReset.js", "advMetadataUpdate.js", "advMoveToFoldersScheduled.js", "ADVendFundReportFiling.js", "advReconcilliation.js", "ADVmoveRecordsToPreQA.js", "advScanningMetadata.js", "advScript2.js", "advScript3.js", "advScript4.js", "advScript1.js", "advScript5.js", "advScriptDaily.js", "advScriptMonthly.js", "advScriptKofax.js", "ADVSiteContext.js", "advMoveToFolder.js", "deleteEphesoftDoc.js", "advUtils.js", "folderCreateADV.js", "advScriptDaily30minFreq.js", "jsonUtils.js", "advScanning.js", "folderCreateDocumentADV.js", "moveToFolders.js", "symplexMetadataUpdate.js", "OOA_SOT_Name_change.js", "moveToFoldersRetainTitle.js", "advScriptWeekly.js", "symplexMoveToFolder.js", "clioToAcsDocUpdate.js", "ClioUpdateScheduledJob.js", "smartFoldersExample.json", "system-overview.html", "businessDocSetup.json", "uappolDocSetup.json", "businessConfig.json", "augConfig.json", "augDocSetup.json", "lawConfig.json", "uappolConfig.json", "UAlbertaSettings.json", "hrsbsDocSetup.json", "advConfig.json", "hrsbsConfig.json", "hrsConfig.json", "hrsDocSetup.json", "advSimplexMapping.json", "advDocSetup.json", "artsDocSetup.json", "alesConfig.json", "alesDocSetup.json", "archiveFolder.json", "artsConfig.json", "advScanningMapping.json", "collegeOfHealthSciencesConfig.json", "chsAgreementsConfig.json", "dropboxCommonAspects.json", "collegeOfHealthSciencesDocSetup.json", "chsAgreementsDocSetup.json", "educationConfig.json", "extensionConfig.json", "fgsrv2DocSetup.json", "foConfig.json", "foDocSetup.json", "educationDocSetup.json", "lawDocSetup.json", "nativeStudiesDocSetup.json", "pllcConfig.json", "pllcDocSetup.json", "roConfig.json", "fgsrv2Config.json", "rsoConfig.json", "rsoDocSetup.json", "sciConfig.json", "eTranscriptConfig.json", "sciDocSetup.json", "roDocSetup.json", "sfsDocSetup.json", "UAlbertaSettings.conf", "student-recordsConfig.json", "securityWorkflowSetting.json", "thesisDepositConfig.json", "globalHeader.html.ftl", "webFormDialog.html.ftl", "alfrescoUserGroupRequest.ftl", "pensionBenefit.html.ftl", "pinames.json", "sponsornames.json", "searchPageConfig.json", "pcmDocSetup.json", "pcmConfig.json", "qaConfig.json", "apsAppConfig.json", "fgsrCreateApsFromCSV.json", "fgsrCopyMetadata.json", "enggCoopDocSetup.json", "enggDocSetup.json", "enggConfig.json", "enggCoopConfig.json", "CapApsConfig.json", "extensionDocSetup.json", "readme.html", "readme_de.html", "readme_ja.html", "readme_fr.html", "advEndowmentName.get.desc.xml", "advEndowmentName.get.json.ftl", "advEndowmentName.get.js", "advEntityName.get.desc.xml", "advEntityName.get.js", "advEntityName.get.html.ftl", "search.get.desc.xml", "search.get.js", "search.get.html.ftl", "changeInitiatorAppt.put.desc.xml", "eSignatureStatusHistory.get.html.ftl", "changeInitiatorAppt.put.json.ftl", "eSignatureStatusHistory.get.desc.xml", "appointmentSubmit.get.js", "processIdProps.get.desc.xml", "changeInitiatorAppt.put.js", "processIdProps.get.json.ftl", "processIdProps.get.js", "appointmentLandingPage.get.desc.xml", "appointmentLandingPage.get.js", "appointmentLandingPage.get.html.ftl", "appointmentStart.get.desc.xml", "appointmentStart.get.html.ftl", "appointmentStart.get.js", "appointmentStartTest.get.desc.xml", "appointmentStartTest.get.js", "appointmentStartTest.get.html.ftl", "appointmentSubmit.get.desc.xml", "appointmentSubmit.get.html.ftl", "eSignatureStatusHistory.get.js", "apsApplicationList.get.desc.xml", "apsApplicationList.get.html.ftl", "assignuser.put.js", "assignuser.put.json.ftl", "claimtask.put.desc.xml", "claimtask.put.js", "claimtask.put.json.ftl", "completetask.post.desc.xml", "completetask.post.json.ftl", "completetask.post.js", "getapsdbid.get.desc.xml", "getapsdbid.get.json.ftl", "gettasks.get.desc.xml", "gettasks.get.json.ftl", "assignuser.put.desc.xml", "gettasks.get.js", "savetask.post.desc.xml", "savetask.post.js", "savetask.post.json.ftl", "taskForm.get.js", "taskForm.get.desc.xml", "tasklist.get.desc.xml", "apsApplicationList.get.js", "taskForm.get.json.ftl", "tasklist.get.html.ftl.jquery", "tasklist.get.html.ftl", "tasklist.get.js", "triggerapsprocess.post.desc.xml", "triggerapsprocess.post.js", "updatevariables.post.desc.xml.notused", "triggerapsprocess.post.json.ftl", "updatevariables.post.json.ftl.notused", "getapsdbid.get.js", "updatevariables.post.js.notused", "taskUtils.js", "apsGroupsConfig.json", "apsSitesConfig.json", "apptStepZeroStarter.post.desc.xml", "apptStepZeroStarter.post.json.ftl", "apptStepZeroStarter.post.js", "apptStepOneStarter.post.desc.xml", "apptStepOneStarter.post.js", "apptStepOneStarter.post.json.ftl", "apptStepOneSave.post.json.ftl", "apptStepOneSave.post.desc.xml", "apptStepOneSave.post.js", "apptStatusDocUpdate.post.desc.xml", "apptStatusDocUpdate.post.json.ftl", "apptStatusDocUpdate.post.js", "APSWorkflowStatus.get.desc.xml", "APSWorkflowStatus.put.html.ftl", "APSWorkflowStatus.get.html.ftl", "APSWorkflowInfo.put.html.ftl", "APSWorkflowStatus.put.desc.xml", "APSWorkflowInfo.put.desc.xml", "APSWorkflowStatus.get.js", "APSWorkflowStatus.put.js", "APSWorkflowInfo.put.js", "NodeInfo.get.desc.xml", "NodeInfo.get.html.ftl", "capinfo.get.js", "capstart.get.js", "epsb.get.js", "epsb.get.html.ftl", "capstart.get.html.ftl", "epsb.get.desc.xml", "schoolboard.get.html.ftl", "NodeInfo.get.js", "NodeInfoByCapId.get.desc.xml", "updateVariable.post.json.ftl", "updateVariable.post.js", "schoolboard.get.desc.xml", "updateVariable.post.desc.xml", "schoolboard.get.js", "capinfo.get.html.ftl.backup", "cap-file-load.post.json.ftl", "NodeInfoByCapId.get.js", "capinfo.get.html.ftl", "capstart.get.desc.xml", "cap-file-load.post.desc.xml", "capinfo.get.desc.xml", "cap-file-load.post.js", "capeamergedoc.get.js", "capeamergedoc.get.desc.xml", "capeamergedoc.get.html.ftl", "capConfig.js", "chsEnv.js", "chsConfig.js", "chsAdminStuView.get.desc.xml", "chsAdminStuView.get.html.ftl", "chsAdminStuView.get.js", "coupa.get.html.ftl", "coupa.get.desc.xml", "coupa.get.js", "coveoGetDocList.get.desc.xml", "coveoGetDocList.get.json.ftl", "coveoGetDocList.get.js", "getJson.get.desc.xml", "getJson.get.js", "getJson.get.json.ftl", "simpleupload.post.desc.xml", "simpleupload.post.json.ftl", "simpleupload.post.js", "consignoMessage.get.js", "consignoWebhook.post.js", "consignoWebhook.post.json.ftl", "consignoMessage.get.desc.xml", "consignoWebhook.post.desc.xml", "consignoMessage.get.json.ftl", "eSignDownload.get.js", "eSignDownload.get.html.ftl", "eSignDownload.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-supervisorv2.get.js", "review-supervisorv2.get.html.ftl", "fgsrssgLanding.get.js", "review-comm01v2.get.desc.xml", "fgsrssgLanding.get.html.ftl", "review-comm01v2.get.html.ftl", "review-comm02v2.get.desc.xml", "review-comm02v2.get.html.ftl", "fgsrssgLanding.get.desc.xml", "review-studentv2.get.html.ftl", "review-comm03v2.get.html.ftl", "review-comm03v2.get.desc.xml", "review-studentv2.get.desc.xml", "review-cosupervisorv2.get.html.ftl", "review-comm02v2.get.js", "review-startv2.get.desc.xml", "review-studentv2.get.js", "review-cosupervisorv2.get.js", "review-startv2.get.js", "review-student-revisionv2.get.html.ftl", "review-student-revisionv2.get.desc.xml", "review-startv2.get.html.ftl", "review-comm03v2.get.js", "review-cosupervisorv2.get.desc.xml", "review-student-revisionv2.get.js", "review-comm01v2.get.js", "review-comm02.get.desc.xml", "review-comm02.get.html.ftl", "review-comm03.get.desc.xml", "review-comm02.get.js", "review-comm03.get.html.ftl", "review-cosupervisor.get.desc.xml", "review-cosupervisor.get.html.ftl", "review-cosupervisor.get.js", "review-nextdate.get.desc.xml", "review-comm03.get.js", "review-nextdate.get.js", "review-student.get.html.ftl", "review-student.get.js", "review-student-revision.get.desc.xml", "review-student.get.desc.xml", "review-student-revision.get.js", "review-studentTest.get.desc.xml", "review-supervisor.get.desc.xml", "review-studentTest.get.js", "review-supervisor.get.html.ftl", "review-supervisor.get.js", "review-comm01.get.desc.xml", "review-comm01.get.html.ftl", "review-comm01.get.js", "review-student-revision.get.html.ftl", "review-nextdate.get.html.ftl", "review-studentTest.get.html.ftl", "guidelines-supervisor.get.desc.xml", "guidelines-supervisor-revision.get.html.ftl", "guidelines-start.get.desc.xml", "guidelines-start.get.html.ftl", "guidelines-start.get.js", "guidelines-student.get.desc.xml", "guidelines-student.get.html.ftl", "guidelines-student-revision.get.js", "guidelines-student-revision.get.desc.xml", "guidelines-supervisor.get.html.ftl", "guidelines-supervisor-revision.get.desc.xml", "guidelines-student-revision.get.html.ftl", "guidelines-student.get.js", "guidelines-supervisor.get.js", "guidelines-supervisor-revision.get.js", "programExtensionScript.js", "customScript.js", "customCSS_FGSR2.css", "customCSS_FGSR.css", "fgsrEnv.js", "FGSR-Forms-Config.js", "config.js", "googleAddon.get.json.ftl", "googleAddon.get.desc.xml", "googleAddon.get.js", "gtaGraStatus.post.json.ftl", "gtaGraStatus.post.js", "gtaGraStatus.post.desc.xml", "wfh-manager.get.desc.xml", "wfh-form.get.js", "wfh-manager.get.html.ftl", "wfh-form.get.desc.xml", "wfh-revise.get.desc.xml", "wfh-revise.get.html.ftl", "wfh-revise.get.js", "wfh-seniormanager.get.desc.xml", "wfh-manager.get.js", "wfh-seniormanager.get.js", "wfh-seniormanager.get.html.ftl", "wfh-form.get.html.ftl", "hrsbsDocumentLinking.get.desc.xml", "hrsbsDocumentLinking.get.html.ftl", "hrsbsDocumentLinking.get.js", "coi-start.get.desc.xml", "coi-start.get.html.ftl", "coi-revise.get.html.ftl", "coi-employee.get.html.ftl", "coi-employee.get.desc.xml", "coi-revise.get.desc.xml", "coi-start.get.js", "coi-revise.get.js", "coi-supervisor.get.js", "coi-supervisor.get.desc.xml", "coi-employee.get.js", "coi-supervisor.get.html.ftl", "getTaskFilter.get.json.ftl", "queryTasks.get.json.ftl", "routableGroups.get.desc.xml", "routableGroups.get.js", "routableGroups.get.json.ftl", "queryTasks.get.desc.xml", "setTaskFilter.post.js", "setTaskFilter.post.json.ftl", "setTaskFilter.post.desc.xml", "applyTaskAction.post.js", "applyTaskAction.post.json.ftl", "applyTaskAction.post.desc.xml", "getTaskFilter.get.desc.xml", "getTaskFilter.get.js", "queryTasks.get.js", "avmbrowse.get.desc.xml", "avmbrowse.get.html.ftl", "avmbrowse.get.js", "avmstores.get.desc.xml", "avmstores.get.html.ftl", "blogsearch.get.atom.400.ftl", "blogsearch.get.html.400.ftl", "blogsearch.get.desc.xml", "blogsearch.get.js", "categorysearch.get.atom.404.ftl", "blogsearch.get.html.ftl", "categorysearch.get.html.404.ftl", "categorysearch.get.js", "categorysearch.get.html.ftl", "categorysearch.get.desc.xml", "folder.get.desc.xml", "folder.get.html.ftl", "folder.get.js", "psDeptAll.get.js", "psDeptSingle.get.json.ftl", "psDeptSingle.get.js", "psPerson.get.json.ftl", "psUtil.js", "psPerson.get.js", "psAcademicDeptAll.get.desc.xml", "psAcademicDeptAll.get.json.ftl", "psAuthorizedApprover.get.desc.xml", "psDeptAll.get.json.ftl", "psAuthorizedApprover.get.js", "psAuthorizedApprover.get.json.ftl", "psDeptAll.get.desc.xml", "psDeptSingle.get.desc.xml", "psPerson.get.desc.xml", "ceeb.get.desc.xml", "ceeb.get.json.ftl", "getSlateId.get.desc.xml", "getSlateId.get.js", "materials.get.json.ftl", "materials.get.desc.xml", "getSlateId.get.json.ftl", "ceeb.get.js", "materials.get.js", "edit.get.html.ftl", "edit.get.js", "save.post.js", "save.post.json.ftl", "scans.get.desc.xml", "scans.get.js", "uploadfile.post.desc.xml", "uploadfile.post.json.ftl", "edit.get.desc.xml", "uploadfile.post.js", "scans.get.html.ftl", "save.post.desc.xml", "AFA_Main.post.desc.xml", "AFA_MainFileOnly.post.desc.xml", "AFA_MainFileOnly.post.js", "AFA_Main.post.js", "AFA_MainFileOnly.post.json.ftl", "AFA_Main.post.json.ftl", "paperFileUtil.get.desc.xml", "paperFileUtil.get.js", "paperFileUtil.get.html.ftl", "rsoprojectdetails.get.html.ftl", "rsoprojectdetails.get.js", "rsoprojectdetails.get.desc.xml", "roslateapplist.get.html.ftl", "roslateapplist.get.desc.xml", "roslateapplist.get.json.ftl", "roslateexists.get.html.ftl", "roslateexists.get.desc.xml", "roslateapplist.get.js", "roslateexists.get.js", "uofaDepartmentList.get.desc.xml", "uofaDepartmentList.get.js", "uofaDepartmentList.get.html.ftl", "uofaDepartmentName.get.desc.xml", "uofaDepartmentName.get.html.ftl", "uofaFacultyList.get.html.ftl", "uofaFacultyList.get.desc.xml", "uofaDepartmentName.get.js", "uofapersonid.get.desc.xml", "uofapersonidrest.get.html.ftl", "uofapersonidrest.get.desc.xml", "uofapersonid.get.html.ftl", "uofapersonid.get.js", "uofapersonidrest.get.js", "uappolCategoryHeirarchy.get.desc.xml", "uappolCategoryHeirarchy.get.json.ftl", "uappol-metadata-query.get.desc.xml", "uappol-metadata-query.get.js", "uappol-metadata-query.get.json.ftl", "uappolCategoryHeirarchy.get.js", "siteFileViewer.get.desc.xml", "siteFileViewerConfig.js", "siteFileViewer.get.html.ftl", "siteFileViewer.get.js", "publicSiteFileViewer.get.html.ftl", "publicSiteFileViewer.get.desc.xml", "publicSiteFileViewer.get.js", "cronJob.post.desc.xml", "cronJob.post.js", "cronJob.post.json.ftl", "studentupload.get.html.ftl", "generatereport.get.json.ftl", "generatereport.get.desc.xml", "approvethesis.post.js", "generatereport.get.js", "search-match-attach.get.js", "search-match-list.get.html.ftl", "search-match-result.get.html.ftl", "search-match-result.get.js", "search-match-list.get.js.old", "chs-agreements.get.js", "chs-agreements.get.html.ftl", "chs-upload.get.html.ftl", "chs-upload.get.js", "uamytasks.config.get.js", "chsStudentView.get.js", "chsStudentView.get.html.ftl", "foModel.xml", "uofaDocTypes.xml", "uofaDocTypes.json", "foModel.json", "tim-sops", "FandO", "cbsr", "nanofab", "support-documentation", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b" ], "public": 1, "adversary": "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": "6665315e25f9dd42a99e4f2f", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7132, "hostname": 3118, "URL": 4909, "email": 20, "FileHash-SHA256": 2144, "FileHash-MD5": 29, "FileHash-SHA1": 29 }, "indicator_count": 17381, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "14 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f45023af873e8d6ac165b9", "name": "UAlberta Alfresco Databreach -> EPS Crimestoppers Alberta RCMP HR Files", "description": "University of Alberta DataBreach(es) -> Alfresco HR Files (included in this Pulse) - Reported. \nCompromise of Edmonton Police Services (EPS), Alberta RCMP (AB RCMP), CrimeStoppers Alberta - All organizations notified, and provided with identified problems (e.g. criminals), offered solutions (e.g. to address compromised infrastructure). Data 'on hand' and publicly available (e.g. in this pulse). Criminal activity ramping up for 2026. Reported by multiple parties no luck, no response.", "modified": "2026-01-03T01:55:41.491000", "created": "2025-10-19T02:42:43.079000", "tags": [ "entity", "EPS", "Alfresco", "UAlberta", "EdmontonPolice" ], "references": [ "https://www.virustotal.com/graph/embed/g8b17f086c8ca45188352d1d054fa3f8948f81bddd2114ea7b99864e585604e72?theme=dark", "https://en.fofa.info/result?qbase64=ZWRtb250b25wb2xpY2UuY2E%3D", "", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88/iocs" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 743, "FileHash-MD5": 75, "FileHash-SHA1": 60, "FileHash-SHA256": 1364, "domain": 688, "hostname": 763 }, "indicator_count": 3693, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "149 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6665315e25f9dd42a99e4f2f", "name": "UAlberta Alfresco Management Software Abuse -> Admin/Backdoor Edmonton Police Services", "description": "Just pulled down what was in my employee profile (I don't work there).\nDiscovered after being directed to some management system (unknown at the time).\nPulled down and scanned: 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "modified": "2025-10-10T19:03:58.376000", "created": "2024-06-09T04:36:46.536000", "tags": [ "note", "home", "lucene paths", "json descriptor", "lucene path", "company home", "actividades", "pageuser", "sie knnen", "sie auf", "link klicken", "recente", "u kunt", "attivit", "possibile", "activits", "vous", "report", "web link", "cvs report", "link", "chs placement", "chs student", "placement", "team", "google form", "university", "alberta", "automation", "please", "following", "followers", "ihnen", "mitarbeitern", "mitarbeiter", "hello", "foreign visitor", "fvca", "human resource", "fvca assessment", "incomplete", "regards", "klik", "wachtwoord", "mijn profiel", "klik op", "hoogachtend", "alfresco", "bonjour", "cliquez sur", "nous", "pour ce", "mon profil", "changer", "invito", "caro", "fare", "password", "il mio", "cambia password", "per rifiutare", "cordiali saluti", "my profile", "change password", "konto", "sie erstellt", "passwort", "wir legen", "ihnen nahe", "passwort bei", "anmeldung zu", "ndern", "gehen sie", "mmm yyyy", "nome utente", "nombre", "contrasea", "para hacerlo", "mi perfil", "atentamente", "account", "alfresco share", "hola", "haga", "los datos", "y seleccione", "si desea", "click", "einladung von", "hallo", "sie eingeladen", "site", "klicken sie", "konto fr", "alfresco client", "kofax index", "inhaltselement", "zur site", "gren alfresco", "pledged gift", "office", "advancement", "datetime", "university vpn", "date", "shared", "support", "auxiliary", "process", "priority", "medium high", "pay action", "sincerely", "uofa ecm", "link um", "aufgaben stehen", "verfgung", "prioritt", "niedrig mittel", "hoch", "klicken", "aufgabe zu", "il seguente", "disponibile", "priorit", "bassa media", "alta", "clicca", "clicca su", "la tche", "tre rcupre", "basse moyenne", "leve", "cliquez", "cordialement", "prioriteit", "laag gemiddeld", "hoog", "la siguiente", "prioridad", "media alta", "saludos", "kb content", "links content", "content url", "download url", "webdav url", "ttulo", "descripcin", "ninguno", "ninguna", "creador", "creado", "modificador", "modificado", "tamao", "webdav", "titre", "aucun", "aucune", "modificateur", "modifi", "taille", "ko liens", "du contenu", "dossier du", "url webdav", "titolo", "nessuno", "nessuna", "creato", "modificato", "dimensioni", "kb link", "al contenuto", "cartella", "ingen", "beskrivelse", "tittel", "opprettet", "modifikator", "modifisert", "strrelse", "lenker for", "innhold mappe", "descrio", "nome", "nenhum", "nenhuma", "criador", "criado", "tamanho", "geen", "beschrijving", "titel", "maker", "gemaakt", "gewijzigd", "grootte", "contenturl", "downloadurl", "beschreibung", "url zum", "keiner", "keine", "ersteller", "erstellt", "bearbeiter", "gendert", "kb links", "download", "navigatebrowse", "pagesite", "readme file", "yesno", "user name", "main", "function", "log debug", "record", "sample rm", "import", "njson", "forms", "sites", "documenttype", "commonfolder", "error", "value", "jsonfile", "service", "false", "moving", "prop", "null", "bearer", "uappol", "uappol function", "contentid", "param", "id var", "call", "post request", "json", "config", "coveo", "uappol metadata", "content id", "and not", "loads", "update", "uploader", "inbox", "rnrn", "create", "contenteml", "inbox folder", "number", "normal", "textpart", "backup", "createchildren", "backupname", "childlist", "name", "content", "array", "write", "childname2", "childname3", "childname4", "reviewgroup", "groupsite", "starting", "started", "delete email", "command", "found", "create content", "resources", "unknown command", "globals", "var title", "rnrncopyright", "copyright", "csvtoarray", "regexp", "jsonstr", "daily", "review", "az09", "format", "hrsfilescanner", "hrs document", "fromscanner", "not type", "matches1", "employee id", "third", "tempfilename", "ldap", "version", "this", "file share", "folder", "trimlr", "namearr", "personid", "document name", "ales file", "scanned", "shared drive", "last", "document type", "document", "advising notes", "debug", "debugstr", "schedule", "descriptorpath", "web service", "inbound rule", "web services", "collaborator", "groupeveryone", "check", "index", "taskassignee", "taskenddate", "filename", "localisotime", "startdatetime", "timeperiod", "uofa edrms", "author", "descommonnode", "nomatch", "iddocumenttype", "siteid", "span", "path", "term", "core", "cap report", "template", "object", "cap mail", "dev testing", "application", "aps status", "cap generate", "monthly report", "extension", "alfresco locale", "september", "pm mdt", "school", "didx", "json response", "cap final", "rebcapiddict", "finalcapiddict", "aps process", "trigger", "chsdocument", "message", "func", "msgstr", "emailobj", "emailtemplate", "emailsubject", "sitepath", "chs docs", "studentfiles", "faculty", "true", "chssiteid", "type", "aspect", "chsdocs", "nodeidx", "find", "expired", "chs school", "defunc", "facultykey", "program", "spasite", "ldapperson", "parent name", "securitytype", "formsengg", "limit", "enggfilescanner", "stuccid", "csv file", "studdept", "supccid", "supdept", "cosupccid", "relocation", "fgsr", "records site", "fgsr doc", "department", "start fgsr", "department doc", "completion of", "oral hlth", "form", "application for", "report of", "admission", "master", "music", "unknown", "comp", "class", "leave", "supervisor", "currentline", "return", "studentid", "superccid", "revdate", "code", "apstaskproperty", "converttocsv", "aps guideline", "aps task", "newdata", "hyperlink", "certificate", "first", "info", "procid", "filecontentstr", "query sort", "create header", "person id", "subject title", "node", "studentccid", "yyyymmdd", "lookupjson", "propidx", "input date", "iso format", "folder level", "query", "duedate", "test java", "dailyschedule", "upload", "ro adm", "workflow", "offset", "adm workflow", "data length", "startindex", "json object", "aps group", "acs site", "user", "getgroupid", "am mst", "acsaps group", "user sync", "january", "start january", "february", "start february", "december", "start december", "march", "start march", "am mdt", "consumer march", "aps student", "april", "start april", "june", "start june", "pm mst", "ro backscan", "edrmsteam", "group", "group december", "aps ro", "copy file", "aps api", "maxfile", "creator", "rand", "hrsbs", "july", "august", "hrsbssyncccids", "zhrroleuserresp", "edrms", "ccids", "prefix", "createdirectory", "directory", "actionreason", "safefilename", "employeeclass", "carry", "csv data", "host", "bachelor", "college level", "mike", "propname", "maxitems", "currjson", "fvca status", "important", "prod", "manual data", "doctoratephd", "medicine", "nodename", "employeeccid", "managerccid", "employeeid", "workingtitle", "regtempdescr", "findkey", "email", "new document", "doctypelabel", "competitive bid", "bid exception", "pcm competitive", "and aspect", "competitive", "nodes", "bid update", "acommonfolder", "formspcm", "peoplesoft", "no data", "qaselectednode", "qaselected", "qanotselected", "qa folder", "preqa", "qa var", "documentcount", "passcount", "qadocument", "qa selected", "moved", "attempts", "accepted", "rm file", "plan", "rm filing", "min to", "rm system", "batch", "time limit", "rmcfg", "string", "already", "load", "valid", "graddate", "uathdep", "ccid", "title", "abstract", "embargo", "datestr", "searchresult", "alfresco afa", "admissions", "student case", "files", "and type", "institution", "inst", "json config", "institution not", "if file", "logger", "needle", "xmlstr", "staus", "document linkn", "getlogfile", "documentlist", "xml field", "not found", "addaspect", "move aspect", "duplicate file", "makes", "to max", "checks", "workflow name", "workflow link", "emplid", "due daten", "total afa", "not path", "afabundling", "change", "not aspect", "logs", "ephesoft", "document moved", "epehsoft", "xmlsourcenode", "batchsize", "filemappingpdf", "entry", "move file", "getcsvfile", "batchprocess", "logging", "completed", "document link", "groupn", "created date", "stdapl", "person", "workflow desc", "json file", "list", "lastmonth", "daily qa", "default", "qastartdate", "query language", "finished", "afa bundle", "transcriptarr", "lucene query", "qacounter", "rrfgroupname", "uaroemplid", "uaropriority", "uaroduedate", "documentlistarr", "uarmm", "profile", "courseauditform", "status", "jile", "searchmatchmove", "logfoldername", "backscanreview", "smfstr", "rosm", "converter", "shortxml", "failedcsvfolder", "xml file", "qaoperatorindex", "qaoperatorlabel", "script", "suresh", "aws promotion", "file", "tasks", "bundlingprop", "tasktype", "grps2", "uarotasktype", "comments", "test", "ro scripts", "xmlnode", "shortdescr", "xmlcont", "firstname", "orgid", "middlename", "lastname", "middle", "final", "script started", "to now", "received date", "first name", "receiveddatestr", "dateofbirthstr", "getdefination", "2005 aug", "dropbox", "foldercreate", "scan doc", "officiality", "search match", "running script", "materialextid", "studentref", "ceeb", "materialcode", "memo", "jsoncontent", "ro document", "paperfileutils", "afaconfig", "ro workflow", "paperfileconfig", "applicationjson", "formsrso", "targetfile", "property name", "pinames today", "addp", "science addp", "addp move", "ro code", "scifilescanner", "desconfnode", "grabnodeprop", "copy", "consumer", "initiators", "hiring", "consigno", "offer letter", "match", "apsmaster", "match2", "reappointment", "expiry date", "today", "finaldate", "task info", "psperson", "complete basic", "hiring info", "employee", "resultdata", "delegategroup", "delegate group", "verify", "bind", "aps appointment", "trevor report", "sfsussl", "drawdown", "refund", "reporttype", "var document", "shareurl", "newgroup", "parentgrp", "group created", "var logfile", "rule folder", "site running", "report on", "get site", "foldername", "create file", "reportlogslogs", "reportlogs", "ist site", "running report", "count", "tran", "var csvfile", "result length", "processid", "process id", "delimiters", "quoted", "standard", "starting name", "morechildren", "pdf var", "length", "newname", "fiscal", "docnamearr", "filenode", "calendar year", "versionhistory", "new doc", "web deployed", "var startdate", "startdate", "maxcount", "prevmonth", "monthcount", "application id", "delete", "get path", "if node", "search length", "arra y", "if csv", "version history", "graduate", "graduate folder", "children", "graduate file", "searchmatchdob", "career", "appl nbr", "jan04 now", "counter", "thesis", "runyear", "spring", "service log", "everything", "this determine", "thesis deposit", "archival", "problem", "filepath", "md import", "arraytocsv", "found document", "start", "food", "yumna", "start kofax", "kofax", "admin", "subject", "sample email", "execute", "koafx", "apasresponseid", "merge", "recruitment", "transcripts", "review request", "admindate", "requesteddate", "approveddate", "approvereject", "getemailbody", "taskid", "sendemail", "request status", "siteconsumer", "sitemanager", "eval", "acshost", "global env", "config file", "apsprod", "params", "alloc", "checkpath", "newpath", "adding entity", "surnamechar", "adding person", "jsonfunction", "text", "syntaxerror", "arraytoxml", "xml related", "change xml", "xmltoarray", "xmlutil", "common folder", "random2digit", "maxlimit", "jsonarchive", "very", "returns", "sitecontext", "arrcounter", "node id", "items", "array length", "therecord", "award sponsor", "rso project", "res0012345", "iso88591", "util function", "project id", "proposal id", "doc name", "newdocname", "prod url", "199899", "property", "typeprop", "barcode", "accepts", "parent", "xmlfilename", "siteconfigjson", "qabatchgrp", "signeddate", "ephdocumenttype", "json document", "qapercentage", "entity", "broker", "add error", "getexecutetime", "qaoperator", "retain title", "idnumber", "assocname", "metaarr", "fund report", "csvcontent", "input folder", "doc00c200004txg", "xmlfile", "node1", "node2", "540am", "240pm", "metadata", "var folder", "filter", "mappedobj", "09azaz", "conditionval", "foldercondition", "file name", "xmlfileobj", "alfresco prop", "setup error", "formatjson", "id property", "move", "getrandomnumber", "result", "newdoctype", "no title", "clioacs update", "clio", "patch", "system overview", "system", "overview", "purpose", "aims", "objectives", "prerequisites", "total", "expected effort", "domain", "urls", "dept param", "department name", "done", "submit form", "saving", "label", "input", "approvers", "information", "user group", "request", "group request", "users", "single family", "edmonton ab", "coverage", "common law", "step workflow", "care", "dental benefits", "direct", "web scripts", "get http", "documentation", "web script", "http method", "http", "apis", "development", "knowledge", "java", "empty argument", "e1234", "im system", "lookupentity", "configfilename", "namespace", "searchterm", "access", "jsonuser", "alfresco search", "page search", "expires", "signer", "reason", "utf8", "stripcharacter", "pull hiring", "getapsdbid", "save", "processsetidset", "saved", "returndata", "boolean", "start building", "varname", "fill", "time click", "initiated all", "submissions", "all submissions", "process landing", "page", "initiators all", "maps initiated", "post doc", "student term", "start form", "middle name", "email address", "retype", "cell", "phone no", "fellow", "secureorigin", "expand", "thank", "here", "please check", "aps list", "pang", "subset", "display", "args", "task", "username", "save form", "data need", "cdkey", "checkdict", "item", "column", "anchor", "multi", "tasks filter", "search", "trigger aps", "process api", "apsprocess", "authentication", "webscript", "getapsperson", "process info", "initsavestatus", "step0statusfail", "signer1", "signer2", "appointment", "taskjson", "groupapiaccess", "checkapiuser", "fgsrpr", "psaudit", "statusname", "unsuccessful1", "apptreappt", "emplobject", "caps aps", "cap epsb", "applicant", "form submitted", "board review", "form applicant", "school district", "start date", "cap application", "home help", "pdfa format", "larger", "upload file", "please click", "uofacap", "applications", "jstr", "processjson", "invalid url", "associate dean", "edmonton public", "october", "elk island", "reutrn false", "mapdoctypeurl", "doctype", "cap document", "doctypes", "doctypemap", "schools", "public schools", "foip", "edmonton area", "epsb", "capid", "server", "aps user", "groupcapadmin", "assignuser", "cap ea", "successfully", "please wait", "successfully ea", "apsservice", "apsserviceprod", "requireddate", "bibliography", "reb approval", "letter", "cprbls", "ahsrespect", "ahscon", "immformdocs", "picvsc", "whmis", "condissi", "hspnet", "conphoto", "conclin", "college", "health", "submission date", "effective date", "expiration date", "chs admin", "student view", "typekey", "placementdocs", "warning", "jobj", "abraniuk", "wendy", "terry harris", "directorhrsbs", "level", "holiday pay", "part time", "payroll", "salariedreg aux", "cheat", "paramname", "getallurlparams", "hrsbs config", "data dictionary", "field", "responsejson", "workflowid", "workflow id", "context", "event", "statusevent", "uaesign", "success", "permission", "progress report", "postdoctoral", "sorry", "deptjson", "fgsr student", "process status", "select", "currentuser", "reports", "student ccid", "populated", "invalid student", "supervisor ccid", "co supervisor", "due date", "freedom", "report process", "fgsr forms", "list fgsr", "report fgsr", "report sorry", "review process", "fgsr supervisor", "thesis programs", "programs", "please enter", "student id", "submit button", "var taskid", "var currentuser", "review sorry", "raheel", "added", "urlorigin", "need", "raheel var", "elmid", "commentkeyarr", "override", "menu", "colour bar", "mdphd", "absence", "completion", "mbameng", "mbamsc", "meng", "jason", "acs property", "available", "subdoctype", "test person", "test effective", "modelnodepath", "sitename", "metadatamap", "sitefile", "google addon", "gtagra", "gta gra", "zhreformengresp", "id otherwise", "university home", "indicate", "monday", "tuesday", "wednesday", "thursday", "friday", "na note", "services", "please contact", "documentname", "time", "docs", "documentlink", "employee ccid", "conflict", "task assigned", "ist coi", "declaration", "jsonobj3", "parse", "stringify", "grouplist", "json post", "taskfilter", "applies", "assigntogroup", "retrieves", "assignee", "queries", "expects", "uri args", "json containing", "applyfilter", "assignment", "avm folder", "avm store", "store id", "fullpath", "store", "storeid", "avm stores", "search term", "blog query", "category", "api call", "returns json", "cached data", "keylabel", "rest", "ldap query", "resultstr", "jsonoutput", "campusid", "jsonobj", "suresh joshee", "raheel bhojani", "desrochers", "first check", "set message", "materialkey", "acommonfolderid", "hasaccess", "siteconfig", "unprocesseddata", "savemetadata", "getcustomscript", "sitetitle", "error occured", "afa admission", "afas", "change log", "date name", "description", "ebeaton script", "tfrith", "afa main", "runasuser", "afas name", "afa paper", "file test", "utility enter", "does", "student", "bad query", "parameters", "add all", "or condition", "batch ids", "case files", "batchid", "afns", "agricultural", "anaesthes", "life", "environmental", "anaesthesiology", "uappol content", "deanaheed", "programyear", "province", "agreementtype", "safety manual", "mtis", "cree", "blackfoot", "nakota sioux", "iroquois", "dene", "treaties", "first nations", "next", "refresh", "site viewer", "facetkey", "sortparameter", "textjavascript", "public site", "viewer access", "acs cron", "job error", "alfrescos", "unauthorized", "enter", "bear tracks", "main department", "choose", "library", "john", "reviewer", "embargodate", "actiondate", "convocation", "graduation", "nodeid", "thesis status", "match result", "match list", "name dob", "view", "searchcriteria", "main function", "method", "chs upload", "stuln", "filetype", "stuid", "chs agreement", "health sciences", "recreation fomd", "dentistry fomd", "fomd", "therapy fomd", "consent for", "disclosure of", "alberta freedom", "protection", "privacy act", "alberta health", "chs form", "intake", "tasks dashlet", "doccd", "val2", "a my", "view error", "view warning", "keyword search", "refresh list" ], "references": [ "old-AlfrescoToolkit.conf", "AlfrescoToolkit.info", "AlfrescoToolkit.conf", "activities-email_es.ftl", "activities-email_ja.ftl", "activities-email_de.ftl", "activities-email_nl.ftl", "activities-email.ftl", "activities-email_it.ftl", "activities-email_fr.ftl", "CAP-notify-monthly-report.ftl", "chs-commentUpdate.ftl", "chs-studentUploadNotification.ftl", "chs-Invalid.ftl", "chs-studentExpireSoon.ftl", "chs-studentExpired.ftl", "following-email.html_it.ftl", "following-email.html_fr.ftl", "following-email.html_ja.ftl", "following-email.html_nl.ftl", "following-email_de.html.ftl", "following-email_fr.html.ftl", "following-email_ja.html.ftl", "following-email_it.html.ftl", "following-email_nl.html.ftl", "following-email.html.ftl", "following-email.html_de.ftl", "fvca-reminder-email.ftl", "fvca-corrections-email.ftl", "invite-email_nl.html.ftl", "invite-email-add-direct.html.ftl", "invite-email-add-direct.html_fr.ftl", "invite-email_fr.html.ftl", "invite-email_it.html.ftl", "invite-email-add-direct.html_es.ftl", "invite-email-add-direct.html_de.ftl", "invite-email_ja.html.ftl", "invite-email-add-direct.html_nl.ftl", "new-user-email.html.ftl", "new-user-email_de.html.ftl", "invite-email-add-direct.html_ja.ftl", "invite-email-moderated.html.ftl", "new-user-email_fr.html.ftl", "new-user-email_it.html.ftl", "new-user-email_ja.html.ftl", "new-user-email_es.html.ftl", "new-user-email_nl.html.ftl", "invite-email-add-direct.html_it.ftl", "new-user-email_nl.html", "invite-email.html_nl.ftl", "invite-email.ftl", "invite-email_es.html.ftl", "invite-email.html.ftl", "invite-email_de.html.ftl", "invite_user_email.ftl", "kofaxFailedEmailTemplate.ftl", "notify_user_email.ftl", "notify_nl.htm", "notify_user_email_es.html.ftl", "notify_user_email_de.html.ftl", "notify_user_email_ooa_failed.ftl", "notify_user_email.html.ftl", "notify_user_email_it.html.ftl", "notify_user_email_e-transcript_failed.ftl", "notify_user_email_ja.html.ftl", "notify_user_email_fr.html.ftl", "notify_user_email_nl.html.ftl", "OOA-notify-email-template.ftl", "ADV-notify-terms-types.ftl", "appt-final-reminder.ftl", "appt-halfway-reminder.ftl", "sfs-wf-email.html.ftl", "sfs-wf-completed-email.html.ftl", "payActionDecision.html.ftl", "departmentAdhocTask.html.ftl", "wf-email.html_de.ftl", "wf-email.html.ftl", "wf-email_it.html.ftl", "wf-email_fr.html.ftl", "wf-email_nl.html.ftl", "wf-email_ja.html.ftl", "wf-email.html_fr.ftl", "wf-email.html_nl.ftl", "wf-email_es.html.ftl", "wf-email.html_ja.ftl", "wf-email.html_it.ftl", "wf-email_de.html.ftl", "wf-email.html_es.ftl", "emailbody_textplain_alfresco.ftl", "emailbody_textplain_alfresco_es.ftl", "emailbody_textplain_alfresco_fr.ftl", "emailbody_textplain_alfresco_it.ftl", "emailbody_textplain_alfresco_ja.ftl", "emailbody_textplain_alfresco_nb.ftl", "emailbody_textplain_alfresco_pt_BR.ftl", "emailbody_textplain_alfresco_nl.ftl", "emailbody_textplain_alfresco_ru.ftl", "emailbody_textplain_alfresco_zh_CN.ftl", "emailbody_textplain_share.ftl", "emailbody_textplain_share_de.ftl", "emailbody_textplain_share_es.ftl", "emailbody_textplain_share_it.ftl", "emailbody_textplain_share_ja.ftl", "emailbody_textplain_share_nb.ftl", "emailbody_textplain_share_nl.ftl", "emailbody_textplain_share_ru.ftl", "emailbody-alfresco-textplain.ftl", "emailbody-share-textplain.ftl", "emailbody_textplain_alfresco_de.ftl", "emailbody_textplain_share_zh_CN.ftl", "emailbody_textplain_share_fr.ftl", "emailbody_textplain_share_pt_BR.ftl", "uofa-pc-model.xml", "uofa-pllc-model.xml", "uofa-science-model.xml", "uofa-rso-model.xml", "uofa-set-model.xml", "uofa-sfs-model.xml", "uofa-slate-model.xml", "uofa-uappol-model.xml", "advext-model.xml", "assocModel.xml", "adv-model.xml", "cbsr-model.xml", "dynamicSecurityMarksModel", "ephesoft-educational.xml", "facopr-model.xml", "fgsr-model.xml", "faculty-model.xml", "psAudit-model.xml", "FVCA.xml", "roDocProcessing-model.xml", "ro-model.xml", "fgsr-thesis-deposit.xml", "security-group-model.xml", "ua-audit-generic-model.xml", "ua-dummy.xml", "calendar-year-model.xml", "ua-error-model.xml", "uafgsrsup-model.xml", "uaqa-model.xml", "transcript-model.xml", "uAlbertaWorkflowGeneral.xml", "uarmm-supplement-scanning.xml", "uarm-rma-filing-model.xml", "ua-search-model.xml", "ro-search-match.xml", "uatraining.xml", "uofa-ales-model.xml", "uofa-arts-model.xml", "uofa-aps-model.xml", "uofa-base-model.xml", "uawfh-model.xml", "uofa-augustana-model.xml", "uofa-business-model.xml", "uarmTempModel.xml", "uofa-cap-model.xml", "uofa-chs-model.xml", "uofa-chs-agreements-model.xml", "uofa-common-model.xml", "uofa-education-model.xml", "tamis-model.xml", "uofa-engg-coop-model.xml", "uofa-engg-model.xml", "uofa-fo-model.xml", "uofa-extension-model.xml", "uofa-esign-model.xml", "uofa-hrsbs-model.xml", "uofa-law-model.xml", "uofa-caps-model.xml", "uofa-hrs-model.xml", "uofa-native-studies-model.xml", "uofa-pllc-model.json", "uofa-rso-model.json", "uofa-pc-model.json", "uofa-native-studies-model.json", "uofa-slate-model.json", "uofa-uappol-model.json", "uofa-science-model.json", "uofa-workflowGeneral.json", "uofa-sfs-model.json", "adv-model.json", "advext-model.json", "assocModel.json", "calendar-year-model.json", "facopr-model.json", "cbsr-model.json", "ephesoft-educational.json", "faculty-model.json", "faculty-model.xml.json", "rma-model.json", "fgsr-model.json", "FVCA.json", "psAudit-model.json", "ro-aug-model.json", "ro-search-match.json", "tamis-model.json", "security-group-model.json", "fgsr-thesis-deposit.json", "transcript-model.json", "ro-model.json", "ua-audit-generic-model.json", "uafgsrsup-model.json", "uaqa-model.json", "uarmm-supplement-scanning.json", "uAlbertaWorkflowGeneral.json", "ua-error-model.json", "uofa-ales-model.json", "ua-search-model.json", "uarmTempModel.json", "uofa-aps-model.json", "uawfh-model.json", "uofa-arts-model.json", "uofa-cap-model.json", "uofa-chs-agreements-model.json", "uofa-augustana-model.json", "uofa-base-model.json", "uofa-chs-model.json", "uofa-engg-coop-model.json", "uofa-common-model.json", "uofa-engg-model.json", "uofa-extension-model.json", "uofa-hrsbs-model.json", "uofa-fo-model.json", "uofa-education-model.json", "uofa-law-model.json", "uofa-hrs-model.json", "uofa-esign-model.json", "uofa-business-model.json", "faculty-of-science-site.json", "FandO-Organizations.json", "FandO-Programs.json", "fgsr-awards.json", "fgsr-category-list.json", "fgsr-exam-list.json", "fgsr-official-list.json", "fgsr-programOfStudy.json", "fgsr-site.json", "fo-emergency-response-manual.json", "graduate-student-records-site.json", "fo-site.json", "fo-utilities.json", "hrs-benefits.json", "hrsbs-action-reasons.json", "graduate-student-records-v2-site.json", "hrsbs-doc-list.json", "hrsbs-file-structure.json", "hrsbs-owner-details.json", "hrsbs-functionalroles.json", "hrsbs-function-module.json", "hrsbs-review-month.json", "hrsbs-security-class.json", "hrsbs-site.json", "hrs-employeeApprovedDeductions.json", "hrs-bulkId.json", "hrsbs-review-cycle.json", "hrs-employmentFinancial.json", "hrs-personalInformation.json", "hrs-pension.json", "hrs-security-list.json", "hrs-leaves.json", "Institutions.json", "ist-site.json", "hrs-site.json", "my-site-site.json", "law-security-list.json", "native-studies-doc-list.json", "fgsr-credential-list.json", "law-doc-list.json", "native-studies-security-list.json", "office-of-advancement-record-types.json", "office-of-advancement-site.json", "pcm-category.json", "pllc-doc-list.json", "ro-academic-pre-pro-programs.json", "pllc-security-list.json", "ro-acad-group.json", "ro-admitType.json", "ro-applicant-type.json", "ro-campusSolutionsTerm.json", "hrsbs-employee-class.json", "pllc-site.json", "ro-indigenous-type.json", "ro-doctypes.json", "pcm-site.json", "ro-official.json", "ro-org-desc.json", "ro-related-record-types.json", "ro-relationship-to-institution.json", "ro-search-match-status.json", "ro-authenticity.json", "ro-slate-folio-material-non-school-scope.json", "ro-slate-institution-material.json", "ro-slate-folio-material-school-scope.json", "ro-method-receipt.json", "ro-slate-institutions.json", "ro-test-id.json", "rso-accounts-receivable-accounts-payable-doc-type.json", "rso-agreements-doc-category.json", "rso-bulk-scan-doc-type.json", "rso-cfi-purchasing-doc-type.json", "rso-cfi-financials-doc-type.json", "rso-financial-reconciliation-doc-type.json", "rso-financial-reporting-doc-type.json", "rso-financials-doc-type.json", "rso-mask.json", "rso-site.json", "rso-sponsor-names.json", "science-doc-list.json", "science-security-list.json", "school-of-business-site.json", "sfs-ussl-report-status.json", "staff-training-site.json", "student-financial-services-doc-list.json", "student-financial-services-site.json", "student-records-bulk-load-testing-site.json", "student-records-training-site.json", "student-records-site.json", "student-transcripts-site.json", "rso-forms-form-type.json", "support-documentation-site.json", "test-site-site.json", "uappol-category-heirarchy.json", "uappol-type.json", "uappol-site.json", "uoda-faculties.json", "academic-department.json", "adv-correspondence-type.json", "uoda-departments.json", "advsearch.json", "ales-security-list.json", "ales-doc-list.json", "arts-doc-list.json", "arts-security-list.json", "augustana-security-list.json", "augustana-site.json", "augustana-legacy-transcript-doc-list.json", "rso-activation-report-doc-type.json", "business-doc-list.json", "business-security-list.json", "bulkload-testing-site.json", "cap-site.json", "caps-school-board-list.json", "cbsrsite-site.json", "cbsrsite-sopTypes.json", "cbsr-study.json", "cbsr-worksheetType.json", "augustana-doc-list.json", "chs-ag-type.json", "chs-agreements-site.json", "chs-campus-list.json", "chs-degProgram-list.json", "chs-emailNotification.json", "chs-document-status.json", "chs-faculty-list.json", "chs-programYear-list.json", "chs-program-list.json", "canada-provinces-list.json", "demo-site-site.json", "education-doc-list.json", "department.json", "education-security-list.json", "chs-stuEmailNotification.json", "college-of-health-sciences-site.json", "chs-provinces-list.json", "engineering-coop-doc-list.json", "engineering-coop-security-list.json", "engineering-co-op-site.json", "engineering-doc-list.json", "extension-doc-list.json", "extension-security-list.json", "facopr-planTypes.json", "facopr-supportinDocField.json", "faculty-of-ales-site.json", "engineering-security-list.json", "faculty-of-education-site.json", "faculty-of-extension-site.json", "faculty-of-native-studies-site.json", "faculty-of-law-site.json", "faculty-of-arts-site.json", "faculty-of-engineering-site.json", "my_docs_inline.ftl", "my_docs.ftl", "my_spaces.ftl", "recent_docs.ftl", "translatable.ftl", "readme.ftl", "show_audit.ftl", "general_example.ftl", "my_summary.ftl", "doc_info.ftl", "localizable.ftl", "recordsCustomModel.xml", "imapConfig.json", "rm_event_config.json", "rmScriptThrowError.js", "report_rmr_transferReport.html.ftl", "report_rmr_destructionReport.html.ftl", "report_rmr_holdReport.html.ftl", "notify-records-due-for-review-email.ftl", "record-rejected-email.ftl", "record-superseded-email.ftl", "onCreate_supersedes.js", "rma_isClosed.js", "PaperFileconfig.json", "MyTasks-config.json", "AFAconfig.json", "roDocumentTypes.json", "uappol-upload-rule.js", "uappolCreateFolderRule.js", "uappolCreateFolder.js", "uappol-api.js", "uappol-functions.js", "command-utils.js", "backup and log.js", "backup.js", "example test script.js", "test return value.js", "start-pooled-review-workflow.js", "command-processor.js", "command-search.js", "alfresco docs.js", "append copyright.js", "createDepartmentJSON.js", "hrsDaily.js", "hrsFolderCreateSchedule.js", "hrsScanned.js", "hrsCreateFolder.js", "hrsFolderCreateRule.js", "hrsFileShareFolder.js", "alesCreateFolderRestricted.js", "alesCreateFolderSchedule.js", "alesBulkShareFolder.js", "alesFileScanned.js", "alesCreateFolder.js", "alesDaily.js", "alesFileShareFolder.js", "alesCreateFolderConfidential.js", "alesCreateAdvisingNotes.js", "alesFolderCreateSchedule.js", "deployWebServiceDescriptor.js", "taskReportCSV-Appointment-prod.js", "artsFileScanned.js", "artsCreateFolderRule.js", "artsCreateFolder.js", "artsCreateFolderRestricted.js", "augCreateFolderRestricted.js", "augCreateFolder.js", "businessCreateFolderRule.js", "businessCreateFolder.js", "businessCreateFolderSchedule.js", "businessBulkShareFolder.js", "businessFileShareFolder.js", "businessCreateFolderRestricted.js", "businessDaily.js", "businessCreateAdvisingNotes.js", "businessFileScanned.js", "CAPSendMonthlyReportEmail.js", "CAPGenerateMonthlyReport.js", "CapFinalReportSubmit.js", "chsCreateFolderRule.js", "chsEmailOnUpdateComment.js", "chsReport.js", "EmailNotifCHSStudent.js", "SetExpiryDate.js", "chsCreateFolder.js", "chsFacultyReport.js", "chsAgreementCreateFolderRule.js", "chsAgreementCreateFolder.js", "scheduleJobTest.js", "every52MinPastHour.js", "every46MinPastHourBetween4PM12PM.js", "every57MinPastHour.js", "every47MinPastHourBetween4PM12PM.js", "everyDay4H30MinAM.js", "everyDay7H45MinAM.js", "every10MinStartingAt5MinPastHour.js", "every38MinPastHourBetween4PM12PM.js", "every20MinStartingAt15MinPastHour.js", "everyDay2H05MinAM.js", "every2MinStartingAt1MinPastHour.js", "everyDay1H05MinAM.js", "everyDay12H30MinAM.js", "everyDay7H30MinPM.js", "every30MinStartingAt19MinPastHour.js", "every30MinStartingAt11MinPastHour.js", "everyDay2H35MinAM.js", "every30MinStartingAt26MinPastHour.js", "every16MinPastHour.js", "everyDay1H45MinAM.js", "everyDay2H45MinAM.js", "every29MinPastHour.js", "every22MinPastHour.js", "everyDay11H30MinPM.js", "educationCreateFolderRule.js", "educationCreateFolder.js", "educationCreateAdvisingNotes.js", "enggCoopCreateFolderRestricted.js", "enggCoopCreateFolderRule.js", "enggCoopBulkUpload.js", "enggCreateFolderRule.js", "enggCreateFolderRestricted.js", "enggCreateFolder.js", "engineeringCreateAdvisingNotes.js", "enggCoopCreateFolder.js", "enggFileScanned.js", "enggCoopFileScanned.js", "extensionFileScanned.js", "extensionCreateFolder.js", "extensionCreateFolderRule.js", "fgsrCreateGuidelineAPSProcessFromCSV.js", "fgsrDocRestructure.js", "fgsrMigrationScript.js", "fgsrDocRelocation.js", "fgsrCreateFolderFromCSV.js", "guideline-reports.js", "fgsrMigrationScript-withTerminationLogic.js", "modfiyOrUpdatePropertyfromCSV.js", "fgsr-case-file-report.js", "fgsrCreateAPSProcessFromFolder.js", "fgsrCreateFolder.js", "fgsrCopyMetadataToFolderLevel.js", "fgsrCreateAPSProcessFromCSV.js", "foCreateFolder.js", "foCreateFolderRule.js", "Script1.js", "Script2.js", "scheduleRunEvery2-10PM.js", "scheduleRunEvery5PMTo10PM.js", "scheduleRunEvery30Minutes.js", "scheduleRunEvery60Minutes.js", "scheduleRunEveryday3PMto11PM.js", "scheduleRunEveryday12AMto6AM.js", "scheduleRunEvery20Minutes.js", "scheduleRunEvery2AM.js", "acsToApsUserUpdate.js", "2024-01-13-log.txt", "2024-01-15-log.txt", "2024-01-20-log.txt", "2024-01-21-log.txt", "2024-01-22-log.txt", "2024-01-23-log.txt", "2024-02-04-log.txt", "2024-02-05-log.txt", "2024-02-06-log.txt", "2024-02-07-log.txt", "2024-02-08-log.txt", "2024-01-14-log.txt", "2024-01-18-log.txt", "2024-01-11-log.txt", "2024-01-16-log.txt", "2024-01-19-log.txt", "2024-01-26-log.txt", "2024-01-28-log.txt", "2024-01-30-log.txt", "2024-01-12-log.txt", "2024-01-29-log.txt", "2024-01-27-log.txt", "2024-01-31-log.txt", "2024-01-24-log.txt", "2024-02-09-log.txt", "2024-02-02-log.txt", "2024-01-09-log.txt", "2024-02-03-log.txt", "2024-01-05-log.txt", "2024-01-06-log.txt", "2024-01-04-log.txt", "2024-02-01-log.txt", "2024-01-07-log.txt", "2024-01-08-log.txt", "2024-02-10-log.txt", "2024-02-11-log.txt", "2024-02-12-log.txt", "2024-02-13-log.txt", "2023-12-31-log.txt", "2024-02-15-log.txt", "2024-02-16-log.txt", "2024-02-14-log.txt", "2024-02-18-log.txt", "2024-02-20-log.txt", "2024-01-17-log.txt", "2024-02-19-log.txt", "2024-01-10-log.txt", "2024-02-23-log.txt", "2024-02-25-log.txt", "2024-02-21-log.txt", "2024-01-25-log.txt", "2024-02-28-log.txt", "2024-02-22-log.txt", "2024-02-29-log.txt", "2024-03-02-log.txt", "2024-03-03-log.txt", "2024-02-26-log.txt", "2024-03-04-log.txt", "2024-03-06-log.txt", "2024-03-07-log.txt", "2024-03-05-log.txt", "2024-03-08-log.txt", "2024-03-09-log.txt", "2024-03-11-log.txt", "2024-03-10-log.txt", "2024-03-12-log.txt", "2024-03-13-log.txt", "2024-03-14-log.txt", "2024-03-15-log.txt", "2024-03-16-log.txt", "2024-03-17-log.txt", "2024-03-18-log.txt", "2024-03-20-log.txt", "2024-03-21-log.txt", "2024-03-22-log.txt", "2024-03-19-log.txt", "2024-03-23-log.txt", "2024-03-01-log.txt", "2024-03-26-log.txt", "2024-03-25-log.txt", "2024-03-28-log.txt", "2024-03-29-log.txt", "2024-03-27-log.txt", "2024-03-24-log.txt", "2024-03-30-log.txt", "2024-04-02-log.txt", "2024-04-03-log.txt", "2024-03-31-log.txt", "2024-04-05-log.txt", "2024-04-06-log.txt", "2024-04-07-log.txt", "2024-04-08-log.txt", "2024-04-09-log.txt", "2024-04-04-log.txt", "2024-04-11-log.txt", "2024-04-12-log.txt", "2024-04-13-log.txt", "2024-02-17-log.txt", "2024-04-01-log.txt", "2024-04-16-log.txt", "2024-04-15-log.txt", "2024-04-10-log.txt", "2024-04-17-log.txt", "2024-02-24-log.txt", "2024-04-14-log.txt", "2024-04-19-log.txt", "2024-04-21-log.txt", "2024-04-22-log.txt", "2024-04-23-log.txt", "2024-04-24-log.txt", "2024-04-26-log.txt", "2024-04-25-log.txt", "2024-04-29-log.txt", "2024-04-30-log.txt", "2024-05-01-log.txt", "2024-05-02-log.txt", "2024-05-03-log.txt", "2024-05-04-log.txt", "2024-05-05-log.txt", "2024-05-06-log.txt", "2024-04-28-log.txt", "2024-05-07-log.txt", "2024-04-18-log.txt", "2024-05-08-log.txt", "2024-05-09-log.txt", "2024-05-10-log.txt", "2024-05-12-log.txt", "2024-05-14-log.txt", "2024-05-11-log.txt", "2024-05-16-log.txt", "2024-04-27-log.txt", "2024-05-17-log.txt", "2024-05-15-log.txt", "2024-05-18-log.txt", "2024-05-20-log.txt", "2024-05-21-log.txt", "2024-05-19-log.txt", "2024-05-22-log.txt", "2024-05-23-log.txt", "2024-05-25-log.txt", "2024-05-24-log.txt", "2024-05-26-log.txt", "2024-05-27-log.txt", "2024-05-28-log.txt", "2024-05-29-log.txt", "2024-05-30-log.txt", "2024-06-02-log.txt", "2024-05-13-log.txt", "2024-06-01-log.txt", "2024-05-31-log.txt", "2024-04-20-log.txt", "2024-06-03-log.txt", "2024-06-04-log.txt", "2024-06-05-log.txt", "2023-12-30-log.txt", "2023-12-01-log.txt", "2024-02-27-log.txt", "2023-12-29-log.txt", "gtaGraProcessToCSV.js", "gtaGraProcessToCSV-2AM.js", "hrs-benefit-report.js", "westCanDocumentMove.js", "hrsbsReviewCycleReport.js", "hrsbsCreateFolderRule.js", "HRSBS-SyncCCIDs.js", "hrsbsCreateFolder.js", "FVCA-data-import.js", "FVCA-manual-property-update.js", "istPerformanceReviewCreateFolder.js", "lawCreateFolderRestricted.js", "lawFileScanned.js", "lawCreateFolder.js", "lawCreateFolderRule.js", "nativeStudiesCreateFolderRestricted.js", "nsFolderCreateSchedule.js", "nativeStudiesCreateFolder.js", "nativeStudiesCreateFolderRule.js", "ADV-notify-type-mapping.json", "OOA-notify-email.js", "ADV-notify-terms-types.js", "pcm-grab-competitive-noderefs.js", "pcm-update-competitive-noderefs.js", "pcmCreateFolder.js", "psUpdateAlfrescoDepartment.js", "pllcCreateFolder.js", "qaProcess.js", "qaRelease.js", "rmOOABackgroundInformationFiling.js", "rmFilingDoc.js", "rmSearchmatchNomatchFiling.js", "rmFilingConfig.json", "thesisDestructionReport.js", "rmThesis.js", "add_document_type_ro.js", "updateSearchMatchStatus.js", "searchmatchFullDob.js", "createROReconciliationReports.js", "eTranscriptInstList.js", "folder-create-ro.js", "augTranscript.js", "addTimeStamp.js", "missingDocumentList-csv.js", "roAddAspectAndMoveAFA.js", "myTaskDownload.js", "roAddAspectAndMoveTranscript.js", "roAddBundlingAspect.js", "roAddSearchMatchAspect.js", "roCopyEphesoftMetadataXML.js", "roBatchScript.js", "addSearchMatchDocumentType.js", "roCreateEducationalCSV.js", "roCopyOlderScannedDocument.js", "roDocumentListAPLSTD.js", "roCopyOlderScannedDocumentAdHoc.js", "roEtranscriptReport.js", "roDailyQA.js", "roEtranscriptsBundleTest.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "roFolderCreateLDAPLookup.js", "roEtranscriptsBundle.js", "roAddComment.js", "roCopyEphesoftMetadataScanned.js", "roMoveCompleted.js", "roMoveCompletedBackScan.js", "roMoveCompletedSearchMatch.js", "roEtranscriptPDFConverter.js", "roScanningMetadata.js", "roScript1.js", "RORoutingWorkflowUtil.js", "roScript3.js", "roScript2.js", "roScanningMetadataBackScan.js", "roScript7.js", "roScript6.js", "roScript9.js", "roScript1BackScan.js", "roSearchMatchNoMatchReport.js", "roSearchMatchQuery.js", "RONotification.js", "roSlateDocumentExport.js", "roTagAndFileRenderedPDFs.js", "roScript4.js", "roScript5.js", "roScript8.js", "createSlateFolioMaterialDropdown.js", "createSlateApplicationsCSV.js", "LaunchWorkflowUtils.js", "PaperFileUtils.js", "GenerateSponsornamesAndPinames.js", "rsoCreateFolder.js", "sciCreateFolderConfidential.js", "sciCreateFolderPublic.js", "sciCreateFolder.js", "sciCreateFolderRestricted.js", "scienceASDocumentImport.js", "sciFileADDPFileTypes.js", "sciFileShareFolder.js", "sciFileScanned.js", "sciBulkShareFolder.js", "copy-signed-offer-letter.js", "dept-config.js", "reappointment-generate-schedule.js", "reappointment-reminder-schedule.js", "reappointment-generate-process.js", "manual-generate-script.js", "reappointment-reminder-process.js", "reminder-email-util.js", "reappointment-tracking-schedule.js", "reappointment-tracking-process.js", "appointment-report.js", "appointment-report-schedule.js", "manual-tracking-script.js", "sfsCreateFolder.js", "sfsWorkflowStatus.js", "security-group-user.js", "createReportPermissionsFoldersInASite.js", "siteMembersReport.js", "createReportRecursiveGroupsAndUsersInASite.js", "search-responses.js", "advChangeDocumentType.js", "addFolderMetadata.js", "advChangeDocumentType_confidential.js", "consignOInitiatorOfferLetterChange.js", "advChangeDocumentType_background.js", "transcriptResponse.js", "change-fgsr-pdf-file-name-with-date.js", "copy-fgsr-to-graduate-students-records.js", "ADVDonationCalendarToFiscal.js", "document-query.js", "deletingCompletingWorkflow.js", "eTranscriptTemp.js", "eTranscript-bundled-02-jan.js", "eTranscriptVersionModifierFix.js", "fixCheckout.js", "removeDonationGrp.js", "eTranscriptVersioningFix.js", "move-fgsr-folder.js", "search-match-dob-add.js", "thesisDepositArchival.js", "moveThesesForTransfer.js", "eraReportGeneration.js", "kofaxMetadataMerge.js", "kofaxMetadataMergeMissing.js", "generic2min.js", "kofaxSendEmail.js", "PeopleSoft-eTranscript-XML-PDF.js", "startBenefitWorkflow.js", "peoplesoftMetadataMergeMissing.js", "securityWorkflowUtil.js", "startPayActionWorkflow.js", "startDepartmentAdhocApprovalWorkflow.js", "convertTranscript.js", "CreateTranscriptUserMemberships.js", "startTwoStepWorkflow.js", "fix_employee_names.js", "env.js", "folderCreateUtil.js", "folderCreateUtilAA.js", "generalSchedule.js", "JSON.js", "xmlUtil.js", "addPersonAspect.js", "addTimeStampRandomFileName.js", "archiveDocument.js", "luceneUtil.js", "util.js", "archivedItems.js", "getProjectDetails.js", "ADVChangeAuthor.js", "ADVcalendarToFiscal.js", "symplexUtils.js", "advBatchProcessing.js", "advChangeDocumentName.js", "ADVEphesoftMove.js", "advCreateFolderScheduled.js", "advErrorMessageReset.js", "advMetadataUpdate.js", "advMoveToFoldersScheduled.js", "ADVendFundReportFiling.js", "advReconcilliation.js", "ADVmoveRecordsToPreQA.js", "advScanningMetadata.js", "advScript2.js", "advScript3.js", "advScript4.js", "advScript1.js", "advScript5.js", "advScriptDaily.js", "advScriptMonthly.js", "advScriptKofax.js", "ADVSiteContext.js", "advMoveToFolder.js", "deleteEphesoftDoc.js", "advUtils.js", "folderCreateADV.js", "advScriptDaily30minFreq.js", "jsonUtils.js", "advScanning.js", "folderCreateDocumentADV.js", "moveToFolders.js", "symplexMetadataUpdate.js", "OOA_SOT_Name_change.js", "moveToFoldersRetainTitle.js", "advScriptWeekly.js", "symplexMoveToFolder.js", "clioToAcsDocUpdate.js", "ClioUpdateScheduledJob.js", "smartFoldersExample.json", "system-overview.html", "businessDocSetup.json", "uappolDocSetup.json", "businessConfig.json", "augConfig.json", "augDocSetup.json", "lawConfig.json", "uappolConfig.json", "UAlbertaSettings.json", "hrsbsDocSetup.json", "advConfig.json", "hrsbsConfig.json", "hrsConfig.json", "hrsDocSetup.json", "advSimplexMapping.json", "advDocSetup.json", "artsDocSetup.json", "alesConfig.json", "alesDocSetup.json", "archiveFolder.json", "artsConfig.json", "advScanningMapping.json", "collegeOfHealthSciencesConfig.json", "chsAgreementsConfig.json", "dropboxCommonAspects.json", "collegeOfHealthSciencesDocSetup.json", "chsAgreementsDocSetup.json", "educationConfig.json", "extensionConfig.json", "fgsrv2DocSetup.json", "foConfig.json", "foDocSetup.json", "educationDocSetup.json", "lawDocSetup.json", "nativeStudiesDocSetup.json", "pllcConfig.json", "pllcDocSetup.json", "roConfig.json", "fgsrv2Config.json", "rsoConfig.json", "rsoDocSetup.json", "sciConfig.json", "eTranscriptConfig.json", "sciDocSetup.json", "roDocSetup.json", "sfsDocSetup.json", "UAlbertaSettings.conf", "student-recordsConfig.json", "securityWorkflowSetting.json", "thesisDepositConfig.json", "globalHeader.html.ftl", "webFormDialog.html.ftl", "alfrescoUserGroupRequest.ftl", "pensionBenefit.html.ftl", "pinames.json", "sponsornames.json", "searchPageConfig.json", "pcmDocSetup.json", "pcmConfig.json", "qaConfig.json", "apsAppConfig.json", "fgsrCreateApsFromCSV.json", "fgsrCopyMetadata.json", "enggCoopDocSetup.json", "enggDocSetup.json", "enggConfig.json", "enggCoopConfig.json", "CapApsConfig.json", "extensionDocSetup.json", "readme.html", "readme_de.html", "readme_ja.html", "readme_fr.html", "advEndowmentName.get.desc.xml", "advEndowmentName.get.json.ftl", "advEndowmentName.get.js", "advEntityName.get.desc.xml", "advEntityName.get.js", "advEntityName.get.html.ftl", "search.get.desc.xml", "search.get.js", "search.get.html.ftl", "changeInitiatorAppt.put.desc.xml", "eSignatureStatusHistory.get.html.ftl", "changeInitiatorAppt.put.json.ftl", "eSignatureStatusHistory.get.desc.xml", "appointmentSubmit.get.js", "processIdProps.get.desc.xml", "changeInitiatorAppt.put.js", "processIdProps.get.json.ftl", "processIdProps.get.js", "appointmentLandingPage.get.desc.xml", "appointmentLandingPage.get.js", "appointmentLandingPage.get.html.ftl", "appointmentStart.get.desc.xml", "appointmentStart.get.html.ftl", "appointmentStart.get.js", "appointmentStartTest.get.desc.xml", "appointmentStartTest.get.js", "appointmentStartTest.get.html.ftl", "appointmentSubmit.get.desc.xml", "appointmentSubmit.get.html.ftl", "eSignatureStatusHistory.get.js", "apsApplicationList.get.desc.xml", "apsApplicationList.get.html.ftl", "assignuser.put.js", "assignuser.put.json.ftl", "claimtask.put.desc.xml", "claimtask.put.js", "claimtask.put.json.ftl", "completetask.post.desc.xml", "completetask.post.json.ftl", "completetask.post.js", "getapsdbid.get.desc.xml", "getapsdbid.get.json.ftl", "gettasks.get.desc.xml", "gettasks.get.json.ftl", "assignuser.put.desc.xml", "gettasks.get.js", "savetask.post.desc.xml", "savetask.post.js", "savetask.post.json.ftl", "taskForm.get.js", "taskForm.get.desc.xml", "tasklist.get.desc.xml", "apsApplicationList.get.js", "taskForm.get.json.ftl", "tasklist.get.html.ftl.jquery", "tasklist.get.html.ftl", "tasklist.get.js", "triggerapsprocess.post.desc.xml", "triggerapsprocess.post.js", "updatevariables.post.desc.xml.notused", "triggerapsprocess.post.json.ftl", "updatevariables.post.json.ftl.notused", "getapsdbid.get.js", "updatevariables.post.js.notused", "taskUtils.js", "apsGroupsConfig.json", "apsSitesConfig.json", "apptStepZeroStarter.post.desc.xml", "apptStepZeroStarter.post.json.ftl", "apptStepZeroStarter.post.js", "apptStepOneStarter.post.desc.xml", "apptStepOneStarter.post.js", "apptStepOneStarter.post.json.ftl", "apptStepOneSave.post.json.ftl", "apptStepOneSave.post.desc.xml", "apptStepOneSave.post.js", "apptStatusDocUpdate.post.desc.xml", "apptStatusDocUpdate.post.json.ftl", "apptStatusDocUpdate.post.js", "APSWorkflowStatus.get.desc.xml", "APSWorkflowStatus.put.html.ftl", "APSWorkflowStatus.get.html.ftl", "APSWorkflowInfo.put.html.ftl", "APSWorkflowStatus.put.desc.xml", "APSWorkflowInfo.put.desc.xml", "APSWorkflowStatus.get.js", "APSWorkflowStatus.put.js", "APSWorkflowInfo.put.js", "NodeInfo.get.desc.xml", "NodeInfo.get.html.ftl", "capinfo.get.js", "capstart.get.js", "epsb.get.js", "epsb.get.html.ftl", "capstart.get.html.ftl", "epsb.get.desc.xml", "schoolboard.get.html.ftl", "NodeInfo.get.js", "NodeInfoByCapId.get.desc.xml", "updateVariable.post.json.ftl", "updateVariable.post.js", "schoolboard.get.desc.xml", "updateVariable.post.desc.xml", "schoolboard.get.js", "capinfo.get.html.ftl.backup", "cap-file-load.post.json.ftl", "NodeInfoByCapId.get.js", "capinfo.get.html.ftl", "capstart.get.desc.xml", "cap-file-load.post.desc.xml", "capinfo.get.desc.xml", "cap-file-load.post.js", "capeamergedoc.get.js", "capeamergedoc.get.desc.xml", "capeamergedoc.get.html.ftl", "capConfig.js", "chsEnv.js", "chsConfig.js", "chsAdminStuView.get.desc.xml", "chsAdminStuView.get.html.ftl", "chsAdminStuView.get.js", "coupa.get.html.ftl", "coupa.get.desc.xml", "coupa.get.js", "coveoGetDocList.get.desc.xml", "coveoGetDocList.get.json.ftl", "coveoGetDocList.get.js", "getJson.get.desc.xml", "getJson.get.js", "getJson.get.json.ftl", "simpleupload.post.desc.xml", "simpleupload.post.json.ftl", "simpleupload.post.js", "consignoMessage.get.js", "consignoWebhook.post.js", "consignoWebhook.post.json.ftl", "consignoMessage.get.desc.xml", "consignoWebhook.post.desc.xml", "consignoMessage.get.json.ftl", "eSignDownload.get.js", "eSignDownload.get.html.ftl", "eSignDownload.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-supervisorv2.get.js", "review-supervisorv2.get.html.ftl", "fgsrssgLanding.get.js", "review-comm01v2.get.desc.xml", "fgsrssgLanding.get.html.ftl", "review-comm01v2.get.html.ftl", "review-comm02v2.get.desc.xml", "review-comm02v2.get.html.ftl", "fgsrssgLanding.get.desc.xml", "review-studentv2.get.html.ftl", "review-comm03v2.get.html.ftl", "review-comm03v2.get.desc.xml", "review-studentv2.get.desc.xml", "review-cosupervisorv2.get.html.ftl", "review-comm02v2.get.js", "review-startv2.get.desc.xml", "review-studentv2.get.js", "review-cosupervisorv2.get.js", "review-startv2.get.js", "review-student-revisionv2.get.html.ftl", "review-student-revisionv2.get.desc.xml", "review-startv2.get.html.ftl", "review-comm03v2.get.js", "review-cosupervisorv2.get.desc.xml", "review-student-revisionv2.get.js", "review-comm01v2.get.js", "review-comm02.get.desc.xml", "review-comm02.get.html.ftl", "review-comm03.get.desc.xml", "review-comm02.get.js", "review-comm03.get.html.ftl", "review-cosupervisor.get.desc.xml", "review-cosupervisor.get.html.ftl", "review-cosupervisor.get.js", "review-nextdate.get.desc.xml", "review-comm03.get.js", "review-nextdate.get.js", "review-student.get.html.ftl", "review-student.get.js", "review-student-revision.get.desc.xml", "review-student.get.desc.xml", "review-student-revision.get.js", "review-studentTest.get.desc.xml", "review-supervisor.get.desc.xml", "review-studentTest.get.js", "review-supervisor.get.html.ftl", "review-supervisor.get.js", "review-comm01.get.desc.xml", "review-comm01.get.html.ftl", "review-comm01.get.js", "review-student-revision.get.html.ftl", "review-nextdate.get.html.ftl", "review-studentTest.get.html.ftl", "guidelines-supervisor.get.desc.xml", "guidelines-supervisor-revision.get.html.ftl", "guidelines-start.get.desc.xml", "guidelines-start.get.html.ftl", "guidelines-start.get.js", "guidelines-student.get.desc.xml", "guidelines-student.get.html.ftl", "guidelines-student-revision.get.js", "guidelines-student-revision.get.desc.xml", "guidelines-supervisor.get.html.ftl", "guidelines-supervisor-revision.get.desc.xml", "guidelines-student-revision.get.html.ftl", "guidelines-student.get.js", "guidelines-supervisor.get.js", "guidelines-supervisor-revision.get.js", "programExtensionScript.js", "customScript.js", "customCSS_FGSR2.css", "customCSS_FGSR.css", "fgsrEnv.js", "FGSR-Forms-Config.js", "config.js", "googleAddon.get.json.ftl", "googleAddon.get.desc.xml", "googleAddon.get.js", "gtaGraStatus.post.json.ftl", "gtaGraStatus.post.js", "gtaGraStatus.post.desc.xml", "wfh-manager.get.desc.xml", "wfh-form.get.js", "wfh-manager.get.html.ftl", "wfh-form.get.desc.xml", "wfh-revise.get.desc.xml", "wfh-revise.get.html.ftl", "wfh-revise.get.js", "wfh-seniormanager.get.desc.xml", "wfh-manager.get.js", "wfh-seniormanager.get.js", "wfh-seniormanager.get.html.ftl", "wfh-form.get.html.ftl", "hrsbsDocumentLinking.get.desc.xml", "hrsbsDocumentLinking.get.html.ftl", "hrsbsDocumentLinking.get.js", "coi-start.get.desc.xml", "coi-start.get.html.ftl", "coi-revise.get.html.ftl", "coi-employee.get.html.ftl", "coi-employee.get.desc.xml", "coi-revise.get.desc.xml", "coi-start.get.js", "coi-revise.get.js", "coi-supervisor.get.js", "coi-supervisor.get.desc.xml", "coi-employee.get.js", "coi-supervisor.get.html.ftl", "getTaskFilter.get.json.ftl", "queryTasks.get.json.ftl", "routableGroups.get.desc.xml", "routableGroups.get.js", "routableGroups.get.json.ftl", "queryTasks.get.desc.xml", "setTaskFilter.post.js", "setTaskFilter.post.json.ftl", "setTaskFilter.post.desc.xml", "applyTaskAction.post.js", "applyTaskAction.post.json.ftl", "applyTaskAction.post.desc.xml", "getTaskFilter.get.desc.xml", "getTaskFilter.get.js", "queryTasks.get.js", "avmbrowse.get.desc.xml", "avmbrowse.get.html.ftl", "avmbrowse.get.js", "avmstores.get.desc.xml", "avmstores.get.html.ftl", "blogsearch.get.atom.400.ftl", "blogsearch.get.html.400.ftl", "blogsearch.get.desc.xml", "blogsearch.get.js", "categorysearch.get.atom.404.ftl", "blogsearch.get.html.ftl", "categorysearch.get.html.404.ftl", "categorysearch.get.js", "categorysearch.get.html.ftl", "categorysearch.get.desc.xml", "folder.get.desc.xml", "folder.get.html.ftl", "folder.get.js", "psDeptAll.get.js", "psDeptSingle.get.json.ftl", "psDeptSingle.get.js", "psPerson.get.json.ftl", "psUtil.js", "psPerson.get.js", "psAcademicDeptAll.get.desc.xml", "psAcademicDeptAll.get.json.ftl", "psAuthorizedApprover.get.desc.xml", "psDeptAll.get.json.ftl", "psAuthorizedApprover.get.js", "psAuthorizedApprover.get.json.ftl", "psDeptAll.get.desc.xml", "psDeptSingle.get.desc.xml", "psPerson.get.desc.xml", "ceeb.get.desc.xml", "ceeb.get.json.ftl", "getSlateId.get.desc.xml", "getSlateId.get.js", "materials.get.json.ftl", "materials.get.desc.xml", "getSlateId.get.json.ftl", "ceeb.get.js", "materials.get.js", "edit.get.html.ftl", "edit.get.js", "save.post.js", "save.post.json.ftl", "scans.get.desc.xml", "scans.get.js", "uploadfile.post.desc.xml", "uploadfile.post.json.ftl", "edit.get.desc.xml", "uploadfile.post.js", "scans.get.html.ftl", "save.post.desc.xml", "AFA_Main.post.desc.xml", "AFA_MainFileOnly.post.desc.xml", "AFA_MainFileOnly.post.js", "AFA_Main.post.js", "AFA_MainFileOnly.post.json.ftl", "AFA_Main.post.json.ftl", "paperFileUtil.get.desc.xml", "paperFileUtil.get.js", "paperFileUtil.get.html.ftl", "rsoprojectdetails.get.html.ftl", "rsoprojectdetails.get.js", "rsoprojectdetails.get.desc.xml", "roslateapplist.get.html.ftl", "roslateapplist.get.desc.xml", "roslateapplist.get.json.ftl", "roslateexists.get.html.ftl", "roslateexists.get.desc.xml", "roslateapplist.get.js", "roslateexists.get.js", "uofaDepartmentList.get.desc.xml", "uofaDepartmentList.get.js", "uofaDepartmentList.get.html.ftl", "uofaDepartmentName.get.desc.xml", "uofaDepartmentName.get.html.ftl", "uofaFacultyList.get.html.ftl", "uofaFacultyList.get.desc.xml", "uofaDepartmentName.get.js", "uofapersonid.get.desc.xml", "uofapersonidrest.get.html.ftl", "uofapersonidrest.get.desc.xml", "uofapersonid.get.html.ftl", "uofapersonid.get.js", "uofapersonidrest.get.js", "uappolCategoryHeirarchy.get.desc.xml", "uappolCategoryHeirarchy.get.json.ftl", "uappol-metadata-query.get.desc.xml", "uappol-metadata-query.get.js", "uappol-metadata-query.get.json.ftl", "uappolCategoryHeirarchy.get.js", "siteFileViewer.get.desc.xml", "siteFileViewerConfig.js", "siteFileViewer.get.html.ftl", "siteFileViewer.get.js", "publicSiteFileViewer.get.html.ftl", "publicSiteFileViewer.get.desc.xml", "publicSiteFileViewer.get.js", "cronJob.post.desc.xml", "cronJob.post.js", "cronJob.post.json.ftl", "studentupload.get.html.ftl", "generatereport.get.json.ftl", "generatereport.get.desc.xml", "approvethesis.post.js", "generatereport.get.js", "search-match-attach.get.js", "search-match-list.get.html.ftl", "search-match-result.get.html.ftl", "search-match-result.get.js", "search-match-list.get.js.old", "chs-agreements.get.js", "chs-agreements.get.html.ftl", "chs-upload.get.html.ftl", "chs-upload.get.js", "uamytasks.config.get.js", "chsStudentView.get.js", "chsStudentView.get.html.ftl", "foModel.xml", "uofaDocTypes.xml", "uofaDocTypes.json", "foModel.json", "tim-sops", "FandO", "cbsr", "nanofab", "support-documentation", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b" ], "public": 1, "adversary": "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 57, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 4, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7132, "hostname": 3118, "URL": 4909, "email": 20, "FileHash-SHA256": 2144, "FileHash-MD5": 29, "FileHash-SHA1": 29 }, "indicator_count": 17381, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "233 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708ef0cdb40fa0e7d239ca", "name": "either emotet or a part of it", "description": "", "modified": "2023-12-06T15:10:40.867000", "created": "2023-12-06T15:10:40.867000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 342, "hostname": 456, "domain": 349, "URL": 1730, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 2879, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "628e790d414886e18b33c262", "name": "either emotet or a part of it", "description": "var a.tldDomains, AWIN.Tracking.com, has a new name for its basket, but how do you find it in your browser?.. and what does this mean?", "modified": "2022-06-24T00:01:00.706000", "created": "2022-05-25T18:44:29.280000", "tags": [ "tfunction", "cnullvvoid", "wnullgvoid", "bnullhvoid", "gnullcvoid", "guidewrapper", "blog", "lfunction", "hotjar", "iab2", "code", "number", "party", "n strictly", "life spann", "azuren n", "cookie tracking", "tablen n", "n cookies", "cookie", "null", "date", "error", "ffffff", "typeof t", "uint16array", "regexp", "uint8array", "array", "uint32array", "helvetica", "void", "execution", "body", "roboto", "prop", "object", "param", "cookies", "getcookie", "name", "typeof", "uri component", "obj2", "typeof e", "webkit", "component", "typeof y", "typeof symbol", "suspense", "context", "forwardref", "unknown", "4096", "function", "typeof n", "typeof window", "uuidv4", "ajsanonymousid", "suffix", "bill", "viewed", "pavel krayzel", "psd2", "bt prorata", "amex", "squad", "march", "new visitors", "promise", "nthis", "eventprocessor", "typeof define", "info", "functional", "member", "hnew regexp", "qfunction", "adview", "addbillinginfo", "addtocart", "addtolist", "contact", "download", "install", "window", "value", "customevent", "image", "samesitelax", "invalid pixel", "snap", "afaf09", "sfunction", "cfunction", "post", "appcuesdeps", "typeerror", "hki3", "ogr1", "typeof self", "full selector", "heatmaps", "sans", "version", "releaseid", "appcues", "dashboard2", "dashboard3", "technology", "selector", "click", "next", "import", "generic", "started", "dismissed", "completed", "contextual help", "symbol", "appcuesfunction", "widget", "iframe", "pnull", "html", "style", "ctnull", "fanull", "license", "ynull", "config", "meta", "accept", "contabo gmbh", "typeof hj", "https", "learn", "surveyv2", "surveyisolated", "safari", "firefox", "chrome", "remove", "edge", "correct", "section", "segoe ui", "emoji", "opera", "path", "span", "this", "typeof document", "small", "blank", "pass", "core", "footer", "close", "form", "main", "direct", "reduceright", "string", "f420", "gyfpnzbgtf3", "copyright", "json", "sesprops", "href", "input", "class", "logger", "target", "push", "awalt", "awinawin", "explorer", "awatp", "ccampid", "impid", "tag1" ], "references": [ "https://www.dwin1.com/13976.js", "https://cdn.heapanalytics.com/js/heap-3501642718.js", "https://www.googletagmanager.com/gtag/js?id=G-YFPNZBGTF3&l=dataLayer&cx=c", "https://contabo.com/client/client.a529db28.js", "https://contabo.com/client/client-30e55c50.css", "https://static.hotjar.com/c/hotjar-2086874.js?sv=6", "https://l.clarity.ms/s/0.6.34/clarity.js", "https://www.clarity.ms/tag/uet/5739677", "https://fast.appcues.com/generic/main/4.35.3/appcues.main.e826b3c1f5ab15648ac446eafdbb489fd58d7f2d.js", "https://fast.appcues.com/79878.js", "https://cdn.segment.com/next-integrations/integrations/vendor/commons.54701049fd6fb8497e9e.js.gz", "https://cdn.segment.com/next-integrations/integrations/appcues/2.3.0/appcues.dynamic.js.gz", "https://cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz", "https://sc-static.net/scevent.min.js", "https://cdn.taboola.com/libtrc/unip/1331749/tfa.js", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "https://unpkg.com/@optimizely/optimizely-sdk@3.5.0/dist/optimizely.browser.umd.min.js", "https://cdn.optimizely.com/datafiles/HgHVKrf9ZD2dsZYVFb9JnD.json/tag.js", "https://www.hotjar.com/ensureSegmentId.js", "https://www.hotjar.com/_next/static/chunks/webpack-ca4d94cab12a165a123f.js", "https://www.hotjar.com/_next/static/chunks/framework-6994461647f52f294af9.js", "https://www.hotjar.com/persistUtmParams.js", "https://www.hotjar.com/_next/static/chunks/pages/_app-be5fbad980fd377922f7.js", "https://www.hotjar.com/_next/static/chunks/pages/index-b7f010d5161cd8f6ddab.js", "https://cdn.cookielaw.org/scripttemplates/6.5.0/otBannerSdk.js" ], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [ { "id": "ReduceRight", "display_name": "ReduceRight", "target": null } ], "attack_ids": [ { "id": "T1059", "name": "Command and Scripting Interpreter", "display_name": "T1059 - Command and Scripting Interpreter" } ], "industries": [], "TLP": "white", "cloned_from": null, "export_count": 11, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "adjadex1@gmail.com", "id": "187163", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 349, "hostname": 456, "URL": 1730, "FileHash-SHA256": 342, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 2879, "is_author": false, "is_subscribing": null, "subscriber_count": 68, "modified_text": "1438 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "references": [ "", "ceeb.get.js", "CAP-notify-monthly-report.ftl", "uofa-engg-coop-model.json", "guidelines-student.get.html.ftl", "ADVendFundReportFiling.js", "appointmentLandingPage.get.desc.xml", "graduate-student-records-site.json", "tamis-model.json", "roMoveCompletedBackScan.js", "guideline-reports.js", "2024-02-07-log.txt", "psAuthorizedApprover.get.desc.xml", "ro-method-receipt.json", "2024-01-17-log.txt", "psDeptSingle.get.json.ftl", "triggerapsprocess.post.desc.xml", "uAlbertaWorkflowGeneral.xml", "hrsCreateFolder.js", "uofa-engg-model.json", "roCreateEducationalCSV.js", "wf-email.html_nl.ftl", "ADV-notify-terms-types.ftl", "advCreateFolderScheduled.js", "https://sc-static.net/scevent.min.js", "following-email.html_de.ftl", "coi-employee.get.desc.xml", "ro-relationship-to-institution.json", "roSlateDocumentExport.js", "foConfig.json", "uofa-pc-model.xml", "lawCreateFolderRestricted.js", "ro-test-id.json", "search-match-list.get.html.ftl", "notify_user_email_nl.html.ftl", "cap-file-load.post.json.ftl", "apsApplicationList.get.desc.xml", "invite-email_fr.html.ftl", "epsb.get.html.ftl", "rmScriptThrowError.js", "search-match-dob-add.js", "pllc-security-list.json", "review-nextdate.get.html.ftl", "rso-financials-doc-type.json", "apptStepOneStarter.post.json.ftl", "https://www.hotjar.com/_next/static/chunks/webpack-ca4d94cab12a165a123f.js", "https://cdn.optimizely.com/datafiles/HgHVKrf9ZD2dsZYVFb9JnD.json/tag.js", "science-security-list.json", "reappointment-reminder-schedule.js", "2024-03-15-log.txt", "2024-02-01-log.txt", "guidelines-supervisor-revision.get.js", "nsFolderCreateSchedule.js", "APSWorkflowInfo.put.js", "augConfig.json", "faculty-of-engineering-site.json", "nanofab", "start-pooled-review-workflow.js", "https://static.hotjar.com/c/hotjar-2086874.js?sv=6", "2024-05-19-log.txt", "folderCreateUtilAA.js", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "invite-email.html.ftl", "eTranscriptVersionModifierFix.js", "roMoveCompleted.js", "2024-05-16-log.txt", "enggCoopDocSetup.json", "fix_employee_names.js", "PeopleSoft-eTranscript-XML-PDF.js", "customScript.js", "guidelines-student-revision.get.html.ftl", "chs-upload.get.js", "fgsr-exam-list.json", "rmOOABackgroundInformationFiling.js", "2024-06-03-log.txt", "faculty-of-science-site.json", "2024-03-08-log.txt", "review-supervisorv2.get.js", "appointmentStart.get.js", "roScript5.js", "roScanningMetadataBackScan.js", "wfh-seniormanager.get.desc.xml", "uappol-functions.js", "publicSiteFileViewer.get.js", "roFolderCreateLDAPLookup.js", "emailbody_textplain_share_es.ftl", "activities-email.ftl", "symplexMoveToFolder.js", "getSlateId.get.desc.xml", "fgsrv2DocSetup.json", "review-supervisorv2.get.html.ftl", "businessCreateFolder.js", "addSearchMatchDocumentType.js", "advScriptDaily.js", "wfh-manager.get.js", "roAddAspectAndMoveAFA.js", "uofa-aps-model.json", "ro-search-match.json", "roScript3.js", "emailbody_textplain_alfresco_de.ftl", "alesFileShareFolder.js", "roScanningMetadata.js", "taskForm.get.desc.xml", "advScript1.js", "uamytasks.config.get.js", "enggCoopCreateFolderRule.js", "apptStepOneSave.post.js", "sciCreateFolder.js", "notify_user_email_it.html.ftl", "review-comm01.get.js", "2024-03-02-log.txt", "uofapersonid.get.desc.xml", "roEtranscriptPDFConverter.js", "uofa-cap-model.json", "uofa-rso-model.xml", "review-studentv2.get.js", "myTaskDownload.js", "search-match-result.get.html.ftl", "2024-03-14-log.txt", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127/iocs", "savetask.post.js", "arts-security-list.json", "2024-02-21-log.txt", "EmailNotifCHSStudent.js", "2024-03-03-log.txt", "chsAdminStuView.get.js", "modfiyOrUpdatePropertyfromCSV.js", "folderCreateDocumentADV.js", "everyDay1H05MinAM.js", "clioToAcsDocUpdate.js", "search-match-list.get.js.old", "every38MinPastHourBetween4PM12PM.js", "general_example.ftl", "following-email_it.html.ftl", "enggCoopBulkUpload.js", "missingDocumentList-csv.js", "taskForm.get.json.ftl", "chs-studentExpired.ftl", "siteFileViewer.get.html.ftl", "2024-02-14-log.txt", "readme_fr.html", "wf-email_es.html.ftl", "review-comm03.get.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "assocModel.xml", "chsCreateFolderRule.js", "capeamergedoc.get.desc.xml", "psAudit-model.xml", "ephesoft-educational.xml", "augDocSetup.json", "roslateapplist.get.desc.xml", "https://cdn.taboola.com/libtrc/unip/1331749/tfa.js", "lawFileScanned.js", "hrs-bulkId.json", "2024-03-22-log.txt", "sfs-ussl-report-status.json", "review-comm01v2.get.html.ftl", "fvca-reminder-email.ftl", "fixCheckout.js", "capinfo.get.html.ftl.backup", "education-security-list.json", "rso-activation-report-doc-type.json", "generalSchedule.js", "coi-employee.get.js", "2024-01-12-log.txt", "uappolDocSetup.json", "readme.html", "2024-04-15-log.txt", "2024-02-16-log.txt", "roScript7.js", "review-student.get.html.ftl", "2024-04-02-log.txt", "2023-12-31-log.txt", "guidelines-start.get.desc.xml", "every47MinPastHourBetween4PM12PM.js", "completetask.post.desc.xml", "review-comm03v2.get.desc.xml", "tamis-model.xml", "getTaskFilter.get.desc.xml", "wf-email.html_it.ftl", "uofa-workflowGeneral.json", "engineering-doc-list.json", "uofa-common-model.xml", "AFA_MainFileOnly.post.js", "roAddSearchMatchAspect.js", "every2MinStartingAt1MinPastHour.js", "uAlbertaWorkflowGeneral.json", "roScript2.js", "fvca-corrections-email.ftl", "advEndowmentName.get.js", "pllcCreateFolder.js", "gtaGraStatus.post.desc.xml", "following-email_de.html.ftl", "2024-01-08-log.txt", "invite-email_de.html.ftl", "advEntityName.get.html.ftl", "review-nextdate.get.desc.xml", "fgsrMigrationScript.js", "augCreateFolderRestricted.js", "review-comm03.get.desc.xml", "appt-final-reminder.ftl", "hrsbsConfig.json", "uawfh-model.xml", "2023-12-01-log.txt", "deployWebServiceDescriptor.js", "chs-document-status.json", "claimtask.put.desc.xml", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all.", "chsAdminStuView.get.desc.xml", "enggCreateFolderRule.js", "chsConfig.js", "2024-01-29-log.txt", "roEtranscriptsBundleTest.js", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b", "facopr-model.xml", "consignoMessage.get.js", "sciCreateFolderPublic.js", "hrsbs-review-month.json", "notify_user_email_ooa_failed.ftl", "hrsScanned.js", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88/iocs", "fo-emergency-response-manual.json", "folderCreateUtil.js", "ClioUpdateScheduledJob.js", "old-AlfrescoToolkit.conf", "following-email_fr.html.ftl", "uofapersonid.get.js", "uofa-chs-agreements-model.json", "ales-doc-list.json", "fgsr-model.xml", "hrsbs-function-module.json", "AFA_MainFileOnly.post.desc.xml", "apptStatusDocUpdate.post.js", "CAPGenerateMonthlyReport.js", "every16MinPastHour.js", "security-group-model.xml", "uofa-native-studies-model.json", "istPerformanceReviewCreateFolder.js", "uarmm-supplement-scanning.xml", "2024-01-14-log.txt", "review-comm03v2.get.html.ftl", "getapsdbid.get.desc.xml", "uofa-slate-model.xml", "apsApplicationList.get.js", "uofa-extension-model.xml", "uofa-pc-model.json", "qaProcess.js", "consignoWebhook.post.js", "guidelines-supervisor-revision.get.html.ftl", "review-startv2.get.desc.xml", "gettasks.get.json.ftl", "ua-audit-generic-model.xml", "hrs-employeeApprovedDeductions.json", "2024-03-20-log.txt", "test return value.js", "routableGroups.get.js", "facopr-planTypes.json", "cap-file-load.post.desc.xml", "2024-02-20-log.txt", "invite_user_email.ftl", "createReportRecursiveGroupsAndUsersInASite.js", "review-comm02.get.html.ftl", "ales-security-list.json", "2024-02-22-log.txt", "uofa-cap-model.xml", "advScriptWeekly.js", "businessDaily.js", "siteFileViewerConfig.js", "eTranscriptTemp.js", "updatevariables.post.js.notused", "APSWorkflowStatus.put.html.ftl", "uaqa-model.json", "appointmentLandingPage.get.js", "chs-emailNotification.json", "moveToFoldersRetainTitle.js", "uofa-hrsbs-model.json", "2024-03-25-log.txt", "roAddBundlingAspect.js", "categorysearch.get.html.ftl", "new-user-email_fr.html.ftl", "ua-error-model.xml", "businessConfig.json", "canada-provinces-list.json", "businessDocSetup.json", "apptStatusDocUpdate.post.desc.xml", "chs-studentUploadNotification.ftl", "emailbody_textplain_alfresco_ja.ftl", "augustana-doc-list.json", "ua-audit-generic-model.json", "eSignDownload.get.desc.xml", "wfh-form.get.html.ftl", "2024-02-27-log.txt", "uappol-category-heirarchy.json", "emailbody_textplain_alfresco_es.ftl", "system-overview.html", "fgsrCreateAPSProcessFromCSV.js", "chs-agreements-site.json", "faculty-of-arts-site.json", "uofa-aps-model.xml", "JSON.js", "https://en.fofa.info/result?qbase64=ZWRtb250b25wb2xpY2UuY2E%3D", "AlfrescoToolkit.conf", "tasklist.get.js", "https://cdn.cookielaw.org/scripttemplates/6.5.0/otBannerSdk.js", "kofaxMetadataMergeMissing.js", "uofa-ales-model.xml", "schoolboard.get.desc.xml", "2024-03-21-log.txt", "hrs-site.json", "2024-05-11-log.txt", "review-comm02v2.get.html.ftl", "review-student-revision.get.html.ftl", "uofa-fo-model.xml", "appointment-report.js", "roslateexists.get.js", "roScript8.js", "psDeptSingle.get.js", "uofaDepartmentList.get.js", "cbsr", "uofa-chs-agreements-model.xml", "lawCreateFolderRule.js", "Script1.js", "2024-05-06-log.txt", "new-user-email_it.html.ftl", "savetask.post.json.ftl", "appt-halfway-reminder.ftl", "report_rmr_destructionReport.html.ftl", "scans.get.html.ftl", "school-of-business-site.json", "review-comm02.get.desc.xml", "fgsr-site.json", "transcript-model.xml", "scans.get.js", "enggFileScanned.js", "2024-02-02-log.txt", "AFA_Main.post.json.ftl", "https://l.clarity.ms/s/0.6.34/clarity.js", "uappolCategoryHeirarchy.get.json.ftl", "roScript6.js", "coi-start.get.desc.xml", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "2024-02-08-log.txt", "2024-01-24-log.txt", "demo-site-site.json", "paperFileUtil.get.html.ftl", "command-search.js", "wfh-seniormanager.get.js", "symplexUtils.js", "2024-03-11-log.txt", "uofaDepartmentName.get.desc.xml", "activities-email_fr.ftl", "native-studies-security-list.json", "following-email.html_ja.ftl", "pllcDocSetup.json", "everyDay7H45MinAM.js", "hrs-benefit-report.js", "uofa-chs-model.json", "alesCreateFolderRestricted.js", "FandO-Organizations.json", "siteFileViewer.get.js", "notify_user_email_de.html.ftl", "2024-03-04-log.txt", "archivedItems.js", "departmentAdhocTask.html.ftl", "2024-05-21-log.txt", "avmbrowse.get.desc.xml", "emailbody_textplain_alfresco_fr.ftl", "2024-04-17-log.txt", "chsAgreementCreateFolder.js", "fgsrCreateApsFromCSV.json", "addFolderMetadata.js", "law-doc-list.json", "uofaDepartmentName.get.html.ftl", "getTaskFilter.get.json.ftl", "uofa-law-model.xml", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "assignuser.put.desc.xml", "search-match-result.get.js", "foCreateFolderRule.js", "gettasks.get.desc.xml", "alesFolderCreateSchedule.js", "2024-03-24-log.txt", "roTagAndFileRenderedPDFs.js", "setTaskFilter.post.js", "advScriptKofax.js", "xmlUtil.js", "sciCreateFolderRestricted.js", "advChangeDocumentType_background.js", "hrsbsDocumentLinking.get.js", "https://www.virustotal.com/graph/embed/g8b17f086c8ca45188352d1d054fa3f8948f81bddd2114ea7b99864e585604e72?theme=dark", "tasklist.get.desc.xml", "calendar-year-model.json", "materials.get.desc.xml", "uofa-common-model.json", "2024-06-05-log.txt", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "uofa-uappol-model.xml", "blogsearch.get.js", "wf-email.html.ftl", "changeInitiatorAppt.put.json.ftl", "roSearchMatchNoMatchReport.js", "sfsCreateFolder.js", "uarm-rma-filing-model.xml", "2024-04-07-log.txt", "2024-05-17-log.txt", "lawDocSetup.json", "fo-site.json", "advErrorMessageReset.js", "wf-email.html_de.ftl", "siteMembersReport.js", "guidelines-supervisor-revision.get.desc.xml", "review-comm02v2.get.js", "artsConfig.json", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88", "2024-05-14-log.txt", "psPerson.get.js", "review-student-revisionv2.get.desc.xml", "2024-05-23-log.txt", "imapConfig.json", "hrsbs-review-cycle.json", "uofa-sfs-model.json", "ephesoft-educational.json", "extensionCreateFolderRule.js", "epsb.get.desc.xml", "uafgsrsup-model.xml", "cbsr-study.json", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "engineering-coop-security-list.json", "rsoDocSetup.json", "chsAdminStuView.get.html.ftl", "Institutions.json", "wf-email.html_ja.ftl", "uofa-sfs-model.xml", "uoda-faculties.json", "report_rmr_transferReport.html.ftl", "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark", "hrsbsCreateFolder.js", "APSWorkflowStatus.put.js", "customCSS_FGSR.css", "everyDay2H45MinAM.js", "pensionBenefit.html.ftl", "2024-02-12-log.txt", "consignoWebhook.post.json.ftl", "caps-school-board-list.json", "review-studentv2.get.desc.xml", "emailbody_textplain_share_de.ftl", "fgsr-thesis-deposit.json", "2024-01-26-log.txt", "chsFacultyReport.js", "review-supervisor.get.html.ftl", "rso-cfi-financials-doc-type.json", "emailbody_textplain_alfresco.ftl", "rma-model.json", "taskForm.get.js", "businessCreateFolderSchedule.js", "ADVEphesoftMove.js", "review-comm01v2.get.desc.xml", "review-comm02v2.get.desc.xml", "ro-slate-folio-material-school-scope.json", "kofaxFailedEmailTemplate.ftl", "uofa-set-model.xml", "collegeOfHealthSciencesConfig.json", "2024-04-28-log.txt", "fo-utilities.json", "fgsrCreateFolderFromCSV.js", "backup and log.js", "FVCA-manual-property-update.js", "following-email.html.ftl", "generatereport.get.js", "2024-03-05-log.txt", "https://contabo.com/client/client.a529db28.js", "new-user-email_de.html.ftl", "ADV-notify-type-mapping.json", "everyDay4H30MinAM.js", "PaperFileconfig.json", "everyDay7H30MinPM.js", "uofa-fo-model.json", "alfresco docs.js", "following-email_nl.html.ftl", "createSlateFolioMaterialDropdown.js", "convertTranscript.js", "appointmentStart.get.desc.xml", "createDepartmentJSON.js", "advEntityName.get.js", "dept-config.js", "uofa-arts-model.json", "taskReportCSV-Appointment-prod.js", "queryTasks.get.desc.xml", "avmbrowse.get.js", "chs-degProgram-list.json", "fgsr-credential-list.json", "record-rejected-email.ftl", "businessCreateFolderRule.js", "enggConfig.json", "categorysearch.get.atom.404.ftl", "review-cosupervisorv2.get.js", "schoolboard.get.js", "kofaxSendEmail.js", "2024-04-22-log.txt", "HRSBS-SyncCCIDs.js", "coupa.get.html.ftl", "queryTasks.get.js", "2024-03-26-log.txt", "uofa-ales-model.json", "hrs-personalInformation.json", "appointmentSubmit.get.js", "UAlbertaSettings.json", "uofa-rso-model.json", "alesCreateFolderSchedule.js", "everyDay1H45MinAM.js", "nativeStudiesCreateFolder.js", "sfsWorkflowStatus.js", "rsoCreateFolder.js", "gtaGraProcessToCSV-2AM.js", "enggCoopConfig.json", "eTranscriptVersioningFix.js", "appointmentSubmit.get.html.ftl", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "uofa-science-model.xml", "show_audit.ftl", "appointment-report-schedule.js", "fgsr-case-file-report.js", "student-records-bulk-load-testing-site.json", "2024-01-05-log.txt", "invite-email_es.html.ftl", "ist-site.json", "hrsFileShareFolder.js", "CreateTranscriptUserMemberships.js", "reappointment-reminder-process.js", "googleAddon.get.json.ftl", "notify_nl.htm", "capstart.get.desc.xml", "onCreate_supersedes.js", "new-user-email.html.ftl", "2024-05-07-log.txt", "cbsrsite-site.json", "review-cosupervisor.get.html.ftl", "eTranscript-bundled-02-jan.js", "2024-01-11-log.txt", "2024-01-23-log.txt", "2024-02-06-log.txt", "law-security-list.json", "pcm-site.json", "rso-forms-form-type.json", "advScanningMapping.json", "guidelines-student.get.desc.xml", "my_summary.ftl", "https://cdn.segment.com/next-integrations/integrations/google-analytics/2.18.5/google-analytics.dynamic.js.gz", "2024-04-23-log.txt", "chs-provinces-list.json", "emailbody_textplain_share_ja.ftl", "ro-admitType.json", "updatevariables.post.desc.xml.notused", "pcmCreateFolder.js", "2024-06-02-log.txt", "deleteEphesoftDoc.js", "review-comm01.get.desc.xml", "createSlateApplicationsCSV.js", "scheduleRunEvery60Minutes.js", "avmbrowse.get.html.ftl", "roslateexists.get.desc.xml", "review-supervisor.get.js", "ADV-notify-terms-types.js", "roCopyOlderScannedDocumentAdHoc.js", "coi-supervisor.get.desc.xml", "qaRelease.js", "2024-03-29-log.txt", "FandO-Programs.json", "westCanDocumentMove.js", "APSWorkflowStatus.get.js", "scheduleRunEveryday3PMto11PM.js", "save.post.desc.xml", "advScript5.js", "businessFileScanned.js", "every20MinStartingAt15MinPastHour.js", "2024-04-30-log.txt", "emailbody_textplain_share_fr.ftl", "wf-email.html_es.ftl", "sciFileScanned.js", "generatereport.get.json.ftl", "hrs-pension.json", "invite-email-add-direct.html_de.ftl", "emailbody-alfresco-textplain.ftl", "uofaDocTypes.xml", "APSWorkflowInfo.put.desc.xml", "cbsr-model.json", "b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6", "capinfo.get.html.ftl", "consignoMessage.get.desc.xml", "2024-02-23-log.txt", "readme_ja.html", "2024-05-18-log.txt", "roScript1.js", "folderCreateADV.js", "roDocumentListAPLSTD.js", "recent_docs.ftl", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127", "assignuser.put.js", "apptStepZeroStarter.post.desc.xml", "uoda-departments.json", "wf-email_fr.html.ftl", "nativeStudiesCreateFolderRule.js", "reappointment-generate-process.js", "fgsrDocRestructure.js", "sciBulkShareFolder.js", "jsonUtils.js", "CapFinalReportSubmit.js", "rso-accounts-receivable-accounts-payable-doc-type.json", "uofa-engg-coop-model.xml", "everyDay2H35MinAM.js", "ro-campusSolutionsTerm.json", "guidelines-student-revision.get.desc.xml", "emailbody_textplain_alfresco_ru.ftl", "2024-03-13-log.txt", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "rmFilingDoc.js", "chs-ag-type.json", "moveThesesForTransfer.js", "capinfo.get.js", "folder.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-studentTest.get.html.ftl", "review-supervisor.get.desc.xml", "uofa-native-studies-model.xml", "hrsConfig.json", "coi-revise.get.html.ftl", "2024-04-14-log.txt", "activities-email_ja.ftl", "simpleupload.post.desc.xml", "enggCoopFileScanned.js", "ro-slate-folio-material-non-school-scope.json", "NodeInfoByCapId.get.js", "getProjectDetails.js", "manual-tracking-script.js", "student-records-training-site.json", "following-email.html_nl.ftl", "scheduleJobTest.js", "Verification failure observed in automated verification handlers during sandbox replay.", "searchPageConfig.json", "student-recordsConfig.json", "rso-sponsor-names.json", "uofa-hrs-model.json", "2024-01-28-log.txt", "uofa-education-model.xml", "2024-01-13-log.txt", "appointmentSubmit.get.desc.xml", "ro-org-desc.json", "fgsr-thesis-deposit.xml", "activities-email_es.ftl", "review-nextdate.get.js", "tim-sops", "augustana-site.json", "extensionDocSetup.json", "review-startv2.get.html.ftl", "every52MinPastHour.js", "uofapersonid.get.html.ftl", "notify_user_email.html.ftl", "getSlateId.get.json.ftl", "folder-create-ro.js", "add_document_type_ro.js", "adv-correspondence-type.json", "educationCreateFolderRule.js", "2024-01-21-log.txt", "faculty-model.xml", "avmstores.get.desc.xml", "psPerson.get.json.ftl", "2024-01-10-log.txt", "security-group-model.json", "cbsr-worksheetType.json", "notify_user_email.ftl", "ro-official.json", "Script2.js", "eraReportGeneration.js", "hrsbs-security-class.json", "2024-05-25-log.txt", "uofaDepartmentList.get.html.ftl", "uofa-science-model.json", "hrsbsDocumentLinking.get.html.ftl", "https://www.clarity.ms/tag/uet/5739677", "emailbody-share-textplain.ftl", "uofapersonidrest.get.js", "edit.get.desc.xml", "ro-academic-pre-pro-programs.json", "review-student.get.js", "processIdProps.get.js", "completetask.post.json.ftl", "2024-05-03-log.txt", "faculty-model.json", "globalHeader.html.ftl", "rso-bulk-scan-doc-type.json", "2024-02-04-log.txt", "fgsrssgLanding.get.js", "emailbody_textplain_share_nl.ftl", "2024-03-16-log.txt", "ro-slate-institution-material.json", "getTaskFilter.get.js", "roslateexists.get.html.ftl", "move-fgsr-folder.js", "RORoutingWorkflowUtil.js", "ro-model.xml", "uafgsrsup-model.json", "emailbody_textplain_alfresco_zh_CN.ftl", "symplexMetadataUpdate.js", "uappol-api.js", "ua-search-model.json", "scheduleRunEveryday12AMto6AM.js", "copy-signed-offer-letter.js", "uofa-arts-model.xml", "https://snap.licdn.com/li.lms-analytics/insight.min.js", "psAcademicDeptAll.get.json.ftl", "roCopyOlderScannedDocument.js", "wfh-seniormanager.get.html.ftl", "2024-03-30-log.txt", "chs-faculty-list.json", "faculty-of-ales-site.json", "SetExpiryDate.js", "review-comm01v2.get.js", "translatable.ftl", "smartFoldersExample.json", "doc_info.ftl", "advChangeDocumentType_confidential.js", "updateVariable.post.desc.xml", "educationCreateAdvisingNotes.js", "advScript3.js", "report_rmr_holdReport.html.ftl", "adv-model.xml", "ro-search-match-status.json", "2024-02-13-log.txt", "rmThesis.js", "extension-security-list.json", "fgsrssgLanding.get.html.ftl", "2024-05-08-log.txt", "2024-04-04-log.txt", "ADVmoveRecordsToPreQA.js", "NodeInfo.get.html.ftl", "2024-02-10-log.txt", "securityWorkflowSetting.json", "rsoprojectdetails.get.desc.xml", "advext-model.json", "2024-03-18-log.txt", "review-comm02.get.js", "roEtranscriptReport.js", "APSWorkflowStatus.get.desc.xml", "wfh-form.get.js", "removeDonationGrp.js", "rso-agreements-doc-category.json", "blogsearch.get.desc.xml", "appointmentStart.get.html.ftl", "webFormDialog.html.ftl", "review-studentTest.get.js", "config.js", "hrsbs-functionalroles.json", "rmFilingConfig.json", "hrsbsCreateFolderRule.js", "roDailyQA.js", "calendar-year-model.xml", "readme_de.html", "facopr-supportinDocField.json", "guidelines-supervisor.get.desc.xml", "https://www.dwin1.com/13976.js", "review-cosupervisor.get.desc.xml", "chs-Invalid.ftl", "adv-model.json", "roslateapplist.get.js", "AFA_Main.post.desc.xml", "every46MinPastHourBetween4PM12PM.js", "advScript4.js", "apptStepOneSave.post.json.ftl", "roEtranscriptsBundle.js", "pllc-site.json", "advSimplexMapping.json", "uappolCategoryHeirarchy.get.desc.xml", "applyTaskAction.post.json.ftl", "2024-05-09-log.txt", "fgsrCreateGuidelineAPSProcessFromCSV.js", "readme.ftl", "2024-04-12-log.txt", "example test script.js", "guidelines-supervisor.get.html.ftl", "APSWorkflowStatus.put.desc.xml", "uarmTempModel.json", "FVCA-data-import.js", "facopr-model.json", "edit.get.js", "2024-04-01-log.txt", "faculty-of-native-studies-site.json", "hrsbs-file-structure.json", "uappol-upload-rule.js", "hrsbsReviewCycleReport.js", "chsAgreementsConfig.json", "academic-department.json", "command-utils.js", "APSWorkflowStatus.get.html.ftl", "uploadfile.post.desc.xml", "RONotification.js", "2023-12-30-log.txt", "chs-programYear-list.json", "alesCreateAdvisingNotes.js", "capeamergedoc.get.js", "eTranscriptInstList.js", "avmstores.get.html.ftl", "following-email_ja.html.ftl", "businessCreateFolderRestricted.js", "my_docs.ftl", "uappol-metadata-query.get.desc.xml", "collegeOfHealthSciencesDocSetup.json", "engineering-co-op-site.json", "reappointment-generate-schedule.js", "uofapersonidrest.get.html.ftl", "advMetadataUpdate.js", "ro-model.json", "2024-06-01-log.txt", "2024-01-07-log.txt", "2024-04-05-log.txt", "rma_isClosed.js", "uofa-business-model.xml", "cap-site.json", "chs-studentExpireSoon.ftl", "hrsbs-site.json", "uofa-esign-model.json", "uofa-caps-model.xml", "thesisDepositArchival.js", "coi-revise.get.js", "advChangeDocumentName.js", "emailbody_textplain_share_nb.ftl", "review-comm03v2.get.js", "uofa-extension-model.json", "NodeInfoByCapId.get.desc.xml", "2024-05-24-log.txt", "UAlbertaSettings.conf", "augustana-legacy-transcript-doc-list.json", "uofa-pllc-model.xml", "2024-02-05-log.txt", "rsoprojectdetails.get.js", "roCopyEphesoftMetadataXML.js", "triggerapsprocess.post.json.ftl", "faculty-of-extension-site.json", "every30MinStartingAt26MinPastHour.js", "sciCreateFolderConfidential.js", "assocModel.json", "educationCreateFolder.js", "student-financial-services-site.json", "routableGroups.get.desc.xml", "invite-email-add-direct.html_fr.ftl", "advScanning.js", "2024-04-26-log.txt", "invite-email_nl.html.ftl", "getSlateId.get.js", "foModel.xml", "lawCreateFolder.js", "eSignatureStatusHistory.get.js", "categorysearch.get.js", "https://contabo.com/client/client-30e55c50.css", "materials.get.json.ftl", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "hrsbs-doc-list.json", "2024-04-25-log.txt", "manual-generate-script.js", "updatevariables.post.json.ftl.notused", "AFA_MainFileOnly.post.json.ftl", "2024-06-04-log.txt", "localizable.ftl", "simpleupload.post.js", "wfh-form.get.desc.xml", "sfs-wf-email.html.ftl", "https://cdn.heapanalytics.com/js/heap-3501642718.js", "educationDocSetup.json", "generatereport.get.desc.xml", "chs-agreements.get.js", "2024-02-18-log.txt", "applyTaskAction.post.desc.xml", "2024-01-16-log.txt", "psDeptAll.get.js", "uarmTempModel.xml", "review-startv2.get.js", "scheduleRunEvery2-10PM.js", "tasklist.get.html.ftl", "emailbody_textplain_share_it.ftl", "record-superseded-email.ftl", "business-doc-list.json", "fgsr-programOfStudy.json", "https://www.hotjar.com/persistUtmParams.js", "staff-training-site.json", "acsToApsUserUpdate.js", "changeInitiatorAppt.put.js", "2024-03-01-log.txt", "https://www.hotjar.com/ensureSegmentId.js", "2023-12-29-log.txt", "uofa-uappol-model.json", "hrsDocSetup.json", "fgsrCreateAPSProcessFromFolder.js", "eTranscriptConfig.json", "2024-01-09-log.txt", "transcript-model.json", "uofaFacultyList.get.desc.xml", "fgsrssgLanding.get.desc.xml", "chs-upload.get.html.ftl", "psPerson.get.desc.xml", "reminder-email-util.js", "archiveFolder.json", "search.get.desc.xml", "activities-email_it.ftl", "rsoprojectdetails.get.html.ftl", "fgsrEnv.js", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "2024-03-19-log.txt", "tasklist.get.html.ftl.jquery", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "2024-04-11-log.txt", "artsCreateFolder.js", "2024-05-31-log.txt", "uofa-education-model.json", "ADVChangeAuthor.js", "roslateapplist.get.json.ftl", "updateSearchMatchStatus.js", "chsStudentView.get.js", "PaperFileUtils.js", "hrsbs-employee-class.json", "wfh-manager.get.desc.xml", "hrsbs-action-reasons.json", "advScanningMetadata.js", "LaunchWorkflowUtils.js", "following-email.html_it.ftl", "uofa-esign-model.xml", "chsEnv.js", "FGSR-Forms-Config.js", "deletingCompletingWorkflow.js", "dropboxCommonAspects.json", "CapApsConfig.json", "routableGroups.get.json.ftl", "emailbody_textplain_alfresco_it.ftl", "2024-02-19-log.txt", "reappointment-tracking-process.js", "capinfo.get.desc.xml", "enggCoopCreateFolder.js", "googleAddon.get.js", "getapsdbid.get.js", "https://www.hotjar.com/_next/static/chunks/framework-6994461647f52f294af9.js", "roCopyEphesoftMetadataScanned.js", "arts-doc-list.json", "pcm-grab-competitive-noderefs.js", "eSignDownload.get.js", "native-studies-doc-list.json", "educationConfig.json", "backup.js", "roDocumentTypes.json", "ro-related-record-types.json", "uappol-type.json", "invite-email-add-direct.html_ja.ftl", "ceeb.get.desc.xml", "2024-03-31-log.txt", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "following-email.html_fr.ftl", "psDeptAll.get.desc.xml", "rso-financial-reporting-doc-type.json", "uofa-pllc-model.json", "notify_user_email_fr.html.ftl", "OOA-notify-email-template.ftl", "advBatchProcessing.js", "invite-email-add-direct.html_nl.ftl", "roSearchMatchQuery.js", "cbsrsite-sopTypes.json", "securityWorkflowUtil.js", "engineering-security-list.json", "savetask.post.desc.xml", "luceneUtil.js", "claimtask.put.js", "APSWorkflowInfo.put.html.ftl", "uofa-base-model.json", "review-cosupervisorv2.get.html.ftl", "uofapersonidrest.get.desc.xml", "2024-05-12-log.txt", "change-fgsr-pdf-file-name-with-date.js", "nativeStudiesCreateFolderRestricted.js", "coveoGetDocList.get.js", "2024-02-29-log.txt", "advEndowmentName.get.json.ftl", "2024-04-27-log.txt", "updateVariable.post.json.ftl", "alesBulkShareFolder.js", "extensionFileScanned.js", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "rso-mask.json", "2024-02-09-log.txt", "blogsearch.get.html.ftl", "2024-05-15-log.txt", "capeamergedoc.get.html.ftl", "hrs-employmentFinancial.json", "getapsdbid.get.json.ftl", "new-user-email_ja.html.ftl", "coi-supervisor.get.html.ftl", "nativeStudiesDocSetup.json", "ua-search-model.xml", "rso-site.json", "categorysearch.get.html.404.ftl", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "uappol-metadata-query.get.js", "coi-start.get.js", "psAudit-model.json", "everyDay12H30MinAM.js", "setTaskFilter.post.json.ftl", "alesDaily.js", "claimtask.put.json.ftl", "emailbody_textplain_share_ru.ftl", "2024-05-22-log.txt", "2024-04-18-log.txt", "apptStepOneSave.post.desc.xml", "test-site-site.json", "addPersonAspect.js", "chsReport.js", "fgsrv2Config.json", "2024-04-10-log.txt", "gtaGraStatus.post.json.ftl", "2024-03-06-log.txt", "apsGroupsConfig.json", "invite-email.ftl", "2024-04-21-log.txt", "ro-doctypes.json", "hrsbsDocSetup.json", "appointmentStartTest.get.js", "uofaFacultyList.get.html.ftl", "roAddAspectAndMoveTranscript.js", "review-student-revisionv2.get.html.ftl", "pcm-category.json", "emailbody_textplain_alfresco_nl.ftl", "uploadfile.post.js", "emailbody_textplain_share_pt_BR.ftl", "consignoWebhook.post.desc.xml", "getJson.get.desc.xml", "cronJob.post.desc.xml", "2024-01-20-log.txt", "enggCreateFolderRestricted.js", "hrs-security-list.json", "studentupload.get.html.ftl", "hrsDaily.js", "2024-04-06-log.txt", "scheduleRunEvery20Minutes.js", "2024-04-09-log.txt", "2024-02-11-log.txt", "psAuthorizedApprover.get.js", "alesDocSetup.json", "psDeptSingle.get.desc.xml", "edit.get.html.ftl", "extensionCreateFolder.js", "ro-aug-model.json", "createReportPermissionsFoldersInASite.js", "applyTaskAction.post.js", "AFAconfig.json", "roAddComment.js", "roScript1BackScan.js", "my_spaces.ftl", "faculty-of-law-site.json", "2024-01-19-log.txt", "apsAppConfig.json", "pcm-update-competitive-noderefs.js", "hrsbs-owner-details.json", "notify-records-due-for-review-email.ftl", "emailbody_textplain_alfresco_nb.ftl", "review-student-revision.get.desc.xml", "apptStepZeroStarter.post.json.ftl", "changeInitiatorAppt.put.desc.xml", "uofa-slate-model.json", "2024-02-03-log.txt", "engineering-coop-doc-list.json", "department.json", "faculty-of-education-site.json", "ADVDonationCalendarToFiscal.js", "artsFileScanned.js", "2024-05-05-log.txt", "searchmatchFullDob.js", "consignOInitiatorOfferLetterChange.js", "2024-01-22-log.txt", "NodeInfo.get.js", "uofaDocTypes.json", "materials.get.js", "peoplesoftMetadataMergeMissing.js", "faculty-model.xml.json", "roScript9.js", "invite-email-add-direct.html_it.ftl", "publicSiteFileViewer.get.desc.xml", "fgsrMigrationScript-withTerminationLogic.js", "2024-04-13-log.txt", "rso-cfi-purchasing-doc-type.json", "augCreateFolder.js", "triggerapsprocess.post.js", "hrsFolderCreateSchedule.js", "artsCreateFolderRule.js", "chs-program-list.json", "businessBulkShareFolder.js", "advUtils.js", "wf-email_de.html.ftl", "sponsornames.json", "2024-04-03-log.txt", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "2024-03-07-log.txt", "thesisDestructionReport.js", "updateVariable.post.js", "notify_user_email_e-transcript_failed.ftl", "augTranscript.js", "hrsbsDocumentLinking.get.desc.xml", "capstart.get.js", "FVCA.json", "guidelines-supervisor.get.js", "chs-commentUpdate.ftl", "enggCreateFolder.js", "psDeptAll.get.json.ftl", "2024-02-15-log.txt", "chsAgreementsDocSetup.json", "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "activities-email_de.ftl", "queryTasks.get.json.ftl", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "psAcademicDeptAll.get.desc.xml", "2024-01-27-log.txt", "wf-email_it.html.ftl", "uappolCreateFolderRule.js", "2024-04-19-log.txt", "uofa-engg-model.xml", "psUtil.js", "eSignDownload.get.html.ftl", "review-comm01.get.html.ftl", "AlfrescoToolkit.info", "invite-email_ja.html.ftl", "FVCA.xml", "alesCreateFolderConfidential.js", "new-user-email_es.html.ftl", "fgsr-model.json", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "rmSearchmatchNomatchFiling.js", "startPayActionWorkflow.js", "payActionDecision.html.ftl", "chs-agreements.get.html.ftl", "2024-04-29-log.txt", "foCreateFolder.js", "processIdProps.get.json.ftl", "foModel.json", "2024-01-30-log.txt", "schoolboard.get.html.ftl", "2024-04-20-log.txt", "fgsrDocRelocation.js", "advScriptDaily30minFreq.js", "rsoConfig.json", "qaConfig.json", "uarmm-supplement-scanning.json", "every10MinStartingAt5MinPastHour.js", "chsCreateFolder.js", "uofaDepartmentName.get.js", "2024-03-17-log.txt", "setTaskFilter.post.desc.xml", "appointmentLandingPage.get.html.ftl", "review-cosupervisorv2.get.desc.xml", "chsAgreementCreateFolderRule.js", "review-student-revisionv2.get.js", "alfrescoUserGroupRequest.ftl", "advScriptMonthly.js", "roConfig.json", "2024-02-25-log.txt", "NodeInfo.get.desc.xml", "copy-fgsr-to-graduate-students-records.js", "AFA_Main.post.js", "review-student.get.desc.xml", "save.post.json.ftl", "epsb.get.js", "my_docs_inline.ftl", "uofa-augustana-model.xml", "alesFileScanned.js", "advDocSetup.json", "chs-stuEmailNotification.json", "2024-01-25-log.txt", "thesisDepositConfig.json", "ro-acad-group.json", "uappol-site.json", "sciConfig.json", "extensionConfig.json", "everyDay2H05MinAM.js", "roDocProcessing-model.xml", "psAuthorizedApprover.get.json.ftl", "processIdProps.get.desc.xml", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "scheduleRunEvery30Minutes.js", "https://cdn.segment.com/next-integrations/integrations/vendor/commons.54701049fd6fb8497e9e.js.gz", "2024-05-30-log.txt", "2024-01-31-log.txt", "uofa-augustana-model.json", "guidelines-start.get.html.ftl", "apptStepOneStarter.post.js", "augustana-security-list.json", "coveoGetDocList.get.json.ftl", "reappointment-tracking-schedule.js", "roBatchScript.js", "generic2min.js", "advScript2.js", "command-processor.js", "review-student-revision.get.js", "cronJob.post.js", "invite-email-add-direct.html.ftl", "enggDocSetup.json", "OOA-notify-email.js", "apptStatusDocUpdate.post.json.ftl", "2024-05-10-log.txt", "2024-01-15-log.txt", "office-of-advancement-site.json", "FandO", "fgsr-awards.json", "notify_user_email_ja.html.ftl", "2024-03-23-log.txt", "review-cosupervisor.get.js", "CAPSendMonthlyReportEmail.js", "student-records-site.json", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "hrs-leaves.json", "cap-file-load.post.js", "uofa-hrs-model.xml", "2024-05-13-log.txt", "gtaGraStatus.post.js", "fgsrCreateFolder.js", "2024-02-17-log.txt", "business-security-list.json", "uofa-law-model.json", "fgsr-official-list.json", "hrsFolderCreateRule.js", "dynamicSecurityMarksModel", "apptStepZeroStarter.post.js", "foDocSetup.json", "ro-slate-institutions.json", "startTwoStepWorkflow.js", "activities-email_nl.ftl", "ro-applicant-type.json", "fgsrCopyMetadataToFolderLevel.js", "createROReconciliationReports.js", "2024-04-08-log.txt", "search.get.html.ftl", "emailbody_textplain_share.ftl", "pllcConfig.json", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "wf-email.html_fr.ftl", "2024-03-27-log.txt", "scans.get.desc.xml", "lawConfig.json", "review-studentv2.get.html.ftl", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "paperFileUtil.get.js", "roslateapplist.get.html.ftl", "https://unpkg.com/@optimizely/optimizely-sdk@3.5.0/dist/optimizely.browser.umd.min.js", "every22MinPastHour.js", "2024-03-12-log.txt", "extension-doc-list.json", "uofaDepartmentList.get.desc.xml", "googleAddon.get.desc.xml", "2024-05-04-log.txt", "programExtensionScript.js", "pcmDocSetup.json", "invite-email-add-direct.html_es.ftl", "completetask.post.js", "appointmentStartTest.get.desc.xml", "2024-02-28-log.txt", "every30MinStartingAt19MinPastHour.js", "2024-04-24-log.txt", "wfh-revise.get.html.ftl", "folder.get.js", "MyTasks-config.json", "wf-email_ja.html.ftl", "env.js", "roScript4.js", "fgsr-category-list.json", "uploadfile.post.json.ftl", "artsDocSetup.json", "2024-02-26-log.txt", "2024-05-26-log.txt", "ro-authenticity.json", "coupa.get.desc.xml", "https://fast.appcues.com/79878.js", "businessCreateAdvisingNotes.js", "uawfh-model.json", "alesCreateFolder.js", "rso-financial-reconciliation-doc-type.json", "rm_event_config.json", "enggCoopCreateFolderRestricted.js", "uofa-business-model.json", "recordsCustomModel.xml", "uappol-metadata-query.get.json.ftl", "hrs-benefits.json", "addTimeStamp.js", "new-user-email_nl.html", "coupa.get.js", "science-doc-list.json", "publicSiteFileViewer.get.html.ftl", "advext-model.xml", "2024-01-04-log.txt", "alesConfig.json", "sfsDocSetup.json", "gtaGraProcessToCSV.js", "assignuser.put.json.ftl", "2024-01-18-log.txt", "addTimeStampRandomFileName.js", "roMoveCompletedSearchMatch.js", "cbsr-model.xml", "2024-05-28-log.txt", "advMoveToFoldersScheduled.js", "2024-05-20-log.txt", "artsCreateFolderRestricted.js", "apsSitesConfig.json", "support-documentation", "2024-05-01-log.txt", "https://www.googletagmanager.com/gtag/js?id=G-YFPNZBGTF3&l=dataLayer&cx=c", "sciFileShareFolder.js", "new-user-email_nl.html.ftl", "my-site-site.json", "uatraining.xml", "sciFileADDPFileTypes.js", "every30MinStartingAt11MinPastHour.js", "student-financial-services-doc-list.json", "notify_user_email_es.html.ftl", "uofa-base-model.xml", "guidelines-student-revision.get.js", "approvethesis.post.js", "2024-05-27-log.txt", "uaqa-model.xml", "fgsrCopyMetadata.json", "graduate-student-records-v2-site.json", "invite-email-moderated.html.ftl", "wf-email_nl.html.ftl", "bulkload-testing-site.json", "support-documentation-site.json", "https://www.hotjar.com/_next/static/chunks/pages/_app-be5fbad980fd377922f7.js", "review-comm03.get.html.ftl", "advReconcilliation.js", "uofa-chs-model.xml", "2024-03-09-log.txt", "pllc-doc-list.json", "ro-search-match.xml", "uappolCategoryHeirarchy.get.js", "gettasks.get.js", "uofa-hrsbs-model.xml", "https://www.hotjar.com/_next/static/chunks/pages/index-b7f010d5161cd8f6ddab.js", "startDepartmentAdhocApprovalWorkflow.js", "advEntityName.get.desc.xml", "chsEmailOnUpdateComment.js", "scheduleRunEvery5PMTo10PM.js", "coveoGetDocList.get.desc.xml", "siteFileViewer.get.desc.xml", "scienceASDocumentImport.js", "transcriptResponse.js", "capstart.get.html.ftl", "ro-indigenous-type.json", "blogsearch.get.html.400.ftl", "everyDay11H30MinPM.js", "security-group-user.js", "2024-05-02-log.txt", "guidelines-start.get.js", "guidelines-student.get.js", "emailbody_textplain_share_zh_CN.ftl", "eSignatureStatusHistory.get.html.ftl", "ceeb.get.json.ftl", "taskUtils.js", "every29MinPastHour.js", "https://cdn.segment.com/next-integrations/integrations/appcues/2.3.0/appcues.dynamic.js.gz", "coi-supervisor.get.js", "wfh-manager.get.html.ftl", "advChangeDocumentType.js", "uappolCreateFolder.js", "2024-05-29-log.txt", "coi-revise.get.desc.xml", "scheduleRunEvery2AM.js", "moveToFolders.js", "sfs-wf-completed-email.html.ftl", "invite-email.html_nl.ftl", "psUpdateAlfrescoDepartment.js", "getJson.get.json.ftl", "customCSS_FGSR2.css", "engineeringCreateAdvisingNotes.js", "student-transcripts-site.json", "util.js", "ADVSiteContext.js", "archiveDocument.js", "categorysearch.get.desc.xml", "coi-start.get.html.ftl", "apptStepOneStarter.post.desc.xml", "wfh-revise.get.js", "sciDocSetup.json", "roDocSetup.json", "advsearch.json", "apsApplicationList.get.html.ftl", "ua-dummy.xml", "ua-error-model.json", "append copyright.js", "getJson.get.js", "capConfig.js", "2024-03-28-log.txt", "every57MinPastHour.js", "advConfig.json", "invite-email_it.html.ftl", "kofaxMetadataMerge.js", "paperFileUtil.get.desc.xml", "appointmentStartTest.get.html.ftl", "review-studentTest.get.desc.xml", "OOA_SOT_Name_change.js", "consignoMessage.get.json.ftl", "education-doc-list.json", "businessFileShareFolder.js", "uappolConfig.json", "folder.get.html.ftl", "wfh-revise.get.desc.xml", "chs-campus-list.json", "coi-employee.get.html.ftl", "college-of-health-sciences-site.json", "document-query.js", "blogsearch.get.atom.400.ftl", "advEndowmentName.get.desc.xml", "search.get.js", "startBenefitWorkflow.js", "GenerateSponsornamesAndPinames.js", "ADVcalendarToFiscal.js", "save.post.js", "eSignatureStatusHistory.get.desc.xml", "search-responses.js", "emailbody_textplain_alfresco_pt_BR.ftl", "pinames.json", "chsStudentView.get.html.ftl", "office-of-advancement-record-types.json", "2024-01-06-log.txt", "2024-02-24-log.txt", "cronJob.post.json.ftl", "https://fast.appcues.com/generic/main/4.35.3/appcues.main.e826b3c1f5ab15648ac446eafdbb489fd58d7f2d.js", "simpleupload.post.json.ftl", "advMoveToFolder.js", "search-match-attach.get.js", "pcmConfig.json", "2024-03-10-log.txt", "2024-04-16-log.txt" ], "related": { "alienvault": { "adversary": [], "malware_families": [], "industries": [] }, "other": { "adversary": [ "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems" ], "malware_families": [ "Reduceright" ], "industries": [ "Education", "Government", "Technology", "Telecommunications", "Healthcare", "Legal, financial, healthcare, government, municipal, real-estate, enterprise-technology, critical-in" ] } } }, "false_positive": [] }, "geo": {}, "geo_ipapicom": {}, "pulse_count": 11, "pulses": [ { "id": "6a135614ee83fa05ff58af66", "name": "Validated: Cybercrime - #Alberta Compromise", "description": "Validated: Cybercrime - UofA BEC/ATO -> UAlberta Alfresco & Edmonton Police Compromise (HR Files) & TX - 05.24.26 - edit", "modified": "2026-05-24T19:48:36.416000", "created": "2026-05-24T19:48:36.416000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Technology", "Healthcare", "Government", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 0, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 60, "FileHash-SHA1": 59, "FileHash-SHA256": 1097, "IPv4": 397, "domain": 341, "hostname": 407 }, "indicator_count": 2561, "is_author": false, "is_subscribing": null, "subscriber_count": 18, "modified_text": "7 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a10a079d3a0831710f3a0ab", "name": "Catastrophic DataBreach confirmed - UAlberta & Edmonton Police Services - 05.22.26", "description": "BEC/ATO (reported) and unauthorized use & abuse of Stolen Identity/Access/Credentials from the University of Alberta has been demonstrated as the cause of catastrophic Data-Breaches across the ualberta[.]ca domain and Edmonton Police Services (EPS).\nData is comprehensive, includes HR Records, PII/PHI, employment data, addresses, contact information.", "modified": "2026-05-22T18:29:13.092000", "created": "2026-05-22T18:29:13.092000", "tags": [], "references": [ "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology" ], "TLP": "white", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 2, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 200, "FileHash-MD5": 61, "FileHash-SHA1": 60, "FileHash-SHA256": 1032, "IPv4": 393, "domain": 340, "hostname": 387 }, "indicator_count": 2473, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "9 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a0bff94564a0098e02ab37d", "name": "Alfresco Archive // b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6 - 05.19.26", "description": "The full list of Edmonton police officers, officers and staff, as part of the city's Police Complaints Commission (PCC), has been released.", "modified": "2026-05-19T06:16:59.932000", "created": "2026-05-19T06:13:40.134000", "tags": [ "UAlberta", "Edmonton", "Edmontonpolice", "EPS", "YEG" ], "references": [ "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127", "https://www.virustotal.com/gui/collection/3f5e2fc684dd1957828c6f9c0d1b7d13524218c8402a4a0a91e9135fb662f127/iocs", "https://www.virustotal.com/graph/embed/g3238715200b747f1a237e03037a4d5ff15d85564ee0740439750d8ff75347031?theme=dark", "b257cc536324cd2566432555666307b43d27ee9cbda5e45707e3e97b61b3dff6" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "UCP_GoA23", "id": "382539", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_382539/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-MD5": 58, "FileHash-SHA1": 57, "FileHash-SHA256": 952, "IPv4": 393, "URL": 200, "domain": 340, "hostname": 367 }, "indicator_count": 2367, "is_author": false, "is_subscribing": null, "subscriber_count": 19, "modified_text": "12 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "698e93e1ab02db8c49e8c3ed", "name": "\u201cBroken Seal\u201d DocuSign-themed Delivery with Fileless Process Hollowing (Zeppelin/Bloat-A)", "description": "Forensic analysis indicates a DocuSign-themed phishing campaign using a deliberately invalid X.509 PKI seal (\u201cBroken Seal\u201d) to trigger fail-open verification logic in automated handlers. The delivery mechanism bypasses Secure Email Gateway (SEG) reputation checks by using encrypted channels and human-gated infrastructure. The payload is a fileless Process Hollowing (RunPE) malware that injects into RWX memory of legitimate processes to evade disk-based EDR.", "modified": "2026-05-17T15:52:35.396000", "created": "2026-02-13T03:00:49.872000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr", "My Independent research finds an intersect between different pdf DV versions being able to connect to Raspberry Pi devices as it was the FCC application document. Risk: Mac ID connectivity to all." ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": null, "export_count": 14, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 28000, "FileHash-SHA256": 48374, "FileHash-MD5": 42596, "FileHash-SHA1": 23243, "hostname": 35654, "URL": 75758, "SSLCertFingerprint": 30, "CVE": 7585, "email": 316, "FileHash-IMPHASH": 8, "CIDR": 26205, "JA3": 1, "URI": 5, "IPv4": 574, "Mutex": 1 }, "indicator_count": 288350, "is_author": false, "is_subscribing": null, "subscriber_count": 92, "modified_text": "14 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6a09b3b462c09a8bf0daa85b", "name": "Credit: Disable_Duck [\"UAlberta alfresco management\"]", "description": "", "modified": "2026-05-17T12:25:24.282000", "created": "2026-05-17T12:25:24.282000", "tags": [ "note", "home", "lucene paths", "json descriptor", "lucene path", "company home", "actividades", "pageuser", "sie knnen", "sie auf", "link klicken", "recente", "u kunt", "attivit", "possibile", "activits", "vous", "report", "web link", "cvs report", "link", "chs placement", "chs student", "placement", "team", "google form", "university", "alberta", "automation", "please", "following", "followers", "ihnen", "mitarbeitern", "mitarbeiter", "hello", "foreign visitor", "fvca", "human resource", "fvca assessment", "incomplete", "regards", "klik", "wachtwoord", "mijn profiel", "klik op", "hoogachtend", "alfresco", "bonjour", "cliquez sur", "nous", "pour ce", "mon profil", "changer", "invito", "caro", "fare", "password", "il mio", "cambia password", "per rifiutare", "cordiali saluti", "my profile", "change password", "konto", "sie erstellt", "passwort", "wir legen", "ihnen nahe", "passwort bei", "anmeldung zu", "ndern", "gehen sie", "mmm yyyy", "nome utente", "nombre", "contrasea", "para hacerlo", "mi perfil", "atentamente", "account", "alfresco share", "hola", "haga", "los datos", "y seleccione", "si desea", "click", "einladung von", "hallo", "sie eingeladen", "site", "klicken sie", "konto fr", "alfresco client", "kofax index", "inhaltselement", "zur site", "gren alfresco", "pledged gift", "office", "advancement", "datetime", "university vpn", "date", "shared", "support", "auxiliary", "process", "priority", "medium high", "pay action", "sincerely", "uofa ecm", "link um", "aufgaben stehen", "verfgung", "prioritt", "niedrig mittel", "hoch", "klicken", "aufgabe zu", "il seguente", "disponibile", "priorit", "bassa media", "alta", "clicca", "clicca su", "la tche", "tre rcupre", "basse moyenne", "leve", "cliquez", "cordialement", "prioriteit", "laag gemiddeld", "hoog", "la siguiente", "prioridad", "media alta", "saludos", "kb content", "links content", "content url", "download url", "webdav url", "ttulo", "descripcin", "ninguno", "ninguna", "creador", "creado", "modificador", "modificado", "tamao", "webdav", "titre", "aucun", "aucune", "modificateur", "modifi", "taille", "ko liens", "du contenu", "dossier du", "url webdav", "titolo", "nessuno", "nessuna", "creato", "modificato", "dimensioni", "kb link", "al contenuto", "cartella", "ingen", "beskrivelse", "tittel", "opprettet", "modifikator", "modifisert", "strrelse", "lenker for", "innhold mappe", "descrio", "nome", "nenhum", "nenhuma", "criador", "criado", "tamanho", "geen", "beschrijving", "titel", "maker", "gemaakt", "gewijzigd", "grootte", "contenturl", "downloadurl", "beschreibung", "url zum", "keiner", "keine", "ersteller", "erstellt", "bearbeiter", "gendert", "kb links", "download", "navigatebrowse", "pagesite", "readme file", "yesno", "user name", "main", "function", "log debug", "record", "sample rm", "import", "njson", "forms", "sites", "documenttype", "commonfolder", "error", "value", "jsonfile", "service", "false", "moving", "prop", "null", "bearer", "uappol", "uappol function", "contentid", "param", "id var", "call", "post request", "json", "config", "coveo", "uappol metadata", "content id", "and not", "loads", "update", "uploader", "inbox", "rnrn", "create", "contenteml", "inbox folder", "number", "normal", "textpart", "backup", "createchildren", "backupname", "childlist", "name", "content", "array", "write", "childname2", "childname3", "childname4", "reviewgroup", "groupsite", "starting", "started", "delete email", "command", "found", "create content", "resources", "unknown command", "globals", "var title", "rnrncopyright", "copyright", "csvtoarray", "regexp", "jsonstr", "daily", "review", "az09", "format", "hrsfilescanner", "hrs document", "fromscanner", "not type", "matches1", "employee id", "third", "tempfilename", "ldap", "version", "this", "file share", "folder", "trimlr", "namearr", "personid", "document name", "ales file", "scanned", "shared drive", "last", "document type", "document", "advising notes", "debug", "debugstr", "schedule", "descriptorpath", "web service", "inbound rule", "web services", "collaborator", "groupeveryone", "check", "index", "taskassignee", "taskenddate", "filename", "localisotime", "startdatetime", "timeperiod", "uofa edrms", "author", "descommonnode", "nomatch", "iddocumenttype", "siteid", "span", "path", "term", "core", "cap report", "template", "object", "cap mail", "dev testing", "application", "aps status", "cap generate", "monthly report", "extension", "alfresco locale", "september", "pm mdt", "school", "didx", "json response", "cap final", "rebcapiddict", "finalcapiddict", "aps process", "trigger", "chsdocument", "message", "func", "msgstr", "emailobj", "emailtemplate", "emailsubject", "sitepath", "chs docs", "studentfiles", "faculty", "true", "chssiteid", "type", "aspect", "chsdocs", "nodeidx", "find", "expired", "chs school", "defunc", "facultykey", "program", "spasite", "ldapperson", "parent name", "securitytype", "formsengg", "limit", "enggfilescanner", "stuccid", "csv file", "studdept", "supccid", "supdept", "cosupccid", "relocation", "fgsr", "records site", "fgsr doc", "department", "start fgsr", "department doc", "completion of", "oral hlth", "form", "application for", "report of", "admission", "master", "music", "unknown", "comp", "class", "leave", "supervisor", "currentline", "return", "studentid", "superccid", "revdate", "code", "apstaskproperty", "converttocsv", "aps guideline", "aps task", "newdata", "hyperlink", "certificate", "first", "info", "procid", "filecontentstr", "query sort", "create header", "person id", "subject title", "node", "studentccid", "yyyymmdd", "lookupjson", "propidx", "input date", "iso format", "folder level", "query", "duedate", "test java", "dailyschedule", "upload", "ro adm", "workflow", "offset", "adm workflow", "data length", "startindex", "json object", "aps group", "acs site", "user", "getgroupid", "am mst", "acsaps group", "user sync", "january", "start january", "february", "start february", "december", "start december", "march", "start march", "am mdt", "consumer march", "aps student", "april", "start april", "june", "start june", "pm mst", "ro backscan", "edrmsteam", "group", "group december", "aps ro", "copy file", "aps api", "maxfile", "creator", "rand", "hrsbs", "july", "august", "hrsbssyncccids", "zhrroleuserresp", "edrms", "ccids", "prefix", "createdirectory", "directory", "actionreason", "safefilename", "employeeclass", "carry", "csv data", "host", "bachelor", "college level", "mike", "propname", "maxitems", "currjson", "fvca status", "important", "prod", "manual data", "doctoratephd", "medicine", "nodename", "employeeccid", "managerccid", "employeeid", "workingtitle", "regtempdescr", "findkey", "email", "new document", "doctypelabel", "competitive bid", "bid exception", "pcm competitive", "and aspect", "competitive", "nodes", "bid update", "acommonfolder", "formspcm", "peoplesoft", "no data", "qaselectednode", "qaselected", "qanotselected", "qa folder", "preqa", "qa var", "documentcount", "passcount", "qadocument", "qa selected", "moved", "attempts", "accepted", "rm file", "plan", "rm filing", "min to", "rm system", "batch", "time limit", "rmcfg", "string", "already", "load", "valid", "graddate", "uathdep", "ccid", "title", "abstract", "embargo", "datestr", "searchresult", "alfresco afa", "admissions", "student case", "files", "and type", "institution", "inst", "json config", "institution not", "if file", "logger", "needle", "xmlstr", "staus", "document linkn", "getlogfile", "documentlist", "xml field", "not found", "addaspect", "move aspect", "duplicate file", "makes", "to max", "checks", "workflow name", "workflow link", "emplid", "due daten", "total afa", "not path", "afabundling", "change", "not aspect", "logs", "ephesoft", "document moved", "epehsoft", "xmlsourcenode", "batchsize", "filemappingpdf", "entry", "move file", "getcsvfile", "batchprocess", "logging", "completed", "document link", "groupn", "created date", "stdapl", "person", "workflow desc", "json file", "list", "lastmonth", "daily qa", "default", "qastartdate", "query language", "finished", "afa bundle", "transcriptarr", "lucene query", "qacounter", "rrfgroupname", "uaroemplid", "uaropriority", "uaroduedate", "documentlistarr", "uarmm", "profile", "courseauditform", "status", "jile", "searchmatchmove", "logfoldername", "backscanreview", "smfstr", "rosm", "converter", "shortxml", "failedcsvfolder", "xml file", "qaoperatorindex", "qaoperatorlabel", "script", "suresh", "aws promotion", "file", "tasks", "bundlingprop", "tasktype", "grps2", "uarotasktype", "comments", "test", "ro scripts", "xmlnode", "shortdescr", "xmlcont", "firstname", "orgid", "middlename", "lastname", "middle", "final", "script started", "to now", "received date", "first name", "receiveddatestr", "dateofbirthstr", "getdefination", "2005 aug", "dropbox", "foldercreate", "scan doc", "officiality", "search match", "running script", "materialextid", "studentref", "ceeb", "materialcode", "memo", "jsoncontent", "ro document", "paperfileutils", "afaconfig", "ro workflow", "paperfileconfig", "applicationjson", "formsrso", "targetfile", "property name", "pinames today", "addp", "science addp", "addp move", "ro code", "scifilescanner", "desconfnode", "grabnodeprop", "copy", "consumer", "initiators", "hiring", "consigno", "offer letter", "match", "apsmaster", "match2", "reappointment", "expiry date", "today", "finaldate", "task info", "psperson", "complete basic", "hiring info", "employee", "resultdata", "delegategroup", "delegate group", "verify", "bind", "aps appointment", "trevor report", "sfsussl", "drawdown", "refund", "reporttype", "var document", "shareurl", "newgroup", "parentgrp", "group created", "var logfile", "rule folder", "site running", "report on", "get site", "foldername", "create file", "reportlogslogs", "reportlogs", "ist site", "running report", "count", "tran", "var csvfile", "result length", "processid", "process id", "delimiters", "quoted", "standard", "starting name", "morechildren", "pdf var", "length", "newname", "fiscal", "docnamearr", "filenode", "calendar year", "versionhistory", "new doc", "web deployed", "var startdate", "startdate", "maxcount", "prevmonth", "monthcount", "application id", "delete", "get path", "if node", "search length", "arra y", "if csv", "version history", "graduate", "graduate folder", "children", "graduate file", "searchmatchdob", "career", "appl nbr", "jan04 now", "counter", "thesis", "runyear", "spring", "service log", "everything", "this determine", "thesis deposit", "archival", "problem", "filepath", "md import", "arraytocsv", "found document", "start", "food", "yumna", "start kofax", "kofax", "admin", "subject", "sample email", "execute", "koafx", "apasresponseid", "merge", "recruitment", "transcripts", "review request", "admindate", "requesteddate", "approveddate", "approvereject", "getemailbody", "taskid", "sendemail", "request status", "siteconsumer", "sitemanager", "eval", "acshost", "global env", "config file", "apsprod", "params", "alloc", "checkpath", "newpath", "adding entity", "surnamechar", "adding person", "jsonfunction", "text", "syntaxerror", "arraytoxml", "xml related", "change xml", "xmltoarray", "xmlutil", "common folder", "random2digit", "maxlimit", "jsonarchive", "very", "returns", "sitecontext", "arrcounter", "node id", "items", "array length", "therecord", "award sponsor", "rso project", "res0012345", "iso88591", "util function", "project id", "proposal id", "doc name", "newdocname", "prod url", "199899", "property", "typeprop", "barcode", "accepts", "parent", "xmlfilename", "siteconfigjson", "qabatchgrp", "signeddate", "ephdocumenttype", "json document", "qapercentage", "entity", "broker", "add error", "getexecutetime", "qaoperator", "retain title", "idnumber", "assocname", "metaarr", "fund report", "csvcontent", "input folder", "doc00c200004txg", "xmlfile", "node1", "node2", "540am", "240pm", "metadata", "var folder", "filter", "mappedobj", "09azaz", "conditionval", "foldercondition", "file name", "xmlfileobj", "alfresco prop", "setup error", "formatjson", "id property", "move", "getrandomnumber", "result", "newdoctype", "no title", "clioacs update", "clio", "patch", "system overview", "system", "overview", "purpose", "aims", "objectives", "prerequisites", "total", "expected effort", "domain", "urls", "dept param", "department name", "done", "submit form", "saving", "label", "input", "approvers", "information", "user group", "request", "group request", "users", "single family", "edmonton ab", "coverage", "common law", "step workflow", "care", "dental benefits", "direct", "web scripts", "get http", "documentation", "web script", "http method", "http", "apis", "development", "knowledge", "java", "empty argument", "e1234", "im system", "lookupentity", "configfilename", "namespace", "searchterm", "access", "jsonuser", "alfresco search", "page search", "expires", "signer", "reason", "utf8", "stripcharacter", "pull hiring", "getapsdbid", "save", "processsetidset", "saved", "returndata", "boolean", "start building", "varname", "fill", "time click", "initiated all", "submissions", "all submissions", "process landing", "page", "initiators all", "maps initiated", "post doc", "student term", "start form", "middle name", "email address", "retype", "cell", "phone no", "fellow", "secureorigin", "expand", "thank", "here", "please check", "aps list", "pang", "subset", "display", "args", "task", "username", "save form", "data need", "cdkey", "checkdict", "item", "column", "anchor", "multi", "tasks filter", "search", "trigger aps", "process api", "apsprocess", "authentication", "webscript", "getapsperson", "process info", "initsavestatus", "step0statusfail", "signer1", "signer2", "appointment", "taskjson", "groupapiaccess", "checkapiuser", "fgsrpr", "psaudit", "statusname", "unsuccessful1", "apptreappt", "emplobject", "caps aps", "cap epsb", "applicant", "form submitted", "board review", "form applicant", "school district", "start date", "cap application", "home help", "pdfa format", "larger", "upload file", "please click", "uofacap", "applications", "jstr", "processjson", "invalid url", "associate dean", "edmonton public", "october", "elk island", "reutrn false", "mapdoctypeurl", "doctype", "cap document", "doctypes", "doctypemap", "schools", "public schools", "foip", "edmonton area", "epsb", "capid", "server", "aps user", "groupcapadmin", "assignuser", "cap ea", "successfully", "please wait", "successfully ea", "apsservice", "apsserviceprod", "requireddate", "bibliography", "reb approval", "letter", "cprbls", "ahsrespect", "ahscon", "immformdocs", "picvsc", "whmis", "condissi", "hspnet", "conphoto", "conclin", "college", "health", "submission date", "effective date", "expiration date", "chs admin", "student view", "typekey", "placementdocs", "warning", "jobj", "abraniuk", "wendy", "terry harris", "directorhrsbs", "level", "holiday pay", "part time", "payroll", "salariedreg aux", "cheat", "paramname", "getallurlparams", "hrsbs config", "data dictionary", "field", "responsejson", "workflowid", "workflow id", "context", "event", "statusevent", "uaesign", "success", "permission", "progress report", "postdoctoral", "sorry", "deptjson", "fgsr student", "process status", "select", "currentuser", "reports", "student ccid", "populated", "invalid student", "supervisor ccid", "co supervisor", "due date", "freedom", "report process", "fgsr forms", "list fgsr", "report fgsr", "report sorry", "review process", "fgsr supervisor", "thesis programs", "programs", "please enter", "student id", "submit button", "var taskid", "var currentuser", "review sorry", "raheel", "added", "urlorigin", "need", "raheel var", "elmid", "commentkeyarr", "override", "menu", "colour bar", "mdphd", "absence", "completion", "mbameng", "mbamsc", "meng", "jason", "acs property", "available", "subdoctype", "test person", "test effective", "modelnodepath", "sitename", "metadatamap", "sitefile", "google addon", "gtagra", "gta gra", "zhreformengresp", "id otherwise", "university home", "indicate", "monday", "tuesday", "wednesday", "thursday", "friday", "na note", "services", "please contact", "documentname", "time", "docs", "documentlink", "employee ccid", "conflict", "task assigned", "ist coi", "declaration", "jsonobj3", "parse", "stringify", "grouplist", "json post", "taskfilter", "applies", "assigntogroup", "retrieves", "assignee", "queries", "expects", "uri args", "json containing", "applyfilter", "assignment", "avm folder", "avm store", "store id", "fullpath", "store", "storeid", "avm stores", "search term", "blog query", "category", "api call", "returns json", "cached data", "keylabel", "rest", "ldap query", "resultstr", "jsonoutput", "campusid", "jsonobj", "suresh joshee", "raheel bhojani", "desrochers", "first check", "set message", "materialkey", "acommonfolderid", "hasaccess", "siteconfig", "unprocesseddata", "savemetadata", "getcustomscript", "sitetitle", "error occured", "afa admission", "afas", "change log", "date name", "description", "ebeaton script", "tfrith", "afa main", "runasuser", "afas name", "afa paper", "file test", "utility enter", "does", "student", "bad query", "parameters", "add all", "or condition", "batch ids", "case files", "batchid", "afns", "agricultural", "anaesthes", "life", "environmental", "anaesthesiology", "uappol content", "deanaheed", "programyear", "province", "agreementtype", "safety manual", "mtis", "cree", "blackfoot", "nakota sioux", "iroquois", "dene", "treaties", "first nations", "next", "refresh", "site viewer", "facetkey", "sortparameter", "textjavascript", "public site", "viewer access", "acs cron", "job error", "alfrescos", "unauthorized", "enter", "bear tracks", "main department", "choose", "library", "john", "reviewer", "embargodate", "actiondate", "convocation", "graduation", "nodeid", "thesis status", "match result", "match list", "name dob", "view", "searchcriteria", "main function", "method", "chs upload", "stuln", "filetype", "stuid", "chs agreement", "health sciences", "recreation fomd", "dentistry fomd", "fomd", "therapy fomd", "consent for", "disclosure of", "alberta freedom", "protection", "privacy act", "alberta health", "chs form", "intake", "tasks dashlet", "doccd", "val2", "a my", "view error", "view warning", "keyword search", "refresh list" ], "references": [ "old-AlfrescoToolkit.conf", "AlfrescoToolkit.info", "AlfrescoToolkit.conf", "activities-email_es.ftl", "activities-email_ja.ftl", "activities-email_de.ftl", "activities-email_nl.ftl", "activities-email.ftl", "activities-email_it.ftl", "activities-email_fr.ftl", "CAP-notify-monthly-report.ftl", "chs-commentUpdate.ftl", "chs-studentUploadNotification.ftl", "chs-Invalid.ftl", "chs-studentExpireSoon.ftl", "chs-studentExpired.ftl", "following-email.html_it.ftl", "following-email.html_fr.ftl", "following-email.html_ja.ftl", "following-email.html_nl.ftl", "following-email_de.html.ftl", "following-email_fr.html.ftl", "following-email_ja.html.ftl", "following-email_it.html.ftl", "following-email_nl.html.ftl", "following-email.html.ftl", "following-email.html_de.ftl", "fvca-reminder-email.ftl", "fvca-corrections-email.ftl", "invite-email_nl.html.ftl", "invite-email-add-direct.html.ftl", "invite-email-add-direct.html_fr.ftl", "invite-email_fr.html.ftl", "invite-email_it.html.ftl", "invite-email-add-direct.html_es.ftl", "invite-email-add-direct.html_de.ftl", "invite-email_ja.html.ftl", "invite-email-add-direct.html_nl.ftl", "new-user-email.html.ftl", "new-user-email_de.html.ftl", "invite-email-add-direct.html_ja.ftl", "invite-email-moderated.html.ftl", "new-user-email_fr.html.ftl", "new-user-email_it.html.ftl", "new-user-email_ja.html.ftl", "new-user-email_es.html.ftl", "new-user-email_nl.html.ftl", "invite-email-add-direct.html_it.ftl", "new-user-email_nl.html", "invite-email.html_nl.ftl", "invite-email.ftl", "invite-email_es.html.ftl", "invite-email.html.ftl", "invite-email_de.html.ftl", "invite_user_email.ftl", "kofaxFailedEmailTemplate.ftl", "notify_user_email.ftl", "notify_nl.htm", "notify_user_email_es.html.ftl", "notify_user_email_de.html.ftl", "notify_user_email_ooa_failed.ftl", "notify_user_email.html.ftl", "notify_user_email_it.html.ftl", "notify_user_email_e-transcript_failed.ftl", "notify_user_email_ja.html.ftl", "notify_user_email_fr.html.ftl", "notify_user_email_nl.html.ftl", "OOA-notify-email-template.ftl", "ADV-notify-terms-types.ftl", "appt-final-reminder.ftl", "appt-halfway-reminder.ftl", "sfs-wf-email.html.ftl", "sfs-wf-completed-email.html.ftl", "payActionDecision.html.ftl", "departmentAdhocTask.html.ftl", "wf-email.html_de.ftl", "wf-email.html.ftl", "wf-email_it.html.ftl", "wf-email_fr.html.ftl", "wf-email_nl.html.ftl", "wf-email_ja.html.ftl", "wf-email.html_fr.ftl", "wf-email.html_nl.ftl", "wf-email_es.html.ftl", "wf-email.html_ja.ftl", "wf-email.html_it.ftl", "wf-email_de.html.ftl", "wf-email.html_es.ftl", "emailbody_textplain_alfresco.ftl", "emailbody_textplain_alfresco_es.ftl", "emailbody_textplain_alfresco_fr.ftl", "emailbody_textplain_alfresco_it.ftl", "emailbody_textplain_alfresco_ja.ftl", "emailbody_textplain_alfresco_nb.ftl", "emailbody_textplain_alfresco_pt_BR.ftl", "emailbody_textplain_alfresco_nl.ftl", "emailbody_textplain_alfresco_ru.ftl", "emailbody_textplain_alfresco_zh_CN.ftl", "emailbody_textplain_share.ftl", "emailbody_textplain_share_de.ftl", "emailbody_textplain_share_es.ftl", "emailbody_textplain_share_it.ftl", "emailbody_textplain_share_ja.ftl", "emailbody_textplain_share_nb.ftl", "emailbody_textplain_share_nl.ftl", "emailbody_textplain_share_ru.ftl", "emailbody-alfresco-textplain.ftl", "emailbody-share-textplain.ftl", "emailbody_textplain_alfresco_de.ftl", "emailbody_textplain_share_zh_CN.ftl", "emailbody_textplain_share_fr.ftl", "emailbody_textplain_share_pt_BR.ftl", "uofa-pc-model.xml", "uofa-pllc-model.xml", "uofa-science-model.xml", "uofa-rso-model.xml", "uofa-set-model.xml", "uofa-sfs-model.xml", "uofa-slate-model.xml", "uofa-uappol-model.xml", "advext-model.xml", "assocModel.xml", "adv-model.xml", "cbsr-model.xml", "dynamicSecurityMarksModel", "ephesoft-educational.xml", "facopr-model.xml", "fgsr-model.xml", "faculty-model.xml", "psAudit-model.xml", "FVCA.xml", "roDocProcessing-model.xml", "ro-model.xml", "fgsr-thesis-deposit.xml", "security-group-model.xml", "ua-audit-generic-model.xml", "ua-dummy.xml", "calendar-year-model.xml", "ua-error-model.xml", "uafgsrsup-model.xml", "uaqa-model.xml", "transcript-model.xml", "uAlbertaWorkflowGeneral.xml", "uarmm-supplement-scanning.xml", "uarm-rma-filing-model.xml", "ua-search-model.xml", "ro-search-match.xml", "uatraining.xml", "uofa-ales-model.xml", "uofa-arts-model.xml", "uofa-aps-model.xml", "uofa-base-model.xml", "uawfh-model.xml", "uofa-augustana-model.xml", "uofa-business-model.xml", "uarmTempModel.xml", "uofa-cap-model.xml", "uofa-chs-model.xml", "uofa-chs-agreements-model.xml", "uofa-common-model.xml", "uofa-education-model.xml", "tamis-model.xml", "uofa-engg-coop-model.xml", "uofa-engg-model.xml", "uofa-fo-model.xml", "uofa-extension-model.xml", "uofa-esign-model.xml", "uofa-hrsbs-model.xml", "uofa-law-model.xml", "uofa-caps-model.xml", "uofa-hrs-model.xml", "uofa-native-studies-model.xml", "uofa-pllc-model.json", "uofa-rso-model.json", "uofa-pc-model.json", "uofa-native-studies-model.json", "uofa-slate-model.json", "uofa-uappol-model.json", "uofa-science-model.json", "uofa-workflowGeneral.json", "uofa-sfs-model.json", "adv-model.json", "advext-model.json", "assocModel.json", "calendar-year-model.json", "facopr-model.json", "cbsr-model.json", "ephesoft-educational.json", "faculty-model.json", "faculty-model.xml.json", "rma-model.json", "fgsr-model.json", "FVCA.json", "psAudit-model.json", "ro-aug-model.json", "ro-search-match.json", "tamis-model.json", "security-group-model.json", "fgsr-thesis-deposit.json", "transcript-model.json", "ro-model.json", "ua-audit-generic-model.json", "uafgsrsup-model.json", "uaqa-model.json", "uarmm-supplement-scanning.json", "uAlbertaWorkflowGeneral.json", "ua-error-model.json", "uofa-ales-model.json", "ua-search-model.json", "uarmTempModel.json", "uofa-aps-model.json", "uawfh-model.json", "uofa-arts-model.json", "uofa-cap-model.json", "uofa-chs-agreements-model.json", "uofa-augustana-model.json", "uofa-base-model.json", "uofa-chs-model.json", "uofa-engg-coop-model.json", "uofa-common-model.json", "uofa-engg-model.json", "uofa-extension-model.json", "uofa-hrsbs-model.json", "uofa-fo-model.json", "uofa-education-model.json", "uofa-law-model.json", "uofa-hrs-model.json", "uofa-esign-model.json", "uofa-business-model.json", "faculty-of-science-site.json", "FandO-Organizations.json", "FandO-Programs.json", "fgsr-awards.json", "fgsr-category-list.json", "fgsr-exam-list.json", "fgsr-official-list.json", "fgsr-programOfStudy.json", "fgsr-site.json", "fo-emergency-response-manual.json", "graduate-student-records-site.json", "fo-site.json", "fo-utilities.json", "hrs-benefits.json", "hrsbs-action-reasons.json", "graduate-student-records-v2-site.json", "hrsbs-doc-list.json", "hrsbs-file-structure.json", "hrsbs-owner-details.json", "hrsbs-functionalroles.json", "hrsbs-function-module.json", "hrsbs-review-month.json", "hrsbs-security-class.json", "hrsbs-site.json", "hrs-employeeApprovedDeductions.json", "hrs-bulkId.json", "hrsbs-review-cycle.json", "hrs-employmentFinancial.json", "hrs-personalInformation.json", "hrs-pension.json", "hrs-security-list.json", "hrs-leaves.json", "Institutions.json", "ist-site.json", "hrs-site.json", "my-site-site.json", "law-security-list.json", "native-studies-doc-list.json", "fgsr-credential-list.json", "law-doc-list.json", "native-studies-security-list.json", "office-of-advancement-record-types.json", "office-of-advancement-site.json", "pcm-category.json", "pllc-doc-list.json", "ro-academic-pre-pro-programs.json", "pllc-security-list.json", "ro-acad-group.json", "ro-admitType.json", "ro-applicant-type.json", "ro-campusSolutionsTerm.json", "hrsbs-employee-class.json", "pllc-site.json", "ro-indigenous-type.json", "ro-doctypes.json", "pcm-site.json", "ro-official.json", "ro-org-desc.json", "ro-related-record-types.json", "ro-relationship-to-institution.json", "ro-search-match-status.json", "ro-authenticity.json", "ro-slate-folio-material-non-school-scope.json", "ro-slate-institution-material.json", "ro-slate-folio-material-school-scope.json", "ro-method-receipt.json", "ro-slate-institutions.json", "ro-test-id.json", "rso-accounts-receivable-accounts-payable-doc-type.json", "rso-agreements-doc-category.json", "rso-bulk-scan-doc-type.json", "rso-cfi-purchasing-doc-type.json", "rso-cfi-financials-doc-type.json", "rso-financial-reconciliation-doc-type.json", "rso-financial-reporting-doc-type.json", "rso-financials-doc-type.json", "rso-mask.json", "rso-site.json", "rso-sponsor-names.json", "science-doc-list.json", "science-security-list.json", "school-of-business-site.json", "sfs-ussl-report-status.json", "staff-training-site.json", "student-financial-services-doc-list.json", "student-financial-services-site.json", "student-records-bulk-load-testing-site.json", "student-records-training-site.json", "student-records-site.json", "student-transcripts-site.json", "rso-forms-form-type.json", "support-documentation-site.json", "test-site-site.json", "uappol-category-heirarchy.json", "uappol-type.json", "uappol-site.json", "uoda-faculties.json", "academic-department.json", "adv-correspondence-type.json", "uoda-departments.json", "advsearch.json", "ales-security-list.json", "ales-doc-list.json", "arts-doc-list.json", "arts-security-list.json", "augustana-security-list.json", "augustana-site.json", "augustana-legacy-transcript-doc-list.json", "rso-activation-report-doc-type.json", "business-doc-list.json", "business-security-list.json", "bulkload-testing-site.json", "cap-site.json", "caps-school-board-list.json", "cbsrsite-site.json", "cbsrsite-sopTypes.json", "cbsr-study.json", "cbsr-worksheetType.json", "augustana-doc-list.json", "chs-ag-type.json", "chs-agreements-site.json", "chs-campus-list.json", "chs-degProgram-list.json", "chs-emailNotification.json", "chs-document-status.json", "chs-faculty-list.json", "chs-programYear-list.json", "chs-program-list.json", "canada-provinces-list.json", "demo-site-site.json", "education-doc-list.json", "department.json", "education-security-list.json", "chs-stuEmailNotification.json", "college-of-health-sciences-site.json", "chs-provinces-list.json", "engineering-coop-doc-list.json", "engineering-coop-security-list.json", "engineering-co-op-site.json", "engineering-doc-list.json", "extension-doc-list.json", "extension-security-list.json", "facopr-planTypes.json", "facopr-supportinDocField.json", "faculty-of-ales-site.json", "engineering-security-list.json", "faculty-of-education-site.json", "faculty-of-extension-site.json", "faculty-of-native-studies-site.json", "faculty-of-law-site.json", "faculty-of-arts-site.json", "faculty-of-engineering-site.json", "my_docs_inline.ftl", "my_docs.ftl", "my_spaces.ftl", "recent_docs.ftl", "translatable.ftl", "readme.ftl", "show_audit.ftl", "general_example.ftl", "my_summary.ftl", "doc_info.ftl", "localizable.ftl", "recordsCustomModel.xml", "imapConfig.json", "rm_event_config.json", "rmScriptThrowError.js", "report_rmr_transferReport.html.ftl", "report_rmr_destructionReport.html.ftl", "report_rmr_holdReport.html.ftl", "notify-records-due-for-review-email.ftl", "record-rejected-email.ftl", "record-superseded-email.ftl", "onCreate_supersedes.js", "rma_isClosed.js", "PaperFileconfig.json", "MyTasks-config.json", "AFAconfig.json", "roDocumentTypes.json", "uappol-upload-rule.js", "uappolCreateFolderRule.js", "uappolCreateFolder.js", "uappol-api.js", "uappol-functions.js", "command-utils.js", "backup and log.js", "backup.js", "example test script.js", "test return value.js", "start-pooled-review-workflow.js", "command-processor.js", "command-search.js", "alfresco docs.js", "append copyright.js", "createDepartmentJSON.js", "hrsDaily.js", "hrsFolderCreateSchedule.js", "hrsScanned.js", "hrsCreateFolder.js", "hrsFolderCreateRule.js", "hrsFileShareFolder.js", "alesCreateFolderRestricted.js", "alesCreateFolderSchedule.js", "alesBulkShareFolder.js", "alesFileScanned.js", "alesCreateFolder.js", "alesDaily.js", "alesFileShareFolder.js", "alesCreateFolderConfidential.js", "alesCreateAdvisingNotes.js", "alesFolderCreateSchedule.js", "deployWebServiceDescriptor.js", "taskReportCSV-Appointment-prod.js", "artsFileScanned.js", "artsCreateFolderRule.js", "artsCreateFolder.js", "artsCreateFolderRestricted.js", "augCreateFolderRestricted.js", "augCreateFolder.js", "businessCreateFolderRule.js", "businessCreateFolder.js", "businessCreateFolderSchedule.js", "businessBulkShareFolder.js", "businessFileShareFolder.js", "businessCreateFolderRestricted.js", "businessDaily.js", "businessCreateAdvisingNotes.js", "businessFileScanned.js", "CAPSendMonthlyReportEmail.js", "CAPGenerateMonthlyReport.js", "CapFinalReportSubmit.js", "chsCreateFolderRule.js", "chsEmailOnUpdateComment.js", "chsReport.js", "EmailNotifCHSStudent.js", "SetExpiryDate.js", "chsCreateFolder.js", "chsFacultyReport.js", "chsAgreementCreateFolderRule.js", "chsAgreementCreateFolder.js", "scheduleJobTest.js", "every52MinPastHour.js", "every46MinPastHourBetween4PM12PM.js", "every57MinPastHour.js", "every47MinPastHourBetween4PM12PM.js", "everyDay4H30MinAM.js", "everyDay7H45MinAM.js", "every10MinStartingAt5MinPastHour.js", "every38MinPastHourBetween4PM12PM.js", "every20MinStartingAt15MinPastHour.js", "everyDay2H05MinAM.js", "every2MinStartingAt1MinPastHour.js", "everyDay1H05MinAM.js", "everyDay12H30MinAM.js", "everyDay7H30MinPM.js", "every30MinStartingAt19MinPastHour.js", "every30MinStartingAt11MinPastHour.js", "everyDay2H35MinAM.js", "every30MinStartingAt26MinPastHour.js", "every16MinPastHour.js", "everyDay1H45MinAM.js", "everyDay2H45MinAM.js", "every29MinPastHour.js", "every22MinPastHour.js", "everyDay11H30MinPM.js", "educationCreateFolderRule.js", "educationCreateFolder.js", "educationCreateAdvisingNotes.js", "enggCoopCreateFolderRestricted.js", "enggCoopCreateFolderRule.js", "enggCoopBulkUpload.js", "enggCreateFolderRule.js", "enggCreateFolderRestricted.js", "enggCreateFolder.js", "engineeringCreateAdvisingNotes.js", "enggCoopCreateFolder.js", "enggFileScanned.js", "enggCoopFileScanned.js", "extensionFileScanned.js", "extensionCreateFolder.js", "extensionCreateFolderRule.js", "fgsrCreateGuidelineAPSProcessFromCSV.js", "fgsrDocRestructure.js", "fgsrMigrationScript.js", "fgsrDocRelocation.js", "fgsrCreateFolderFromCSV.js", "guideline-reports.js", "fgsrMigrationScript-withTerminationLogic.js", "modfiyOrUpdatePropertyfromCSV.js", "fgsr-case-file-report.js", "fgsrCreateAPSProcessFromFolder.js", "fgsrCreateFolder.js", "fgsrCopyMetadataToFolderLevel.js", "fgsrCreateAPSProcessFromCSV.js", "foCreateFolder.js", "foCreateFolderRule.js", "Script1.js", "Script2.js", "scheduleRunEvery2-10PM.js", "scheduleRunEvery5PMTo10PM.js", "scheduleRunEvery30Minutes.js", "scheduleRunEvery60Minutes.js", "scheduleRunEveryday3PMto11PM.js", "scheduleRunEveryday12AMto6AM.js", "scheduleRunEvery20Minutes.js", "scheduleRunEvery2AM.js", "acsToApsUserUpdate.js", "2024-01-13-log.txt", "2024-01-15-log.txt", "2024-01-20-log.txt", "2024-01-21-log.txt", "2024-01-22-log.txt", "2024-01-23-log.txt", "2024-02-04-log.txt", "2024-02-05-log.txt", "2024-02-06-log.txt", "2024-02-07-log.txt", "2024-02-08-log.txt", "2024-01-14-log.txt", "2024-01-18-log.txt", "2024-01-11-log.txt", "2024-01-16-log.txt", "2024-01-19-log.txt", "2024-01-26-log.txt", "2024-01-28-log.txt", "2024-01-30-log.txt", "2024-01-12-log.txt", "2024-01-29-log.txt", "2024-01-27-log.txt", "2024-01-31-log.txt", "2024-01-24-log.txt", "2024-02-09-log.txt", "2024-02-02-log.txt", "2024-01-09-log.txt", "2024-02-03-log.txt", "2024-01-05-log.txt", "2024-01-06-log.txt", "2024-01-04-log.txt", "2024-02-01-log.txt", "2024-01-07-log.txt", "2024-01-08-log.txt", "2024-02-10-log.txt", "2024-02-11-log.txt", "2024-02-12-log.txt", "2024-02-13-log.txt", "2023-12-31-log.txt", "2024-02-15-log.txt", "2024-02-16-log.txt", "2024-02-14-log.txt", "2024-02-18-log.txt", "2024-02-20-log.txt", "2024-01-17-log.txt", "2024-02-19-log.txt", "2024-01-10-log.txt", "2024-02-23-log.txt", "2024-02-25-log.txt", "2024-02-21-log.txt", "2024-01-25-log.txt", "2024-02-28-log.txt", "2024-02-22-log.txt", "2024-02-29-log.txt", "2024-03-02-log.txt", "2024-03-03-log.txt", "2024-02-26-log.txt", "2024-03-04-log.txt", "2024-03-06-log.txt", "2024-03-07-log.txt", "2024-03-05-log.txt", "2024-03-08-log.txt", "2024-03-09-log.txt", "2024-03-11-log.txt", "2024-03-10-log.txt", "2024-03-12-log.txt", "2024-03-13-log.txt", "2024-03-14-log.txt", "2024-03-15-log.txt", "2024-03-16-log.txt", "2024-03-17-log.txt", "2024-03-18-log.txt", "2024-03-20-log.txt", "2024-03-21-log.txt", "2024-03-22-log.txt", "2024-03-19-log.txt", "2024-03-23-log.txt", "2024-03-01-log.txt", "2024-03-26-log.txt", "2024-03-25-log.txt", "2024-03-28-log.txt", "2024-03-29-log.txt", "2024-03-27-log.txt", "2024-03-24-log.txt", "2024-03-30-log.txt", "2024-04-02-log.txt", "2024-04-03-log.txt", "2024-03-31-log.txt", "2024-04-05-log.txt", "2024-04-06-log.txt", "2024-04-07-log.txt", "2024-04-08-log.txt", "2024-04-09-log.txt", "2024-04-04-log.txt", "2024-04-11-log.txt", "2024-04-12-log.txt", "2024-04-13-log.txt", "2024-02-17-log.txt", "2024-04-01-log.txt", "2024-04-16-log.txt", "2024-04-15-log.txt", "2024-04-10-log.txt", "2024-04-17-log.txt", "2024-02-24-log.txt", "2024-04-14-log.txt", "2024-04-19-log.txt", "2024-04-21-log.txt", "2024-04-22-log.txt", "2024-04-23-log.txt", "2024-04-24-log.txt", "2024-04-26-log.txt", "2024-04-25-log.txt", "2024-04-29-log.txt", "2024-04-30-log.txt", "2024-05-01-log.txt", "2024-05-02-log.txt", "2024-05-03-log.txt", "2024-05-04-log.txt", "2024-05-05-log.txt", "2024-05-06-log.txt", "2024-04-28-log.txt", "2024-05-07-log.txt", "2024-04-18-log.txt", "2024-05-08-log.txt", "2024-05-09-log.txt", "2024-05-10-log.txt", "2024-05-12-log.txt", "2024-05-14-log.txt", "2024-05-11-log.txt", "2024-05-16-log.txt", "2024-04-27-log.txt", "2024-05-17-log.txt", "2024-05-15-log.txt", "2024-05-18-log.txt", "2024-05-20-log.txt", "2024-05-21-log.txt", "2024-05-19-log.txt", "2024-05-22-log.txt", "2024-05-23-log.txt", "2024-05-25-log.txt", "2024-05-24-log.txt", "2024-05-26-log.txt", "2024-05-27-log.txt", "2024-05-28-log.txt", "2024-05-29-log.txt", "2024-05-30-log.txt", "2024-06-02-log.txt", "2024-05-13-log.txt", "2024-06-01-log.txt", "2024-05-31-log.txt", "2024-04-20-log.txt", "2024-06-03-log.txt", "2024-06-04-log.txt", "2024-06-05-log.txt", "2023-12-30-log.txt", "2023-12-01-log.txt", "2024-02-27-log.txt", "2023-12-29-log.txt", "gtaGraProcessToCSV.js", "gtaGraProcessToCSV-2AM.js", "hrs-benefit-report.js", "westCanDocumentMove.js", "hrsbsReviewCycleReport.js", "hrsbsCreateFolderRule.js", "HRSBS-SyncCCIDs.js", "hrsbsCreateFolder.js", "FVCA-data-import.js", "FVCA-manual-property-update.js", "istPerformanceReviewCreateFolder.js", "lawCreateFolderRestricted.js", "lawFileScanned.js", "lawCreateFolder.js", "lawCreateFolderRule.js", "nativeStudiesCreateFolderRestricted.js", "nsFolderCreateSchedule.js", "nativeStudiesCreateFolder.js", "nativeStudiesCreateFolderRule.js", "ADV-notify-type-mapping.json", "OOA-notify-email.js", "ADV-notify-terms-types.js", "pcm-grab-competitive-noderefs.js", "pcm-update-competitive-noderefs.js", "pcmCreateFolder.js", "psUpdateAlfrescoDepartment.js", "pllcCreateFolder.js", "qaProcess.js", "qaRelease.js", "rmOOABackgroundInformationFiling.js", "rmFilingDoc.js", "rmSearchmatchNomatchFiling.js", "rmFilingConfig.json", "thesisDestructionReport.js", "rmThesis.js", "add_document_type_ro.js", "updateSearchMatchStatus.js", "searchmatchFullDob.js", "createROReconciliationReports.js", "eTranscriptInstList.js", "folder-create-ro.js", "augTranscript.js", "addTimeStamp.js", "missingDocumentList-csv.js", "roAddAspectAndMoveAFA.js", "myTaskDownload.js", "roAddAspectAndMoveTranscript.js", "roAddBundlingAspect.js", "roAddSearchMatchAspect.js", "roCopyEphesoftMetadataXML.js", "roBatchScript.js", "addSearchMatchDocumentType.js", "roCreateEducationalCSV.js", "roCopyOlderScannedDocument.js", "roDocumentListAPLSTD.js", "roCopyOlderScannedDocumentAdHoc.js", "roEtranscriptReport.js", "roDailyQA.js", "roEtranscriptsBundleTest.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "roFolderCreateLDAPLookup.js", "roEtranscriptsBundle.js", "roAddComment.js", "roCopyEphesoftMetadataScanned.js", "roMoveCompleted.js", "roMoveCompletedBackScan.js", "roMoveCompletedSearchMatch.js", "roEtranscriptPDFConverter.js", "roScanningMetadata.js", "roScript1.js", "RORoutingWorkflowUtil.js", "roScript3.js", "roScript2.js", "roScanningMetadataBackScan.js", "roScript7.js", "roScript6.js", "roScript9.js", "roScript1BackScan.js", "roSearchMatchNoMatchReport.js", "roSearchMatchQuery.js", "RONotification.js", "roSlateDocumentExport.js", "roTagAndFileRenderedPDFs.js", "roScript4.js", "roScript5.js", "roScript8.js", "createSlateFolioMaterialDropdown.js", "createSlateApplicationsCSV.js", "LaunchWorkflowUtils.js", "PaperFileUtils.js", "GenerateSponsornamesAndPinames.js", "rsoCreateFolder.js", "sciCreateFolderConfidential.js", "sciCreateFolderPublic.js", "sciCreateFolder.js", "sciCreateFolderRestricted.js", "scienceASDocumentImport.js", "sciFileADDPFileTypes.js", "sciFileShareFolder.js", "sciFileScanned.js", "sciBulkShareFolder.js", "copy-signed-offer-letter.js", "dept-config.js", "reappointment-generate-schedule.js", "reappointment-reminder-schedule.js", "reappointment-generate-process.js", "manual-generate-script.js", "reappointment-reminder-process.js", "reminder-email-util.js", "reappointment-tracking-schedule.js", "reappointment-tracking-process.js", "appointment-report.js", "appointment-report-schedule.js", "manual-tracking-script.js", "sfsCreateFolder.js", "sfsWorkflowStatus.js", "security-group-user.js", "createReportPermissionsFoldersInASite.js", "siteMembersReport.js", "createReportRecursiveGroupsAndUsersInASite.js", "search-responses.js", "advChangeDocumentType.js", "addFolderMetadata.js", "advChangeDocumentType_confidential.js", "consignOInitiatorOfferLetterChange.js", "advChangeDocumentType_background.js", "transcriptResponse.js", "change-fgsr-pdf-file-name-with-date.js", "copy-fgsr-to-graduate-students-records.js", "ADVDonationCalendarToFiscal.js", "document-query.js", "deletingCompletingWorkflow.js", "eTranscriptTemp.js", "eTranscript-bundled-02-jan.js", "eTranscriptVersionModifierFix.js", "fixCheckout.js", "removeDonationGrp.js", "eTranscriptVersioningFix.js", "move-fgsr-folder.js", "search-match-dob-add.js", "thesisDepositArchival.js", "moveThesesForTransfer.js", "eraReportGeneration.js", "kofaxMetadataMerge.js", "kofaxMetadataMergeMissing.js", "generic2min.js", "kofaxSendEmail.js", "PeopleSoft-eTranscript-XML-PDF.js", "startBenefitWorkflow.js", "peoplesoftMetadataMergeMissing.js", "securityWorkflowUtil.js", "startPayActionWorkflow.js", "startDepartmentAdhocApprovalWorkflow.js", "convertTranscript.js", "CreateTranscriptUserMemberships.js", "startTwoStepWorkflow.js", "fix_employee_names.js", "env.js", "folderCreateUtil.js", "folderCreateUtilAA.js", "generalSchedule.js", "JSON.js", "xmlUtil.js", "addPersonAspect.js", "addTimeStampRandomFileName.js", "archiveDocument.js", "luceneUtil.js", "util.js", "archivedItems.js", "getProjectDetails.js", "ADVChangeAuthor.js", "ADVcalendarToFiscal.js", "symplexUtils.js", "advBatchProcessing.js", "advChangeDocumentName.js", "ADVEphesoftMove.js", "advCreateFolderScheduled.js", "advErrorMessageReset.js", "advMetadataUpdate.js", "advMoveToFoldersScheduled.js", "ADVendFundReportFiling.js", "advReconcilliation.js", "ADVmoveRecordsToPreQA.js", "advScanningMetadata.js", "advScript2.js", "advScript3.js", "advScript4.js", "advScript1.js", "advScript5.js", "advScriptDaily.js", "advScriptMonthly.js", "advScriptKofax.js", "ADVSiteContext.js", "advMoveToFolder.js", "deleteEphesoftDoc.js", "advUtils.js", "folderCreateADV.js", "advScriptDaily30minFreq.js", "jsonUtils.js", "advScanning.js", "folderCreateDocumentADV.js", "moveToFolders.js", "symplexMetadataUpdate.js", "OOA_SOT_Name_change.js", "moveToFoldersRetainTitle.js", "advScriptWeekly.js", "symplexMoveToFolder.js", "clioToAcsDocUpdate.js", "ClioUpdateScheduledJob.js", "smartFoldersExample.json", "system-overview.html", "businessDocSetup.json", "uappolDocSetup.json", "businessConfig.json", "augConfig.json", "augDocSetup.json", "lawConfig.json", "uappolConfig.json", "UAlbertaSettings.json", "hrsbsDocSetup.json", "advConfig.json", "hrsbsConfig.json", "hrsConfig.json", "hrsDocSetup.json", "advSimplexMapping.json", "advDocSetup.json", "artsDocSetup.json", "alesConfig.json", "alesDocSetup.json", "archiveFolder.json", "artsConfig.json", "advScanningMapping.json", "collegeOfHealthSciencesConfig.json", "chsAgreementsConfig.json", "dropboxCommonAspects.json", "collegeOfHealthSciencesDocSetup.json", "chsAgreementsDocSetup.json", "educationConfig.json", "extensionConfig.json", "fgsrv2DocSetup.json", "foConfig.json", "foDocSetup.json", "educationDocSetup.json", "lawDocSetup.json", "nativeStudiesDocSetup.json", "pllcConfig.json", "pllcDocSetup.json", "roConfig.json", "fgsrv2Config.json", "rsoConfig.json", "rsoDocSetup.json", "sciConfig.json", "eTranscriptConfig.json", "sciDocSetup.json", "roDocSetup.json", "sfsDocSetup.json", "UAlbertaSettings.conf", "student-recordsConfig.json", "securityWorkflowSetting.json", "thesisDepositConfig.json", "globalHeader.html.ftl", "webFormDialog.html.ftl", "alfrescoUserGroupRequest.ftl", "pensionBenefit.html.ftl", "pinames.json", "sponsornames.json", "searchPageConfig.json", "pcmDocSetup.json", "pcmConfig.json", "qaConfig.json", "apsAppConfig.json", "fgsrCreateApsFromCSV.json", "fgsrCopyMetadata.json", "enggCoopDocSetup.json", "enggDocSetup.json", "enggConfig.json", "enggCoopConfig.json", "CapApsConfig.json", "extensionDocSetup.json", "readme.html", "readme_de.html", "readme_ja.html", "readme_fr.html", "advEndowmentName.get.desc.xml", "advEndowmentName.get.json.ftl", "advEndowmentName.get.js", "advEntityName.get.desc.xml", "advEntityName.get.js", "advEntityName.get.html.ftl", "search.get.desc.xml", "search.get.js", "search.get.html.ftl", "changeInitiatorAppt.put.desc.xml", "eSignatureStatusHistory.get.html.ftl", "changeInitiatorAppt.put.json.ftl", "eSignatureStatusHistory.get.desc.xml", "appointmentSubmit.get.js", "processIdProps.get.desc.xml", "changeInitiatorAppt.put.js", "processIdProps.get.json.ftl", "processIdProps.get.js", "appointmentLandingPage.get.desc.xml", "appointmentLandingPage.get.js", "appointmentLandingPage.get.html.ftl", "appointmentStart.get.desc.xml", "appointmentStart.get.html.ftl", "appointmentStart.get.js", "appointmentStartTest.get.desc.xml", "appointmentStartTest.get.js", "appointmentStartTest.get.html.ftl", "appointmentSubmit.get.desc.xml", "appointmentSubmit.get.html.ftl", "eSignatureStatusHistory.get.js", "apsApplicationList.get.desc.xml", "apsApplicationList.get.html.ftl", "assignuser.put.js", "assignuser.put.json.ftl", "claimtask.put.desc.xml", "claimtask.put.js", "claimtask.put.json.ftl", "completetask.post.desc.xml", "completetask.post.json.ftl", "completetask.post.js", "getapsdbid.get.desc.xml", "getapsdbid.get.json.ftl", "gettasks.get.desc.xml", "gettasks.get.json.ftl", "assignuser.put.desc.xml", "gettasks.get.js", "savetask.post.desc.xml", "savetask.post.js", "savetask.post.json.ftl", "taskForm.get.js", "taskForm.get.desc.xml", "tasklist.get.desc.xml", "apsApplicationList.get.js", "taskForm.get.json.ftl", "tasklist.get.html.ftl.jquery", "tasklist.get.html.ftl", "tasklist.get.js", "triggerapsprocess.post.desc.xml", "triggerapsprocess.post.js", "updatevariables.post.desc.xml.notused", "triggerapsprocess.post.json.ftl", "updatevariables.post.json.ftl.notused", "getapsdbid.get.js", "updatevariables.post.js.notused", "taskUtils.js", "apsGroupsConfig.json", "apsSitesConfig.json", "apptStepZeroStarter.post.desc.xml", "apptStepZeroStarter.post.json.ftl", "apptStepZeroStarter.post.js", "apptStepOneStarter.post.desc.xml", "apptStepOneStarter.post.js", "apptStepOneStarter.post.json.ftl", "apptStepOneSave.post.json.ftl", "apptStepOneSave.post.desc.xml", "apptStepOneSave.post.js", "apptStatusDocUpdate.post.desc.xml", "apptStatusDocUpdate.post.json.ftl", "apptStatusDocUpdate.post.js", "APSWorkflowStatus.get.desc.xml", "APSWorkflowStatus.put.html.ftl", "APSWorkflowStatus.get.html.ftl", "APSWorkflowInfo.put.html.ftl", "APSWorkflowStatus.put.desc.xml", "APSWorkflowInfo.put.desc.xml", "APSWorkflowStatus.get.js", "APSWorkflowStatus.put.js", "APSWorkflowInfo.put.js", "NodeInfo.get.desc.xml", "NodeInfo.get.html.ftl", "capinfo.get.js", "capstart.get.js", "epsb.get.js", "epsb.get.html.ftl", "capstart.get.html.ftl", "epsb.get.desc.xml", "schoolboard.get.html.ftl", "NodeInfo.get.js", "NodeInfoByCapId.get.desc.xml", "updateVariable.post.json.ftl", "updateVariable.post.js", "schoolboard.get.desc.xml", "updateVariable.post.desc.xml", "schoolboard.get.js", "capinfo.get.html.ftl.backup", "cap-file-load.post.json.ftl", "NodeInfoByCapId.get.js", "capinfo.get.html.ftl", "capstart.get.desc.xml", "cap-file-load.post.desc.xml", "capinfo.get.desc.xml", "cap-file-load.post.js", "capeamergedoc.get.js", "capeamergedoc.get.desc.xml", "capeamergedoc.get.html.ftl", "capConfig.js", "chsEnv.js", "chsConfig.js", "chsAdminStuView.get.desc.xml", "chsAdminStuView.get.html.ftl", "chsAdminStuView.get.js", "coupa.get.html.ftl", "coupa.get.desc.xml", "coupa.get.js", "coveoGetDocList.get.desc.xml", "coveoGetDocList.get.json.ftl", "coveoGetDocList.get.js", "getJson.get.desc.xml", "getJson.get.js", "getJson.get.json.ftl", "simpleupload.post.desc.xml", "simpleupload.post.json.ftl", "simpleupload.post.js", "consignoMessage.get.js", "consignoWebhook.post.js", "consignoWebhook.post.json.ftl", "consignoMessage.get.desc.xml", "consignoWebhook.post.desc.xml", "consignoMessage.get.json.ftl", "eSignDownload.get.js", "eSignDownload.get.html.ftl", "eSignDownload.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-supervisorv2.get.js", "review-supervisorv2.get.html.ftl", "fgsrssgLanding.get.js", "review-comm01v2.get.desc.xml", "fgsrssgLanding.get.html.ftl", "review-comm01v2.get.html.ftl", "review-comm02v2.get.desc.xml", "review-comm02v2.get.html.ftl", "fgsrssgLanding.get.desc.xml", "review-studentv2.get.html.ftl", "review-comm03v2.get.html.ftl", "review-comm03v2.get.desc.xml", "review-studentv2.get.desc.xml", "review-cosupervisorv2.get.html.ftl", "review-comm02v2.get.js", "review-startv2.get.desc.xml", "review-studentv2.get.js", "review-cosupervisorv2.get.js", "review-startv2.get.js", "review-student-revisionv2.get.html.ftl", "review-student-revisionv2.get.desc.xml", "review-startv2.get.html.ftl", "review-comm03v2.get.js", "review-cosupervisorv2.get.desc.xml", "review-student-revisionv2.get.js", "review-comm01v2.get.js", "review-comm02.get.desc.xml", "review-comm02.get.html.ftl", "review-comm03.get.desc.xml", "review-comm02.get.js", "review-comm03.get.html.ftl", "review-cosupervisor.get.desc.xml", "review-cosupervisor.get.html.ftl", "review-cosupervisor.get.js", "review-nextdate.get.desc.xml", "review-comm03.get.js", "review-nextdate.get.js", "review-student.get.html.ftl", "review-student.get.js", "review-student-revision.get.desc.xml", "review-student.get.desc.xml", "review-student-revision.get.js", "review-studentTest.get.desc.xml", "review-supervisor.get.desc.xml", "review-studentTest.get.js", "review-supervisor.get.html.ftl", "review-supervisor.get.js", "review-comm01.get.desc.xml", "review-comm01.get.html.ftl", "review-comm01.get.js", "review-student-revision.get.html.ftl", "review-nextdate.get.html.ftl", "review-studentTest.get.html.ftl", "guidelines-supervisor.get.desc.xml", "guidelines-supervisor-revision.get.html.ftl", "guidelines-start.get.desc.xml", "guidelines-start.get.html.ftl", "guidelines-start.get.js", "guidelines-student.get.desc.xml", "guidelines-student.get.html.ftl", "guidelines-student-revision.get.js", "guidelines-student-revision.get.desc.xml", "guidelines-supervisor.get.html.ftl", "guidelines-supervisor-revision.get.desc.xml", "guidelines-student-revision.get.html.ftl", "guidelines-student.get.js", "guidelines-supervisor.get.js", "guidelines-supervisor-revision.get.js", "programExtensionScript.js", "customScript.js", "customCSS_FGSR2.css", "customCSS_FGSR.css", "fgsrEnv.js", "FGSR-Forms-Config.js", "config.js", "googleAddon.get.json.ftl", "googleAddon.get.desc.xml", "googleAddon.get.js", "gtaGraStatus.post.json.ftl", "gtaGraStatus.post.js", "gtaGraStatus.post.desc.xml", "wfh-manager.get.desc.xml", "wfh-form.get.js", "wfh-manager.get.html.ftl", "wfh-form.get.desc.xml", "wfh-revise.get.desc.xml", "wfh-revise.get.html.ftl", "wfh-revise.get.js", "wfh-seniormanager.get.desc.xml", "wfh-manager.get.js", "wfh-seniormanager.get.js", "wfh-seniormanager.get.html.ftl", "wfh-form.get.html.ftl", "hrsbsDocumentLinking.get.desc.xml", "hrsbsDocumentLinking.get.html.ftl", "hrsbsDocumentLinking.get.js", "coi-start.get.desc.xml", "coi-start.get.html.ftl", "coi-revise.get.html.ftl", "coi-employee.get.html.ftl", "coi-employee.get.desc.xml", "coi-revise.get.desc.xml", "coi-start.get.js", "coi-revise.get.js", "coi-supervisor.get.js", "coi-supervisor.get.desc.xml", "coi-employee.get.js", "coi-supervisor.get.html.ftl", "getTaskFilter.get.json.ftl", "queryTasks.get.json.ftl", "routableGroups.get.desc.xml", "routableGroups.get.js", "routableGroups.get.json.ftl", "queryTasks.get.desc.xml", "setTaskFilter.post.js", "setTaskFilter.post.json.ftl", "setTaskFilter.post.desc.xml", "applyTaskAction.post.js", "applyTaskAction.post.json.ftl", "applyTaskAction.post.desc.xml", "getTaskFilter.get.desc.xml", "getTaskFilter.get.js", "queryTasks.get.js", "avmbrowse.get.desc.xml", "avmbrowse.get.html.ftl", "avmbrowse.get.js", "avmstores.get.desc.xml", "avmstores.get.html.ftl", "blogsearch.get.atom.400.ftl", "blogsearch.get.html.400.ftl", "blogsearch.get.desc.xml", "blogsearch.get.js", "categorysearch.get.atom.404.ftl", "blogsearch.get.html.ftl", "categorysearch.get.html.404.ftl", "categorysearch.get.js", "categorysearch.get.html.ftl", "categorysearch.get.desc.xml", "folder.get.desc.xml", "folder.get.html.ftl", "folder.get.js", "psDeptAll.get.js", "psDeptSingle.get.json.ftl", "psDeptSingle.get.js", "psPerson.get.json.ftl", "psUtil.js", "psPerson.get.js", "psAcademicDeptAll.get.desc.xml", "psAcademicDeptAll.get.json.ftl", "psAuthorizedApprover.get.desc.xml", "psDeptAll.get.json.ftl", "psAuthorizedApprover.get.js", "psAuthorizedApprover.get.json.ftl", "psDeptAll.get.desc.xml", "psDeptSingle.get.desc.xml", "psPerson.get.desc.xml", "ceeb.get.desc.xml", "ceeb.get.json.ftl", "getSlateId.get.desc.xml", "getSlateId.get.js", "materials.get.json.ftl", "materials.get.desc.xml", "getSlateId.get.json.ftl", "ceeb.get.js", "materials.get.js", "edit.get.html.ftl", "edit.get.js", "save.post.js", "save.post.json.ftl", "scans.get.desc.xml", "scans.get.js", "uploadfile.post.desc.xml", "uploadfile.post.json.ftl", "edit.get.desc.xml", "uploadfile.post.js", "scans.get.html.ftl", "save.post.desc.xml", "AFA_Main.post.desc.xml", "AFA_MainFileOnly.post.desc.xml", "AFA_MainFileOnly.post.js", "AFA_Main.post.js", "AFA_MainFileOnly.post.json.ftl", "AFA_Main.post.json.ftl", "paperFileUtil.get.desc.xml", "paperFileUtil.get.js", "paperFileUtil.get.html.ftl", "rsoprojectdetails.get.html.ftl", "rsoprojectdetails.get.js", "rsoprojectdetails.get.desc.xml", "roslateapplist.get.html.ftl", "roslateapplist.get.desc.xml", "roslateapplist.get.json.ftl", "roslateexists.get.html.ftl", "roslateexists.get.desc.xml", "roslateapplist.get.js", "roslateexists.get.js", "uofaDepartmentList.get.desc.xml", "uofaDepartmentList.get.js", "uofaDepartmentList.get.html.ftl", "uofaDepartmentName.get.desc.xml", "uofaDepartmentName.get.html.ftl", "uofaFacultyList.get.html.ftl", "uofaFacultyList.get.desc.xml", "uofaDepartmentName.get.js", "uofapersonid.get.desc.xml", "uofapersonidrest.get.html.ftl", "uofapersonidrest.get.desc.xml", "uofapersonid.get.html.ftl", "uofapersonid.get.js", "uofapersonidrest.get.js", "uappolCategoryHeirarchy.get.desc.xml", "uappolCategoryHeirarchy.get.json.ftl", "uappol-metadata-query.get.desc.xml", "uappol-metadata-query.get.js", "uappol-metadata-query.get.json.ftl", "uappolCategoryHeirarchy.get.js", "siteFileViewer.get.desc.xml", "siteFileViewerConfig.js", "siteFileViewer.get.html.ftl", "siteFileViewer.get.js", "publicSiteFileViewer.get.html.ftl", "publicSiteFileViewer.get.desc.xml", "publicSiteFileViewer.get.js", "cronJob.post.desc.xml", "cronJob.post.js", "cronJob.post.json.ftl", "studentupload.get.html.ftl", "generatereport.get.json.ftl", "generatereport.get.desc.xml", "approvethesis.post.js", "generatereport.get.js", "search-match-attach.get.js", "search-match-list.get.html.ftl", "search-match-result.get.html.ftl", "search-match-result.get.js", "search-match-list.get.js.old", "chs-agreements.get.js", "chs-agreements.get.html.ftl", "chs-upload.get.html.ftl", "chs-upload.get.js", "uamytasks.config.get.js", "chsStudentView.get.js", "chsStudentView.get.html.ftl", "foModel.xml", "uofaDocTypes.xml", "uofaDocTypes.json", "foModel.json", "tim-sops", "FandO", "cbsr", "nanofab", "support-documentation", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b" ], "public": 1, "adversary": "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": "6665315e25f9dd42a99e4f2f", "export_count": 1, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "msudosos", "id": "381696", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7132, "hostname": 3118, "URL": 4909, "email": 20, "FileHash-SHA256": 2144, "FileHash-MD5": 29, "FileHash-SHA1": 29 }, "indicator_count": 17381, "is_author": false, "is_subscribing": null, "subscriber_count": 66, "modified_text": "14 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64e1d5e06aa6207f78de", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:21.863000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 149, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "69bf64eccb5d39a90a3c391e", "name": "Spam \u201cBroken Seal\u201d DocuSign-themed Delivery w/Fileless Process Hollowing (Zeppelin/Bloat-A) by msudosos", "description": "", "modified": "2026-03-27T00:30:39.055000", "created": "2026-03-22T03:41:32.565000", "tags": [ "Zeppelin, Bloat-A, W32.Bloat-A, Zero-Day-Delivery, Protocol-Devi", "9698f46495ce9401c8bcaf9a2afe1598", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional)", "MD5: b47266fef17ad4b2e4ca6ee1d06c39a7 SHA-1: cb92796715c799d7e71", "Filename: b47266fef17ad4b2e4ca6ee1d06c39a7.virus File Type: Win3", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Link", "DocuSign-themed phishing lure Invalid X.509 seal (\u201cBroken Seal\u201d)" ], "references": [ "Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensures that the structurally invalid X.509 \"Broken Seal\" is only delivered via encrypted channels, while the gated Port 80 tier prevents the discovery of the underlying Zeppelin/Bloat-A redirection logic by non-human-interacted sessions.", "Imphash: 9698f46495ce9401c8bcaf9a2afe1598 | Imports (additional): GdipSetSmoothingMode, I_UuidCreate, RpcStringFreeW, UuidCreate, UuidToStringW, InternetCheckConnectionW | Resource: RT_MANIFEST (1, ENGLISH US, SHA-256 4bb79dcea0a901f7d9eac5aa05728ae92acb42e0cb22e5dd14134f4421a3d8df, XML, entropy 4.91)", "Observed hosting and routing telemetry indicates the delivery infrastructure is operating through AS209242 (Cloudflare London LLC), suggesting the actor is leveraging Cloudflare\u2019s transit layer for resilience and to reduce direct exposure of origin infrastructure.", "Research into the gogetlife.co telemetry confirms a dual-port obfuscation strategy designed to bypass multi-layer security indexing. Forensic HTTP scans identify a Port 80 \"Fail-Closed\" state, where standard web traffic is gated by a Cloudflare-managed 403 Forbidden challenge, effectively neutralizing automated crawlers. Conversely, Port 443 remains accessible, serving a WordPress-based interface backed by a freshly issued Google Trust Services certificate (Feb 4, 2026). This asymmetric configuration ensure", "Compilation / Toolchain Compiler: Microsoft Visual C++ 2017 Linker: Microsoft Linker 14.16.27032 IDE: Visual Studio 2017 (15.9) Classification: PEBIN TrID: Win64 EXE (32.2%) / Win32 DLL (20.1%) / Win16 NE (15.4%) PE Section Entropy (Suspicion): .data 7.36 \u2192 high (suggests packing/encryption), .reloc 6.66 \u2192 possible runtime modification, .text 6.01, .rdata 5.88, .rsrc 4.72 Imports (Capabilities): CreateRemoteThread, CreateThread, ExitProcess", "Broken Seal exploitation: The invalid X.509 seal appears engineered to exploit verification logic gaps, forcing fail-open behavior and allowing SEG bypass under certain configurations. Human-gated delivery posture: Cloudflare 403 challenges suggest the actor enforces human interaction before payload delivery, reducing automated discovery and sandbox analysis. Industrialized infrastructure: Correlation across thousands of domains and URLs indicates a highly automated, rotating delivery ecosystem.", "MITRE ATT&CK: Process Hollowing (T1055.012): Documentation on the RunPE injection method used by the payload to achieve a fileless state in RWX memory. RFC 5652 - Cryptographic Message Syntax (CMS): This standard defines the structure of the digital signatures that this campaign's \"Broken Seal\" exploit bypasses.", "As of Feb 13 (early AM) \u2014 Indicators of Compromise: 17K | Types: Email (30), FileHash-SHA256 (2,146), URL (8,070), Hostname (2,755), Domain (3,528), Other (1,110) | Geo: US (233), Canada (15), China (10), Japan (2), Spain (2), Other (13)", "Verification failure observed in automated verification handlers during sandbox replay.", "The payload (SHA256: dfff54...4af) achieves a fileless execution state via Process Hollowing (RunPE), injecting into RWX memory regions of legitimate system processes to evade disk-based EDR telemetry. Anti-analysis controls\u2014including Bochs artifact checks, geofencing logic, and direct CPU clock interrogation\u2014are implemented to validate a high-interaction user environment prior to execution.", "Multiple antivirus engines flagged the sample with generic heuristic names (e.g., Trojan:Win32/Vigorf.A, Win32:Malware-gen, Trojan.Generic), consistent with multi-engine heuristic detection on VirusTotal.", "Malicious sample (SHA256: fa8e2ddfe42e77a9771a7c4d6421c7a808cf4508f8cd6dc6f4cf8bd4e2ae7f8f) detected as TrojanDownloader:Win32/Tugspay.A with YARA hits for Win32_PUA_Domaiq, aPLib, PECompact_2xx and IDS alerts including TLS Handshake Failure + 403 Forbidden, contacting 36 domains (e.g., api.123mediaplayer.com, static.sslsecure1.com) and IPs such as 104.18.23.19 and 193.166.255.171.", "SHA256 3d10374b55a18a2dd90d35d28472600496c680a7efab4e772595f735cb062343 identified as Win.Malware.Vtflooder-9783271-0 / Trojan:Win32/Vflooder.B with UPX/Nrv2x packing YARA hits, IDS detections for Win32/Vflooder.B check-in and DOS behavior, and network C2 indicators including 172.66.0.227 and 34.54.88.138.", "SHA-256: fc1fedce1419d4e2009828aad8644deca78b4eeed176e5b009797e0eb0d7d3ff \u2014 Detected as Win.Malware.Vtflooder / Trojan:Win32/Vflooder; UPX-packed PE32 executable, with 812 IDS hits (including C2 checkin + HTTP EXE upload).", "nationalgrid.com \u2014 Whitelisted domain (US, AS13335 Cloudflare) with 500+ passive DNS entries, 692 URLs, 195 subdomains, and 2 malicious files hosted on IP 104.17.1.192, which is concerning given the infrastructure and trust level.", "eversource.com (IP: 159.108.5.46, ASN: AS2024) has 2 flagged malicious files within its infrastructure, despite being whitelisted. The domain hosts 95 subdomains and maintains an active SPF record, indicating potential security risks under an otherwise trusted facade.", "Whitelisted IP Address 204.79.197.212 Location United States ASN AS8068 microsoft corporation Nameservers ns4-205.azure-dns.info. , ns1-205.azure-dns.com. More WHOIS Registrar: MarkMonitor, Inc., Creation Date: Mar 26, 1996 Related Pulses OTX User-Created Pulses (50) Related Tags 2025 Related Tags 4328 , 5943 , 80211 , #supportsitewebsiteabuse #rootcertificatefailure #cryptographicf , The dynamics of the mudoSOSIntersectalign with sophisticated adv More Indicator Facts 982 malicious files communicat", "", "The AlienVault OTX report for flypdx.com documents 11 related tags, including ids detections and av detections, across 4 active AWS IP addresses (3.175.34.30\u2013.106). These indicators confirm the airport's network has been flagged for unauthorized activity, specifically pointing to a bridge between their web infrastructure and internal passenger tracking. The display of PII on aviation hardware during my June flight matches a known data-bleeding pattern where Personally Identifiable Information (PII) leaks fr" ], "public": 1, "adversary": "", "targeted_countries": [ "China", "United States of America", "Spain", "Japan", "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Legal, Financial, Healthcare, Government, Municipal, Real-Estate, Enterprise-Technology, Critical-In" ], "TLP": "green", "cloned_from": "698e93e1ab02db8c49e8c3ed", "export_count": 4, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Q.Vashti", "id": "337942", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 27572, "FileHash-SHA256": 46076, "FileHash-MD5": 42177, "FileHash-SHA1": 22874, "hostname": 33438, "URL": 74810, "SSLCertFingerprint": 21, "CVE": 7579, "email": 297, "FileHash-IMPHASH": 8, "CIDR": 26203, "JA3": 1 }, "indicator_count": 281056, "is_author": false, "is_subscribing": null, "subscriber_count": 152, "modified_text": "66 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "68f45023af873e8d6ac165b9", "name": "UAlberta Alfresco Databreach -> EPS Crimestoppers Alberta RCMP HR Files", "description": "University of Alberta DataBreach(es) -> Alfresco HR Files (included in this Pulse) - Reported. \nCompromise of Edmonton Police Services (EPS), Alberta RCMP (AB RCMP), CrimeStoppers Alberta - All organizations notified, and provided with identified problems (e.g. criminals), offered solutions (e.g. to address compromised infrastructure). Data 'on hand' and publicly available (e.g. in this pulse). Criminal activity ramping up for 2026. Reported by multiple parties no luck, no response.", "modified": "2026-01-03T01:55:41.491000", "created": "2025-10-19T02:42:43.079000", "tags": [ "entity", "EPS", "Alfresco", "UAlberta", "EdmontonPolice" ], "references": [ "https://www.virustotal.com/graph/embed/g8b17f086c8ca45188352d1d054fa3f8948f81bddd2114ea7b99864e585604e72?theme=dark", "https://en.fofa.info/result?qbase64=ZWRtb250b25wb2xpY2UuY2E%3D", "", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88", "https://www.virustotal.com/gui/collection/7774b0b7593e64e019df4e783911800bb322ec28a0f9eb3792fe6f75755f3b88/iocs" ], "public": 1, "adversary": "", "targeted_countries": [ "Canada" ], "malware_families": [], "attack_ids": [], "industries": [ "Government", "Education", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 3, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "URL": 743, "FileHash-MD5": 75, "FileHash-SHA1": 60, "FileHash-SHA256": 1364, "domain": 688, "hostname": 763 }, "indicator_count": 3693, "is_author": false, "is_subscribing": null, "subscriber_count": 130, "modified_text": "149 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "6665315e25f9dd42a99e4f2f", "name": "UAlberta Alfresco Management Software Abuse -> Admin/Backdoor Edmonton Police Services", "description": "Just pulled down what was in my employee profile (I don't work there).\nDiscovered after being directed to some management system (unknown at the time).\nPulled down and scanned: 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "modified": "2025-10-10T19:03:58.376000", "created": "2024-06-09T04:36:46.536000", "tags": [ "note", "home", "lucene paths", "json descriptor", "lucene path", "company home", "actividades", "pageuser", "sie knnen", "sie auf", "link klicken", "recente", "u kunt", "attivit", "possibile", "activits", "vous", "report", "web link", "cvs report", "link", "chs placement", "chs student", "placement", "team", "google form", "university", "alberta", "automation", "please", "following", "followers", "ihnen", "mitarbeitern", "mitarbeiter", "hello", "foreign visitor", "fvca", "human resource", "fvca assessment", "incomplete", "regards", "klik", "wachtwoord", "mijn profiel", "klik op", "hoogachtend", "alfresco", "bonjour", "cliquez sur", "nous", "pour ce", "mon profil", "changer", "invito", "caro", "fare", "password", "il mio", "cambia password", "per rifiutare", "cordiali saluti", "my profile", "change password", "konto", "sie erstellt", "passwort", "wir legen", "ihnen nahe", "passwort bei", "anmeldung zu", "ndern", "gehen sie", "mmm yyyy", "nome utente", "nombre", "contrasea", "para hacerlo", "mi perfil", "atentamente", "account", "alfresco share", "hola", "haga", "los datos", "y seleccione", "si desea", "click", "einladung von", "hallo", "sie eingeladen", "site", "klicken sie", "konto fr", "alfresco client", "kofax index", "inhaltselement", "zur site", "gren alfresco", "pledged gift", "office", "advancement", "datetime", "university vpn", "date", "shared", "support", "auxiliary", "process", "priority", "medium high", "pay action", "sincerely", "uofa ecm", "link um", "aufgaben stehen", "verfgung", "prioritt", "niedrig mittel", "hoch", "klicken", "aufgabe zu", "il seguente", "disponibile", "priorit", "bassa media", "alta", "clicca", "clicca su", "la tche", "tre rcupre", "basse moyenne", "leve", "cliquez", "cordialement", "prioriteit", "laag gemiddeld", "hoog", "la siguiente", "prioridad", "media alta", "saludos", "kb content", "links content", "content url", "download url", "webdav url", "ttulo", "descripcin", "ninguno", "ninguna", "creador", "creado", "modificador", "modificado", "tamao", "webdav", "titre", "aucun", "aucune", "modificateur", "modifi", "taille", "ko liens", "du contenu", "dossier du", "url webdav", "titolo", "nessuno", "nessuna", "creato", "modificato", "dimensioni", "kb link", "al contenuto", "cartella", "ingen", "beskrivelse", "tittel", "opprettet", "modifikator", "modifisert", "strrelse", "lenker for", "innhold mappe", "descrio", "nome", "nenhum", "nenhuma", "criador", "criado", "tamanho", "geen", "beschrijving", "titel", "maker", "gemaakt", "gewijzigd", "grootte", "contenturl", "downloadurl", "beschreibung", "url zum", "keiner", "keine", "ersteller", "erstellt", "bearbeiter", "gendert", "kb links", "download", "navigatebrowse", "pagesite", "readme file", "yesno", "user name", "main", "function", "log debug", "record", "sample rm", "import", "njson", "forms", "sites", "documenttype", "commonfolder", "error", "value", "jsonfile", "service", "false", "moving", "prop", "null", "bearer", "uappol", "uappol function", "contentid", "param", "id var", "call", "post request", "json", "config", "coveo", "uappol metadata", "content id", "and not", "loads", "update", "uploader", "inbox", "rnrn", "create", "contenteml", "inbox folder", "number", "normal", "textpart", "backup", "createchildren", "backupname", "childlist", "name", "content", "array", "write", "childname2", "childname3", "childname4", "reviewgroup", "groupsite", "starting", "started", "delete email", "command", "found", "create content", "resources", "unknown command", "globals", "var title", "rnrncopyright", "copyright", "csvtoarray", "regexp", "jsonstr", "daily", "review", "az09", "format", "hrsfilescanner", "hrs document", "fromscanner", "not type", "matches1", "employee id", "third", "tempfilename", "ldap", "version", "this", "file share", "folder", "trimlr", "namearr", "personid", "document name", "ales file", "scanned", "shared drive", "last", "document type", "document", "advising notes", "debug", "debugstr", "schedule", "descriptorpath", "web service", "inbound rule", "web services", "collaborator", "groupeveryone", "check", "index", "taskassignee", "taskenddate", "filename", "localisotime", "startdatetime", "timeperiod", "uofa edrms", "author", "descommonnode", "nomatch", "iddocumenttype", "siteid", "span", "path", "term", "core", "cap report", "template", "object", "cap mail", "dev testing", "application", "aps status", "cap generate", "monthly report", "extension", "alfresco locale", "september", "pm mdt", "school", "didx", "json response", "cap final", "rebcapiddict", "finalcapiddict", "aps process", "trigger", "chsdocument", "message", "func", "msgstr", "emailobj", "emailtemplate", "emailsubject", "sitepath", "chs docs", "studentfiles", "faculty", "true", "chssiteid", "type", "aspect", "chsdocs", "nodeidx", "find", "expired", "chs school", "defunc", "facultykey", "program", "spasite", "ldapperson", "parent name", "securitytype", "formsengg", "limit", "enggfilescanner", "stuccid", "csv file", "studdept", "supccid", "supdept", "cosupccid", "relocation", "fgsr", "records site", "fgsr doc", "department", "start fgsr", "department doc", "completion of", "oral hlth", "form", "application for", "report of", "admission", "master", "music", "unknown", "comp", "class", "leave", "supervisor", "currentline", "return", "studentid", "superccid", "revdate", "code", "apstaskproperty", "converttocsv", "aps guideline", "aps task", "newdata", "hyperlink", "certificate", "first", "info", "procid", "filecontentstr", "query sort", "create header", "person id", "subject title", "node", "studentccid", "yyyymmdd", "lookupjson", "propidx", "input date", "iso format", "folder level", "query", "duedate", "test java", "dailyschedule", "upload", "ro adm", "workflow", "offset", "adm workflow", "data length", "startindex", "json object", "aps group", "acs site", "user", "getgroupid", "am mst", "acsaps group", "user sync", "january", "start january", "february", "start february", "december", "start december", "march", "start march", "am mdt", "consumer march", "aps student", "april", "start april", "june", "start june", "pm mst", "ro backscan", "edrmsteam", "group", "group december", "aps ro", "copy file", "aps api", "maxfile", "creator", "rand", "hrsbs", "july", "august", "hrsbssyncccids", "zhrroleuserresp", "edrms", "ccids", "prefix", "createdirectory", "directory", "actionreason", "safefilename", "employeeclass", "carry", "csv data", "host", "bachelor", "college level", "mike", "propname", "maxitems", "currjson", "fvca status", "important", "prod", "manual data", "doctoratephd", "medicine", "nodename", "employeeccid", "managerccid", "employeeid", "workingtitle", "regtempdescr", "findkey", "email", "new document", "doctypelabel", "competitive bid", "bid exception", "pcm competitive", "and aspect", "competitive", "nodes", "bid update", "acommonfolder", "formspcm", "peoplesoft", "no data", "qaselectednode", "qaselected", "qanotselected", "qa folder", "preqa", "qa var", "documentcount", "passcount", "qadocument", "qa selected", "moved", "attempts", "accepted", "rm file", "plan", "rm filing", "min to", "rm system", "batch", "time limit", "rmcfg", "string", "already", "load", "valid", "graddate", "uathdep", "ccid", "title", "abstract", "embargo", "datestr", "searchresult", "alfresco afa", "admissions", "student case", "files", "and type", "institution", "inst", "json config", "institution not", "if file", "logger", "needle", "xmlstr", "staus", "document linkn", "getlogfile", "documentlist", "xml field", "not found", "addaspect", "move aspect", "duplicate file", "makes", "to max", "checks", "workflow name", "workflow link", "emplid", "due daten", "total afa", "not path", "afabundling", "change", "not aspect", "logs", "ephesoft", "document moved", "epehsoft", "xmlsourcenode", "batchsize", "filemappingpdf", "entry", "move file", "getcsvfile", "batchprocess", "logging", "completed", "document link", "groupn", "created date", "stdapl", "person", "workflow desc", "json file", "list", "lastmonth", "daily qa", "default", "qastartdate", "query language", "finished", "afa bundle", "transcriptarr", "lucene query", "qacounter", "rrfgroupname", "uaroemplid", "uaropriority", "uaroduedate", "documentlistarr", "uarmm", "profile", "courseauditform", "status", "jile", "searchmatchmove", "logfoldername", "backscanreview", "smfstr", "rosm", "converter", "shortxml", "failedcsvfolder", "xml file", "qaoperatorindex", "qaoperatorlabel", "script", "suresh", "aws promotion", "file", "tasks", "bundlingprop", "tasktype", "grps2", "uarotasktype", "comments", "test", "ro scripts", "xmlnode", "shortdescr", "xmlcont", "firstname", "orgid", "middlename", "lastname", "middle", "final", "script started", "to now", "received date", "first name", "receiveddatestr", "dateofbirthstr", "getdefination", "2005 aug", "dropbox", "foldercreate", "scan doc", "officiality", "search match", "running script", "materialextid", "studentref", "ceeb", "materialcode", "memo", "jsoncontent", "ro document", "paperfileutils", "afaconfig", "ro workflow", "paperfileconfig", "applicationjson", "formsrso", "targetfile", "property name", "pinames today", "addp", "science addp", "addp move", "ro code", "scifilescanner", "desconfnode", "grabnodeprop", "copy", "consumer", "initiators", "hiring", "consigno", "offer letter", "match", "apsmaster", "match2", "reappointment", "expiry date", "today", "finaldate", "task info", "psperson", "complete basic", "hiring info", "employee", "resultdata", "delegategroup", "delegate group", "verify", "bind", "aps appointment", "trevor report", "sfsussl", "drawdown", "refund", "reporttype", "var document", "shareurl", "newgroup", "parentgrp", "group created", "var logfile", "rule folder", "site running", "report on", "get site", "foldername", "create file", "reportlogslogs", "reportlogs", "ist site", "running report", "count", "tran", "var csvfile", "result length", "processid", "process id", "delimiters", "quoted", "standard", "starting name", "morechildren", "pdf var", "length", "newname", "fiscal", "docnamearr", "filenode", "calendar year", "versionhistory", "new doc", "web deployed", "var startdate", "startdate", "maxcount", "prevmonth", "monthcount", "application id", "delete", "get path", "if node", "search length", "arra y", "if csv", "version history", "graduate", "graduate folder", "children", "graduate file", "searchmatchdob", "career", "appl nbr", "jan04 now", "counter", "thesis", "runyear", "spring", "service log", "everything", "this determine", "thesis deposit", "archival", "problem", "filepath", "md import", "arraytocsv", "found document", "start", "food", "yumna", "start kofax", "kofax", "admin", "subject", "sample email", "execute", "koafx", "apasresponseid", "merge", "recruitment", "transcripts", "review request", "admindate", "requesteddate", "approveddate", "approvereject", "getemailbody", "taskid", "sendemail", "request status", "siteconsumer", "sitemanager", "eval", "acshost", "global env", "config file", "apsprod", "params", "alloc", "checkpath", "newpath", "adding entity", "surnamechar", "adding person", "jsonfunction", "text", "syntaxerror", "arraytoxml", "xml related", "change xml", "xmltoarray", "xmlutil", "common folder", "random2digit", "maxlimit", "jsonarchive", "very", "returns", "sitecontext", "arrcounter", "node id", "items", "array length", "therecord", "award sponsor", "rso project", "res0012345", "iso88591", "util function", "project id", "proposal id", "doc name", "newdocname", "prod url", "199899", "property", "typeprop", "barcode", "accepts", "parent", "xmlfilename", "siteconfigjson", "qabatchgrp", "signeddate", "ephdocumenttype", "json document", "qapercentage", "entity", "broker", "add error", "getexecutetime", "qaoperator", "retain title", "idnumber", "assocname", "metaarr", "fund report", "csvcontent", "input folder", "doc00c200004txg", "xmlfile", "node1", "node2", "540am", "240pm", "metadata", "var folder", "filter", "mappedobj", "09azaz", "conditionval", "foldercondition", "file name", "xmlfileobj", "alfresco prop", "setup error", "formatjson", "id property", "move", "getrandomnumber", "result", "newdoctype", "no title", "clioacs update", "clio", "patch", "system overview", "system", "overview", "purpose", "aims", "objectives", "prerequisites", "total", "expected effort", "domain", "urls", "dept param", "department name", "done", "submit form", "saving", "label", "input", "approvers", "information", "user group", "request", "group request", "users", "single family", "edmonton ab", "coverage", "common law", "step workflow", "care", "dental benefits", "direct", "web scripts", "get http", "documentation", "web script", "http method", "http", "apis", "development", "knowledge", "java", "empty argument", "e1234", "im system", "lookupentity", "configfilename", "namespace", "searchterm", "access", "jsonuser", "alfresco search", "page search", "expires", "signer", "reason", "utf8", "stripcharacter", "pull hiring", "getapsdbid", "save", "processsetidset", "saved", "returndata", "boolean", "start building", "varname", "fill", "time click", "initiated all", "submissions", "all submissions", "process landing", "page", "initiators all", "maps initiated", "post doc", "student term", "start form", "middle name", "email address", "retype", "cell", "phone no", "fellow", "secureorigin", "expand", "thank", "here", "please check", "aps list", "pang", "subset", "display", "args", "task", "username", "save form", "data need", "cdkey", "checkdict", "item", "column", "anchor", "multi", "tasks filter", "search", "trigger aps", "process api", "apsprocess", "authentication", "webscript", "getapsperson", "process info", "initsavestatus", "step0statusfail", "signer1", "signer2", "appointment", "taskjson", "groupapiaccess", "checkapiuser", "fgsrpr", "psaudit", "statusname", "unsuccessful1", "apptreappt", "emplobject", "caps aps", "cap epsb", "applicant", "form submitted", "board review", "form applicant", "school district", "start date", "cap application", "home help", "pdfa format", "larger", "upload file", "please click", "uofacap", "applications", "jstr", "processjson", "invalid url", "associate dean", "edmonton public", "october", "elk island", "reutrn false", "mapdoctypeurl", "doctype", "cap document", "doctypes", "doctypemap", "schools", "public schools", "foip", "edmonton area", "epsb", "capid", "server", "aps user", "groupcapadmin", "assignuser", "cap ea", "successfully", "please wait", "successfully ea", "apsservice", "apsserviceprod", "requireddate", "bibliography", "reb approval", "letter", "cprbls", "ahsrespect", "ahscon", "immformdocs", "picvsc", "whmis", "condissi", "hspnet", "conphoto", "conclin", "college", "health", "submission date", "effective date", "expiration date", "chs admin", "student view", "typekey", "placementdocs", "warning", "jobj", "abraniuk", "wendy", "terry harris", "directorhrsbs", "level", "holiday pay", "part time", "payroll", "salariedreg aux", "cheat", "paramname", "getallurlparams", "hrsbs config", "data dictionary", "field", "responsejson", "workflowid", "workflow id", "context", "event", "statusevent", "uaesign", "success", "permission", "progress report", "postdoctoral", "sorry", "deptjson", "fgsr student", "process status", "select", "currentuser", "reports", "student ccid", "populated", "invalid student", "supervisor ccid", "co supervisor", "due date", "freedom", "report process", "fgsr forms", "list fgsr", "report fgsr", "report sorry", "review process", "fgsr supervisor", "thesis programs", "programs", "please enter", "student id", "submit button", "var taskid", "var currentuser", "review sorry", "raheel", "added", "urlorigin", "need", "raheel var", "elmid", "commentkeyarr", "override", "menu", "colour bar", "mdphd", "absence", "completion", "mbameng", "mbamsc", "meng", "jason", "acs property", "available", "subdoctype", "test person", "test effective", "modelnodepath", "sitename", "metadatamap", "sitefile", "google addon", "gtagra", "gta gra", "zhreformengresp", "id otherwise", "university home", "indicate", "monday", "tuesday", "wednesday", "thursday", "friday", "na note", "services", "please contact", "documentname", "time", "docs", "documentlink", "employee ccid", "conflict", "task assigned", "ist coi", "declaration", "jsonobj3", "parse", "stringify", "grouplist", "json post", "taskfilter", "applies", "assigntogroup", "retrieves", "assignee", "queries", "expects", "uri args", "json containing", "applyfilter", "assignment", "avm folder", "avm store", "store id", "fullpath", "store", "storeid", "avm stores", "search term", "blog query", "category", "api call", "returns json", "cached data", "keylabel", "rest", "ldap query", "resultstr", "jsonoutput", "campusid", "jsonobj", "suresh joshee", "raheel bhojani", "desrochers", "first check", "set message", "materialkey", "acommonfolderid", "hasaccess", "siteconfig", "unprocesseddata", "savemetadata", "getcustomscript", "sitetitle", "error occured", "afa admission", "afas", "change log", "date name", "description", "ebeaton script", "tfrith", "afa main", "runasuser", "afas name", "afa paper", "file test", "utility enter", "does", "student", "bad query", "parameters", "add all", "or condition", "batch ids", "case files", "batchid", "afns", "agricultural", "anaesthes", "life", "environmental", "anaesthesiology", "uappol content", "deanaheed", "programyear", "province", "agreementtype", "safety manual", "mtis", "cree", "blackfoot", "nakota sioux", "iroquois", "dene", "treaties", "first nations", "next", "refresh", "site viewer", "facetkey", "sortparameter", "textjavascript", "public site", "viewer access", "acs cron", "job error", "alfrescos", "unauthorized", "enter", "bear tracks", "main department", "choose", "library", "john", "reviewer", "embargodate", "actiondate", "convocation", "graduation", "nodeid", "thesis status", "match result", "match list", "name dob", "view", "searchcriteria", "main function", "method", "chs upload", "stuln", "filetype", "stuid", "chs agreement", "health sciences", "recreation fomd", "dentistry fomd", "fomd", "therapy fomd", "consent for", "disclosure of", "alberta freedom", "protection", "privacy act", "alberta health", "chs form", "intake", "tasks dashlet", "doccd", "val2", "a my", "view error", "view warning", "keyword search", "refresh list" ], "references": [ "old-AlfrescoToolkit.conf", "AlfrescoToolkit.info", "AlfrescoToolkit.conf", "activities-email_es.ftl", "activities-email_ja.ftl", "activities-email_de.ftl", "activities-email_nl.ftl", "activities-email.ftl", "activities-email_it.ftl", "activities-email_fr.ftl", "CAP-notify-monthly-report.ftl", "chs-commentUpdate.ftl", "chs-studentUploadNotification.ftl", "chs-Invalid.ftl", "chs-studentExpireSoon.ftl", "chs-studentExpired.ftl", "following-email.html_it.ftl", "following-email.html_fr.ftl", "following-email.html_ja.ftl", "following-email.html_nl.ftl", "following-email_de.html.ftl", "following-email_fr.html.ftl", "following-email_ja.html.ftl", "following-email_it.html.ftl", "following-email_nl.html.ftl", "following-email.html.ftl", "following-email.html_de.ftl", "fvca-reminder-email.ftl", "fvca-corrections-email.ftl", "invite-email_nl.html.ftl", "invite-email-add-direct.html.ftl", "invite-email-add-direct.html_fr.ftl", "invite-email_fr.html.ftl", "invite-email_it.html.ftl", "invite-email-add-direct.html_es.ftl", "invite-email-add-direct.html_de.ftl", "invite-email_ja.html.ftl", "invite-email-add-direct.html_nl.ftl", "new-user-email.html.ftl", "new-user-email_de.html.ftl", "invite-email-add-direct.html_ja.ftl", "invite-email-moderated.html.ftl", "new-user-email_fr.html.ftl", "new-user-email_it.html.ftl", "new-user-email_ja.html.ftl", "new-user-email_es.html.ftl", "new-user-email_nl.html.ftl", "invite-email-add-direct.html_it.ftl", "new-user-email_nl.html", "invite-email.html_nl.ftl", "invite-email.ftl", "invite-email_es.html.ftl", "invite-email.html.ftl", "invite-email_de.html.ftl", "invite_user_email.ftl", "kofaxFailedEmailTemplate.ftl", "notify_user_email.ftl", "notify_nl.htm", "notify_user_email_es.html.ftl", "notify_user_email_de.html.ftl", "notify_user_email_ooa_failed.ftl", "notify_user_email.html.ftl", "notify_user_email_it.html.ftl", "notify_user_email_e-transcript_failed.ftl", "notify_user_email_ja.html.ftl", "notify_user_email_fr.html.ftl", "notify_user_email_nl.html.ftl", "OOA-notify-email-template.ftl", "ADV-notify-terms-types.ftl", "appt-final-reminder.ftl", "appt-halfway-reminder.ftl", "sfs-wf-email.html.ftl", "sfs-wf-completed-email.html.ftl", "payActionDecision.html.ftl", "departmentAdhocTask.html.ftl", "wf-email.html_de.ftl", "wf-email.html.ftl", "wf-email_it.html.ftl", "wf-email_fr.html.ftl", "wf-email_nl.html.ftl", "wf-email_ja.html.ftl", "wf-email.html_fr.ftl", "wf-email.html_nl.ftl", "wf-email_es.html.ftl", "wf-email.html_ja.ftl", "wf-email.html_it.ftl", "wf-email_de.html.ftl", "wf-email.html_es.ftl", "emailbody_textplain_alfresco.ftl", "emailbody_textplain_alfresco_es.ftl", "emailbody_textplain_alfresco_fr.ftl", "emailbody_textplain_alfresco_it.ftl", "emailbody_textplain_alfresco_ja.ftl", "emailbody_textplain_alfresco_nb.ftl", "emailbody_textplain_alfresco_pt_BR.ftl", "emailbody_textplain_alfresco_nl.ftl", "emailbody_textplain_alfresco_ru.ftl", "emailbody_textplain_alfresco_zh_CN.ftl", "emailbody_textplain_share.ftl", "emailbody_textplain_share_de.ftl", "emailbody_textplain_share_es.ftl", "emailbody_textplain_share_it.ftl", "emailbody_textplain_share_ja.ftl", "emailbody_textplain_share_nb.ftl", "emailbody_textplain_share_nl.ftl", "emailbody_textplain_share_ru.ftl", "emailbody-alfresco-textplain.ftl", "emailbody-share-textplain.ftl", "emailbody_textplain_alfresco_de.ftl", "emailbody_textplain_share_zh_CN.ftl", "emailbody_textplain_share_fr.ftl", "emailbody_textplain_share_pt_BR.ftl", "uofa-pc-model.xml", "uofa-pllc-model.xml", "uofa-science-model.xml", "uofa-rso-model.xml", "uofa-set-model.xml", "uofa-sfs-model.xml", "uofa-slate-model.xml", "uofa-uappol-model.xml", "advext-model.xml", "assocModel.xml", "adv-model.xml", "cbsr-model.xml", "dynamicSecurityMarksModel", "ephesoft-educational.xml", "facopr-model.xml", "fgsr-model.xml", "faculty-model.xml", "psAudit-model.xml", "FVCA.xml", "roDocProcessing-model.xml", "ro-model.xml", "fgsr-thesis-deposit.xml", "security-group-model.xml", "ua-audit-generic-model.xml", "ua-dummy.xml", "calendar-year-model.xml", "ua-error-model.xml", "uafgsrsup-model.xml", "uaqa-model.xml", "transcript-model.xml", "uAlbertaWorkflowGeneral.xml", "uarmm-supplement-scanning.xml", "uarm-rma-filing-model.xml", "ua-search-model.xml", "ro-search-match.xml", "uatraining.xml", "uofa-ales-model.xml", "uofa-arts-model.xml", "uofa-aps-model.xml", "uofa-base-model.xml", "uawfh-model.xml", "uofa-augustana-model.xml", "uofa-business-model.xml", "uarmTempModel.xml", "uofa-cap-model.xml", "uofa-chs-model.xml", "uofa-chs-agreements-model.xml", "uofa-common-model.xml", "uofa-education-model.xml", "tamis-model.xml", "uofa-engg-coop-model.xml", "uofa-engg-model.xml", "uofa-fo-model.xml", "uofa-extension-model.xml", "uofa-esign-model.xml", "uofa-hrsbs-model.xml", "uofa-law-model.xml", "uofa-caps-model.xml", "uofa-hrs-model.xml", "uofa-native-studies-model.xml", "uofa-pllc-model.json", "uofa-rso-model.json", "uofa-pc-model.json", "uofa-native-studies-model.json", "uofa-slate-model.json", "uofa-uappol-model.json", "uofa-science-model.json", "uofa-workflowGeneral.json", "uofa-sfs-model.json", "adv-model.json", "advext-model.json", "assocModel.json", "calendar-year-model.json", "facopr-model.json", "cbsr-model.json", "ephesoft-educational.json", "faculty-model.json", "faculty-model.xml.json", "rma-model.json", "fgsr-model.json", "FVCA.json", "psAudit-model.json", "ro-aug-model.json", "ro-search-match.json", "tamis-model.json", "security-group-model.json", "fgsr-thesis-deposit.json", "transcript-model.json", "ro-model.json", "ua-audit-generic-model.json", "uafgsrsup-model.json", "uaqa-model.json", "uarmm-supplement-scanning.json", "uAlbertaWorkflowGeneral.json", "ua-error-model.json", "uofa-ales-model.json", "ua-search-model.json", "uarmTempModel.json", "uofa-aps-model.json", "uawfh-model.json", "uofa-arts-model.json", "uofa-cap-model.json", "uofa-chs-agreements-model.json", "uofa-augustana-model.json", "uofa-base-model.json", "uofa-chs-model.json", "uofa-engg-coop-model.json", "uofa-common-model.json", "uofa-engg-model.json", "uofa-extension-model.json", "uofa-hrsbs-model.json", "uofa-fo-model.json", "uofa-education-model.json", "uofa-law-model.json", "uofa-hrs-model.json", "uofa-esign-model.json", "uofa-business-model.json", "faculty-of-science-site.json", "FandO-Organizations.json", "FandO-Programs.json", "fgsr-awards.json", "fgsr-category-list.json", "fgsr-exam-list.json", "fgsr-official-list.json", "fgsr-programOfStudy.json", "fgsr-site.json", "fo-emergency-response-manual.json", "graduate-student-records-site.json", "fo-site.json", "fo-utilities.json", "hrs-benefits.json", "hrsbs-action-reasons.json", "graduate-student-records-v2-site.json", "hrsbs-doc-list.json", "hrsbs-file-structure.json", "hrsbs-owner-details.json", "hrsbs-functionalroles.json", "hrsbs-function-module.json", "hrsbs-review-month.json", "hrsbs-security-class.json", "hrsbs-site.json", "hrs-employeeApprovedDeductions.json", "hrs-bulkId.json", "hrsbs-review-cycle.json", "hrs-employmentFinancial.json", "hrs-personalInformation.json", "hrs-pension.json", "hrs-security-list.json", "hrs-leaves.json", "Institutions.json", "ist-site.json", "hrs-site.json", "my-site-site.json", "law-security-list.json", "native-studies-doc-list.json", "fgsr-credential-list.json", "law-doc-list.json", "native-studies-security-list.json", "office-of-advancement-record-types.json", "office-of-advancement-site.json", "pcm-category.json", "pllc-doc-list.json", "ro-academic-pre-pro-programs.json", "pllc-security-list.json", "ro-acad-group.json", "ro-admitType.json", "ro-applicant-type.json", "ro-campusSolutionsTerm.json", "hrsbs-employee-class.json", "pllc-site.json", "ro-indigenous-type.json", "ro-doctypes.json", "pcm-site.json", "ro-official.json", "ro-org-desc.json", "ro-related-record-types.json", "ro-relationship-to-institution.json", "ro-search-match-status.json", "ro-authenticity.json", "ro-slate-folio-material-non-school-scope.json", "ro-slate-institution-material.json", "ro-slate-folio-material-school-scope.json", "ro-method-receipt.json", "ro-slate-institutions.json", "ro-test-id.json", "rso-accounts-receivable-accounts-payable-doc-type.json", "rso-agreements-doc-category.json", "rso-bulk-scan-doc-type.json", "rso-cfi-purchasing-doc-type.json", "rso-cfi-financials-doc-type.json", "rso-financial-reconciliation-doc-type.json", "rso-financial-reporting-doc-type.json", "rso-financials-doc-type.json", "rso-mask.json", "rso-site.json", "rso-sponsor-names.json", "science-doc-list.json", "science-security-list.json", "school-of-business-site.json", "sfs-ussl-report-status.json", "staff-training-site.json", "student-financial-services-doc-list.json", "student-financial-services-site.json", "student-records-bulk-load-testing-site.json", "student-records-training-site.json", "student-records-site.json", "student-transcripts-site.json", "rso-forms-form-type.json", "support-documentation-site.json", "test-site-site.json", "uappol-category-heirarchy.json", "uappol-type.json", "uappol-site.json", "uoda-faculties.json", "academic-department.json", "adv-correspondence-type.json", "uoda-departments.json", "advsearch.json", "ales-security-list.json", "ales-doc-list.json", "arts-doc-list.json", "arts-security-list.json", "augustana-security-list.json", "augustana-site.json", "augustana-legacy-transcript-doc-list.json", "rso-activation-report-doc-type.json", "business-doc-list.json", "business-security-list.json", "bulkload-testing-site.json", "cap-site.json", "caps-school-board-list.json", "cbsrsite-site.json", "cbsrsite-sopTypes.json", "cbsr-study.json", "cbsr-worksheetType.json", "augustana-doc-list.json", "chs-ag-type.json", "chs-agreements-site.json", "chs-campus-list.json", "chs-degProgram-list.json", "chs-emailNotification.json", "chs-document-status.json", "chs-faculty-list.json", "chs-programYear-list.json", "chs-program-list.json", "canada-provinces-list.json", "demo-site-site.json", "education-doc-list.json", "department.json", "education-security-list.json", "chs-stuEmailNotification.json", "college-of-health-sciences-site.json", "chs-provinces-list.json", "engineering-coop-doc-list.json", "engineering-coop-security-list.json", "engineering-co-op-site.json", "engineering-doc-list.json", "extension-doc-list.json", "extension-security-list.json", "facopr-planTypes.json", "facopr-supportinDocField.json", "faculty-of-ales-site.json", "engineering-security-list.json", "faculty-of-education-site.json", "faculty-of-extension-site.json", "faculty-of-native-studies-site.json", "faculty-of-law-site.json", "faculty-of-arts-site.json", "faculty-of-engineering-site.json", "my_docs_inline.ftl", "my_docs.ftl", "my_spaces.ftl", "recent_docs.ftl", "translatable.ftl", "readme.ftl", "show_audit.ftl", "general_example.ftl", "my_summary.ftl", "doc_info.ftl", "localizable.ftl", "recordsCustomModel.xml", "imapConfig.json", "rm_event_config.json", "rmScriptThrowError.js", "report_rmr_transferReport.html.ftl", "report_rmr_destructionReport.html.ftl", "report_rmr_holdReport.html.ftl", "notify-records-due-for-review-email.ftl", "record-rejected-email.ftl", "record-superseded-email.ftl", "onCreate_supersedes.js", "rma_isClosed.js", "PaperFileconfig.json", "MyTasks-config.json", "AFAconfig.json", "roDocumentTypes.json", "uappol-upload-rule.js", "uappolCreateFolderRule.js", "uappolCreateFolder.js", "uappol-api.js", "uappol-functions.js", "command-utils.js", "backup and log.js", "backup.js", "example test script.js", "test return value.js", "start-pooled-review-workflow.js", "command-processor.js", "command-search.js", "alfresco docs.js", "append copyright.js", "createDepartmentJSON.js", "hrsDaily.js", "hrsFolderCreateSchedule.js", "hrsScanned.js", "hrsCreateFolder.js", "hrsFolderCreateRule.js", "hrsFileShareFolder.js", "alesCreateFolderRestricted.js", "alesCreateFolderSchedule.js", "alesBulkShareFolder.js", "alesFileScanned.js", "alesCreateFolder.js", "alesDaily.js", "alesFileShareFolder.js", "alesCreateFolderConfidential.js", "alesCreateAdvisingNotes.js", "alesFolderCreateSchedule.js", "deployWebServiceDescriptor.js", "taskReportCSV-Appointment-prod.js", "artsFileScanned.js", "artsCreateFolderRule.js", "artsCreateFolder.js", "artsCreateFolderRestricted.js", "augCreateFolderRestricted.js", "augCreateFolder.js", "businessCreateFolderRule.js", "businessCreateFolder.js", "businessCreateFolderSchedule.js", "businessBulkShareFolder.js", "businessFileShareFolder.js", "businessCreateFolderRestricted.js", "businessDaily.js", "businessCreateAdvisingNotes.js", "businessFileScanned.js", "CAPSendMonthlyReportEmail.js", "CAPGenerateMonthlyReport.js", "CapFinalReportSubmit.js", "chsCreateFolderRule.js", "chsEmailOnUpdateComment.js", "chsReport.js", "EmailNotifCHSStudent.js", "SetExpiryDate.js", "chsCreateFolder.js", "chsFacultyReport.js", "chsAgreementCreateFolderRule.js", "chsAgreementCreateFolder.js", "scheduleJobTest.js", "every52MinPastHour.js", "every46MinPastHourBetween4PM12PM.js", "every57MinPastHour.js", "every47MinPastHourBetween4PM12PM.js", "everyDay4H30MinAM.js", "everyDay7H45MinAM.js", "every10MinStartingAt5MinPastHour.js", "every38MinPastHourBetween4PM12PM.js", "every20MinStartingAt15MinPastHour.js", "everyDay2H05MinAM.js", "every2MinStartingAt1MinPastHour.js", "everyDay1H05MinAM.js", "everyDay12H30MinAM.js", "everyDay7H30MinPM.js", "every30MinStartingAt19MinPastHour.js", "every30MinStartingAt11MinPastHour.js", "everyDay2H35MinAM.js", "every30MinStartingAt26MinPastHour.js", "every16MinPastHour.js", "everyDay1H45MinAM.js", "everyDay2H45MinAM.js", "every29MinPastHour.js", "every22MinPastHour.js", "everyDay11H30MinPM.js", "educationCreateFolderRule.js", "educationCreateFolder.js", "educationCreateAdvisingNotes.js", "enggCoopCreateFolderRestricted.js", "enggCoopCreateFolderRule.js", "enggCoopBulkUpload.js", "enggCreateFolderRule.js", "enggCreateFolderRestricted.js", "enggCreateFolder.js", "engineeringCreateAdvisingNotes.js", "enggCoopCreateFolder.js", "enggFileScanned.js", "enggCoopFileScanned.js", "extensionFileScanned.js", "extensionCreateFolder.js", "extensionCreateFolderRule.js", "fgsrCreateGuidelineAPSProcessFromCSV.js", "fgsrDocRestructure.js", "fgsrMigrationScript.js", "fgsrDocRelocation.js", "fgsrCreateFolderFromCSV.js", "guideline-reports.js", "fgsrMigrationScript-withTerminationLogic.js", "modfiyOrUpdatePropertyfromCSV.js", "fgsr-case-file-report.js", "fgsrCreateAPSProcessFromFolder.js", "fgsrCreateFolder.js", "fgsrCopyMetadataToFolderLevel.js", "fgsrCreateAPSProcessFromCSV.js", "foCreateFolder.js", "foCreateFolderRule.js", "Script1.js", "Script2.js", "scheduleRunEvery2-10PM.js", "scheduleRunEvery5PMTo10PM.js", "scheduleRunEvery30Minutes.js", "scheduleRunEvery60Minutes.js", "scheduleRunEveryday3PMto11PM.js", "scheduleRunEveryday12AMto6AM.js", "scheduleRunEvery20Minutes.js", "scheduleRunEvery2AM.js", "acsToApsUserUpdate.js", "2024-01-13-log.txt", "2024-01-15-log.txt", "2024-01-20-log.txt", "2024-01-21-log.txt", "2024-01-22-log.txt", "2024-01-23-log.txt", "2024-02-04-log.txt", "2024-02-05-log.txt", "2024-02-06-log.txt", "2024-02-07-log.txt", "2024-02-08-log.txt", "2024-01-14-log.txt", "2024-01-18-log.txt", "2024-01-11-log.txt", "2024-01-16-log.txt", "2024-01-19-log.txt", "2024-01-26-log.txt", "2024-01-28-log.txt", "2024-01-30-log.txt", "2024-01-12-log.txt", "2024-01-29-log.txt", "2024-01-27-log.txt", "2024-01-31-log.txt", "2024-01-24-log.txt", "2024-02-09-log.txt", "2024-02-02-log.txt", "2024-01-09-log.txt", "2024-02-03-log.txt", "2024-01-05-log.txt", "2024-01-06-log.txt", "2024-01-04-log.txt", "2024-02-01-log.txt", "2024-01-07-log.txt", "2024-01-08-log.txt", "2024-02-10-log.txt", "2024-02-11-log.txt", "2024-02-12-log.txt", "2024-02-13-log.txt", "2023-12-31-log.txt", "2024-02-15-log.txt", "2024-02-16-log.txt", "2024-02-14-log.txt", "2024-02-18-log.txt", "2024-02-20-log.txt", "2024-01-17-log.txt", "2024-02-19-log.txt", "2024-01-10-log.txt", "2024-02-23-log.txt", "2024-02-25-log.txt", "2024-02-21-log.txt", "2024-01-25-log.txt", "2024-02-28-log.txt", "2024-02-22-log.txt", "2024-02-29-log.txt", "2024-03-02-log.txt", "2024-03-03-log.txt", "2024-02-26-log.txt", "2024-03-04-log.txt", "2024-03-06-log.txt", "2024-03-07-log.txt", "2024-03-05-log.txt", "2024-03-08-log.txt", "2024-03-09-log.txt", "2024-03-11-log.txt", "2024-03-10-log.txt", "2024-03-12-log.txt", "2024-03-13-log.txt", "2024-03-14-log.txt", "2024-03-15-log.txt", "2024-03-16-log.txt", "2024-03-17-log.txt", "2024-03-18-log.txt", "2024-03-20-log.txt", "2024-03-21-log.txt", "2024-03-22-log.txt", "2024-03-19-log.txt", "2024-03-23-log.txt", "2024-03-01-log.txt", "2024-03-26-log.txt", "2024-03-25-log.txt", "2024-03-28-log.txt", "2024-03-29-log.txt", "2024-03-27-log.txt", "2024-03-24-log.txt", "2024-03-30-log.txt", "2024-04-02-log.txt", "2024-04-03-log.txt", "2024-03-31-log.txt", "2024-04-05-log.txt", "2024-04-06-log.txt", "2024-04-07-log.txt", "2024-04-08-log.txt", "2024-04-09-log.txt", "2024-04-04-log.txt", "2024-04-11-log.txt", "2024-04-12-log.txt", "2024-04-13-log.txt", "2024-02-17-log.txt", "2024-04-01-log.txt", "2024-04-16-log.txt", "2024-04-15-log.txt", "2024-04-10-log.txt", "2024-04-17-log.txt", "2024-02-24-log.txt", "2024-04-14-log.txt", "2024-04-19-log.txt", "2024-04-21-log.txt", "2024-04-22-log.txt", "2024-04-23-log.txt", "2024-04-24-log.txt", "2024-04-26-log.txt", "2024-04-25-log.txt", "2024-04-29-log.txt", "2024-04-30-log.txt", "2024-05-01-log.txt", "2024-05-02-log.txt", "2024-05-03-log.txt", "2024-05-04-log.txt", "2024-05-05-log.txt", "2024-05-06-log.txt", "2024-04-28-log.txt", "2024-05-07-log.txt", "2024-04-18-log.txt", "2024-05-08-log.txt", "2024-05-09-log.txt", "2024-05-10-log.txt", "2024-05-12-log.txt", "2024-05-14-log.txt", "2024-05-11-log.txt", "2024-05-16-log.txt", "2024-04-27-log.txt", "2024-05-17-log.txt", "2024-05-15-log.txt", "2024-05-18-log.txt", "2024-05-20-log.txt", "2024-05-21-log.txt", "2024-05-19-log.txt", "2024-05-22-log.txt", "2024-05-23-log.txt", "2024-05-25-log.txt", "2024-05-24-log.txt", "2024-05-26-log.txt", "2024-05-27-log.txt", "2024-05-28-log.txt", "2024-05-29-log.txt", "2024-05-30-log.txt", "2024-06-02-log.txt", "2024-05-13-log.txt", "2024-06-01-log.txt", "2024-05-31-log.txt", "2024-04-20-log.txt", "2024-06-03-log.txt", "2024-06-04-log.txt", "2024-06-05-log.txt", "2023-12-30-log.txt", "2023-12-01-log.txt", "2024-02-27-log.txt", "2023-12-29-log.txt", "gtaGraProcessToCSV.js", "gtaGraProcessToCSV-2AM.js", "hrs-benefit-report.js", "westCanDocumentMove.js", "hrsbsReviewCycleReport.js", "hrsbsCreateFolderRule.js", "HRSBS-SyncCCIDs.js", "hrsbsCreateFolder.js", "FVCA-data-import.js", "FVCA-manual-property-update.js", "istPerformanceReviewCreateFolder.js", "lawCreateFolderRestricted.js", "lawFileScanned.js", "lawCreateFolder.js", "lawCreateFolderRule.js", "nativeStudiesCreateFolderRestricted.js", "nsFolderCreateSchedule.js", "nativeStudiesCreateFolder.js", "nativeStudiesCreateFolderRule.js", "ADV-notify-type-mapping.json", "OOA-notify-email.js", "ADV-notify-terms-types.js", "pcm-grab-competitive-noderefs.js", "pcm-update-competitive-noderefs.js", "pcmCreateFolder.js", "psUpdateAlfrescoDepartment.js", "pllcCreateFolder.js", "qaProcess.js", "qaRelease.js", "rmOOABackgroundInformationFiling.js", "rmFilingDoc.js", "rmSearchmatchNomatchFiling.js", "rmFilingConfig.json", "thesisDestructionReport.js", "rmThesis.js", "add_document_type_ro.js", "updateSearchMatchStatus.js", "searchmatchFullDob.js", "createROReconciliationReports.js", "eTranscriptInstList.js", "folder-create-ro.js", "augTranscript.js", "addTimeStamp.js", "missingDocumentList-csv.js", "roAddAspectAndMoveAFA.js", "myTaskDownload.js", "roAddAspectAndMoveTranscript.js", "roAddBundlingAspect.js", "roAddSearchMatchAspect.js", "roCopyEphesoftMetadataXML.js", "roBatchScript.js", "addSearchMatchDocumentType.js", "roCreateEducationalCSV.js", "roCopyOlderScannedDocument.js", "roDocumentListAPLSTD.js", "roCopyOlderScannedDocumentAdHoc.js", "roEtranscriptReport.js", "roDailyQA.js", "roEtranscriptsBundleTest.js", "roFolderCreateLDAPLookup_no_notificatiion.js", "roFolderCreateLDAPLookup.js", "roEtranscriptsBundle.js", "roAddComment.js", "roCopyEphesoftMetadataScanned.js", "roMoveCompleted.js", "roMoveCompletedBackScan.js", "roMoveCompletedSearchMatch.js", "roEtranscriptPDFConverter.js", "roScanningMetadata.js", "roScript1.js", "RORoutingWorkflowUtil.js", "roScript3.js", "roScript2.js", "roScanningMetadataBackScan.js", "roScript7.js", "roScript6.js", "roScript9.js", "roScript1BackScan.js", "roSearchMatchNoMatchReport.js", "roSearchMatchQuery.js", "RONotification.js", "roSlateDocumentExport.js", "roTagAndFileRenderedPDFs.js", "roScript4.js", "roScript5.js", "roScript8.js", "createSlateFolioMaterialDropdown.js", "createSlateApplicationsCSV.js", "LaunchWorkflowUtils.js", "PaperFileUtils.js", "GenerateSponsornamesAndPinames.js", "rsoCreateFolder.js", "sciCreateFolderConfidential.js", "sciCreateFolderPublic.js", "sciCreateFolder.js", "sciCreateFolderRestricted.js", "scienceASDocumentImport.js", "sciFileADDPFileTypes.js", "sciFileShareFolder.js", "sciFileScanned.js", "sciBulkShareFolder.js", "copy-signed-offer-letter.js", "dept-config.js", "reappointment-generate-schedule.js", "reappointment-reminder-schedule.js", "reappointment-generate-process.js", "manual-generate-script.js", "reappointment-reminder-process.js", "reminder-email-util.js", "reappointment-tracking-schedule.js", "reappointment-tracking-process.js", "appointment-report.js", "appointment-report-schedule.js", "manual-tracking-script.js", "sfsCreateFolder.js", "sfsWorkflowStatus.js", "security-group-user.js", "createReportPermissionsFoldersInASite.js", "siteMembersReport.js", "createReportRecursiveGroupsAndUsersInASite.js", "search-responses.js", "advChangeDocumentType.js", "addFolderMetadata.js", "advChangeDocumentType_confidential.js", "consignOInitiatorOfferLetterChange.js", "advChangeDocumentType_background.js", "transcriptResponse.js", "change-fgsr-pdf-file-name-with-date.js", "copy-fgsr-to-graduate-students-records.js", "ADVDonationCalendarToFiscal.js", "document-query.js", "deletingCompletingWorkflow.js", "eTranscriptTemp.js", "eTranscript-bundled-02-jan.js", "eTranscriptVersionModifierFix.js", "fixCheckout.js", "removeDonationGrp.js", "eTranscriptVersioningFix.js", "move-fgsr-folder.js", "search-match-dob-add.js", "thesisDepositArchival.js", "moveThesesForTransfer.js", "eraReportGeneration.js", "kofaxMetadataMerge.js", "kofaxMetadataMergeMissing.js", "generic2min.js", "kofaxSendEmail.js", "PeopleSoft-eTranscript-XML-PDF.js", "startBenefitWorkflow.js", "peoplesoftMetadataMergeMissing.js", "securityWorkflowUtil.js", "startPayActionWorkflow.js", "startDepartmentAdhocApprovalWorkflow.js", "convertTranscript.js", "CreateTranscriptUserMemberships.js", "startTwoStepWorkflow.js", "fix_employee_names.js", "env.js", "folderCreateUtil.js", "folderCreateUtilAA.js", "generalSchedule.js", "JSON.js", "xmlUtil.js", "addPersonAspect.js", "addTimeStampRandomFileName.js", "archiveDocument.js", "luceneUtil.js", "util.js", "archivedItems.js", "getProjectDetails.js", "ADVChangeAuthor.js", "ADVcalendarToFiscal.js", "symplexUtils.js", "advBatchProcessing.js", "advChangeDocumentName.js", "ADVEphesoftMove.js", "advCreateFolderScheduled.js", "advErrorMessageReset.js", "advMetadataUpdate.js", "advMoveToFoldersScheduled.js", "ADVendFundReportFiling.js", "advReconcilliation.js", "ADVmoveRecordsToPreQA.js", "advScanningMetadata.js", "advScript2.js", "advScript3.js", "advScript4.js", "advScript1.js", "advScript5.js", "advScriptDaily.js", "advScriptMonthly.js", "advScriptKofax.js", "ADVSiteContext.js", "advMoveToFolder.js", "deleteEphesoftDoc.js", "advUtils.js", "folderCreateADV.js", "advScriptDaily30minFreq.js", "jsonUtils.js", "advScanning.js", "folderCreateDocumentADV.js", "moveToFolders.js", "symplexMetadataUpdate.js", "OOA_SOT_Name_change.js", "moveToFoldersRetainTitle.js", "advScriptWeekly.js", "symplexMoveToFolder.js", "clioToAcsDocUpdate.js", "ClioUpdateScheduledJob.js", "smartFoldersExample.json", "system-overview.html", "businessDocSetup.json", "uappolDocSetup.json", "businessConfig.json", "augConfig.json", "augDocSetup.json", "lawConfig.json", "uappolConfig.json", "UAlbertaSettings.json", "hrsbsDocSetup.json", "advConfig.json", "hrsbsConfig.json", "hrsConfig.json", "hrsDocSetup.json", "advSimplexMapping.json", "advDocSetup.json", "artsDocSetup.json", "alesConfig.json", "alesDocSetup.json", "archiveFolder.json", "artsConfig.json", "advScanningMapping.json", "collegeOfHealthSciencesConfig.json", "chsAgreementsConfig.json", "dropboxCommonAspects.json", "collegeOfHealthSciencesDocSetup.json", "chsAgreementsDocSetup.json", "educationConfig.json", "extensionConfig.json", "fgsrv2DocSetup.json", "foConfig.json", "foDocSetup.json", "educationDocSetup.json", "lawDocSetup.json", "nativeStudiesDocSetup.json", "pllcConfig.json", "pllcDocSetup.json", "roConfig.json", "fgsrv2Config.json", "rsoConfig.json", "rsoDocSetup.json", "sciConfig.json", "eTranscriptConfig.json", "sciDocSetup.json", "roDocSetup.json", "sfsDocSetup.json", "UAlbertaSettings.conf", "student-recordsConfig.json", "securityWorkflowSetting.json", "thesisDepositConfig.json", "globalHeader.html.ftl", "webFormDialog.html.ftl", "alfrescoUserGroupRequest.ftl", "pensionBenefit.html.ftl", "pinames.json", "sponsornames.json", "searchPageConfig.json", "pcmDocSetup.json", "pcmConfig.json", "qaConfig.json", "apsAppConfig.json", "fgsrCreateApsFromCSV.json", "fgsrCopyMetadata.json", "enggCoopDocSetup.json", "enggDocSetup.json", "enggConfig.json", "enggCoopConfig.json", "CapApsConfig.json", "extensionDocSetup.json", "readme.html", "readme_de.html", "readme_ja.html", "readme_fr.html", "advEndowmentName.get.desc.xml", "advEndowmentName.get.json.ftl", "advEndowmentName.get.js", "advEntityName.get.desc.xml", "advEntityName.get.js", "advEntityName.get.html.ftl", "search.get.desc.xml", "search.get.js", "search.get.html.ftl", "changeInitiatorAppt.put.desc.xml", "eSignatureStatusHistory.get.html.ftl", "changeInitiatorAppt.put.json.ftl", "eSignatureStatusHistory.get.desc.xml", "appointmentSubmit.get.js", "processIdProps.get.desc.xml", "changeInitiatorAppt.put.js", "processIdProps.get.json.ftl", "processIdProps.get.js", "appointmentLandingPage.get.desc.xml", "appointmentLandingPage.get.js", "appointmentLandingPage.get.html.ftl", "appointmentStart.get.desc.xml", "appointmentStart.get.html.ftl", "appointmentStart.get.js", "appointmentStartTest.get.desc.xml", "appointmentStartTest.get.js", "appointmentStartTest.get.html.ftl", "appointmentSubmit.get.desc.xml", "appointmentSubmit.get.html.ftl", "eSignatureStatusHistory.get.js", "apsApplicationList.get.desc.xml", "apsApplicationList.get.html.ftl", "assignuser.put.js", "assignuser.put.json.ftl", "claimtask.put.desc.xml", "claimtask.put.js", "claimtask.put.json.ftl", "completetask.post.desc.xml", "completetask.post.json.ftl", "completetask.post.js", "getapsdbid.get.desc.xml", "getapsdbid.get.json.ftl", "gettasks.get.desc.xml", "gettasks.get.json.ftl", "assignuser.put.desc.xml", "gettasks.get.js", "savetask.post.desc.xml", "savetask.post.js", "savetask.post.json.ftl", "taskForm.get.js", "taskForm.get.desc.xml", "tasklist.get.desc.xml", "apsApplicationList.get.js", "taskForm.get.json.ftl", "tasklist.get.html.ftl.jquery", "tasklist.get.html.ftl", "tasklist.get.js", "triggerapsprocess.post.desc.xml", "triggerapsprocess.post.js", "updatevariables.post.desc.xml.notused", "triggerapsprocess.post.json.ftl", "updatevariables.post.json.ftl.notused", "getapsdbid.get.js", "updatevariables.post.js.notused", "taskUtils.js", "apsGroupsConfig.json", "apsSitesConfig.json", "apptStepZeroStarter.post.desc.xml", "apptStepZeroStarter.post.json.ftl", "apptStepZeroStarter.post.js", "apptStepOneStarter.post.desc.xml", "apptStepOneStarter.post.js", "apptStepOneStarter.post.json.ftl", "apptStepOneSave.post.json.ftl", "apptStepOneSave.post.desc.xml", "apptStepOneSave.post.js", "apptStatusDocUpdate.post.desc.xml", "apptStatusDocUpdate.post.json.ftl", "apptStatusDocUpdate.post.js", "APSWorkflowStatus.get.desc.xml", "APSWorkflowStatus.put.html.ftl", "APSWorkflowStatus.get.html.ftl", "APSWorkflowInfo.put.html.ftl", "APSWorkflowStatus.put.desc.xml", "APSWorkflowInfo.put.desc.xml", "APSWorkflowStatus.get.js", "APSWorkflowStatus.put.js", "APSWorkflowInfo.put.js", "NodeInfo.get.desc.xml", "NodeInfo.get.html.ftl", "capinfo.get.js", "capstart.get.js", "epsb.get.js", "epsb.get.html.ftl", "capstart.get.html.ftl", "epsb.get.desc.xml", "schoolboard.get.html.ftl", "NodeInfo.get.js", "NodeInfoByCapId.get.desc.xml", "updateVariable.post.json.ftl", "updateVariable.post.js", "schoolboard.get.desc.xml", "updateVariable.post.desc.xml", "schoolboard.get.js", "capinfo.get.html.ftl.backup", "cap-file-load.post.json.ftl", "NodeInfoByCapId.get.js", "capinfo.get.html.ftl", "capstart.get.desc.xml", "cap-file-load.post.desc.xml", "capinfo.get.desc.xml", "cap-file-load.post.js", "capeamergedoc.get.js", "capeamergedoc.get.desc.xml", "capeamergedoc.get.html.ftl", "capConfig.js", "chsEnv.js", "chsConfig.js", "chsAdminStuView.get.desc.xml", "chsAdminStuView.get.html.ftl", "chsAdminStuView.get.js", "coupa.get.html.ftl", "coupa.get.desc.xml", "coupa.get.js", "coveoGetDocList.get.desc.xml", "coveoGetDocList.get.json.ftl", "coveoGetDocList.get.js", "getJson.get.desc.xml", "getJson.get.js", "getJson.get.json.ftl", "simpleupload.post.desc.xml", "simpleupload.post.json.ftl", "simpleupload.post.js", "consignoMessage.get.js", "consignoWebhook.post.js", "consignoWebhook.post.json.ftl", "consignoMessage.get.desc.xml", "consignoWebhook.post.desc.xml", "consignoMessage.get.json.ftl", "eSignDownload.get.js", "eSignDownload.get.html.ftl", "eSignDownload.get.desc.xml", "review-supervisorv2.get.desc.xml", "review-supervisorv2.get.js", "review-supervisorv2.get.html.ftl", "fgsrssgLanding.get.js", "review-comm01v2.get.desc.xml", "fgsrssgLanding.get.html.ftl", "review-comm01v2.get.html.ftl", "review-comm02v2.get.desc.xml", "review-comm02v2.get.html.ftl", "fgsrssgLanding.get.desc.xml", "review-studentv2.get.html.ftl", "review-comm03v2.get.html.ftl", "review-comm03v2.get.desc.xml", "review-studentv2.get.desc.xml", "review-cosupervisorv2.get.html.ftl", "review-comm02v2.get.js", "review-startv2.get.desc.xml", "review-studentv2.get.js", "review-cosupervisorv2.get.js", "review-startv2.get.js", "review-student-revisionv2.get.html.ftl", "review-student-revisionv2.get.desc.xml", "review-startv2.get.html.ftl", "review-comm03v2.get.js", "review-cosupervisorv2.get.desc.xml", "review-student-revisionv2.get.js", "review-comm01v2.get.js", "review-comm02.get.desc.xml", "review-comm02.get.html.ftl", "review-comm03.get.desc.xml", "review-comm02.get.js", "review-comm03.get.html.ftl", "review-cosupervisor.get.desc.xml", "review-cosupervisor.get.html.ftl", "review-cosupervisor.get.js", "review-nextdate.get.desc.xml", "review-comm03.get.js", "review-nextdate.get.js", "review-student.get.html.ftl", "review-student.get.js", "review-student-revision.get.desc.xml", "review-student.get.desc.xml", "review-student-revision.get.js", "review-studentTest.get.desc.xml", "review-supervisor.get.desc.xml", "review-studentTest.get.js", "review-supervisor.get.html.ftl", "review-supervisor.get.js", "review-comm01.get.desc.xml", "review-comm01.get.html.ftl", "review-comm01.get.js", "review-student-revision.get.html.ftl", "review-nextdate.get.html.ftl", "review-studentTest.get.html.ftl", "guidelines-supervisor.get.desc.xml", "guidelines-supervisor-revision.get.html.ftl", "guidelines-start.get.desc.xml", "guidelines-start.get.html.ftl", "guidelines-start.get.js", "guidelines-student.get.desc.xml", "guidelines-student.get.html.ftl", "guidelines-student-revision.get.js", "guidelines-student-revision.get.desc.xml", "guidelines-supervisor.get.html.ftl", "guidelines-supervisor-revision.get.desc.xml", "guidelines-student-revision.get.html.ftl", "guidelines-student.get.js", "guidelines-supervisor.get.js", "guidelines-supervisor-revision.get.js", "programExtensionScript.js", "customScript.js", "customCSS_FGSR2.css", "customCSS_FGSR.css", "fgsrEnv.js", "FGSR-Forms-Config.js", "config.js", "googleAddon.get.json.ftl", "googleAddon.get.desc.xml", "googleAddon.get.js", "gtaGraStatus.post.json.ftl", "gtaGraStatus.post.js", "gtaGraStatus.post.desc.xml", "wfh-manager.get.desc.xml", "wfh-form.get.js", "wfh-manager.get.html.ftl", "wfh-form.get.desc.xml", "wfh-revise.get.desc.xml", "wfh-revise.get.html.ftl", "wfh-revise.get.js", "wfh-seniormanager.get.desc.xml", "wfh-manager.get.js", "wfh-seniormanager.get.js", "wfh-seniormanager.get.html.ftl", "wfh-form.get.html.ftl", "hrsbsDocumentLinking.get.desc.xml", "hrsbsDocumentLinking.get.html.ftl", "hrsbsDocumentLinking.get.js", "coi-start.get.desc.xml", "coi-start.get.html.ftl", "coi-revise.get.html.ftl", "coi-employee.get.html.ftl", "coi-employee.get.desc.xml", "coi-revise.get.desc.xml", "coi-start.get.js", "coi-revise.get.js", "coi-supervisor.get.js", "coi-supervisor.get.desc.xml", "coi-employee.get.js", "coi-supervisor.get.html.ftl", "getTaskFilter.get.json.ftl", "queryTasks.get.json.ftl", "routableGroups.get.desc.xml", "routableGroups.get.js", "routableGroups.get.json.ftl", "queryTasks.get.desc.xml", "setTaskFilter.post.js", "setTaskFilter.post.json.ftl", "setTaskFilter.post.desc.xml", "applyTaskAction.post.js", "applyTaskAction.post.json.ftl", "applyTaskAction.post.desc.xml", "getTaskFilter.get.desc.xml", "getTaskFilter.get.js", "queryTasks.get.js", "avmbrowse.get.desc.xml", "avmbrowse.get.html.ftl", "avmbrowse.get.js", "avmstores.get.desc.xml", "avmstores.get.html.ftl", "blogsearch.get.atom.400.ftl", "blogsearch.get.html.400.ftl", "blogsearch.get.desc.xml", "blogsearch.get.js", "categorysearch.get.atom.404.ftl", "blogsearch.get.html.ftl", "categorysearch.get.html.404.ftl", "categorysearch.get.js", "categorysearch.get.html.ftl", "categorysearch.get.desc.xml", "folder.get.desc.xml", "folder.get.html.ftl", "folder.get.js", "psDeptAll.get.js", "psDeptSingle.get.json.ftl", "psDeptSingle.get.js", "psPerson.get.json.ftl", "psUtil.js", "psPerson.get.js", "psAcademicDeptAll.get.desc.xml", "psAcademicDeptAll.get.json.ftl", "psAuthorizedApprover.get.desc.xml", "psDeptAll.get.json.ftl", "psAuthorizedApprover.get.js", "psAuthorizedApprover.get.json.ftl", "psDeptAll.get.desc.xml", "psDeptSingle.get.desc.xml", "psPerson.get.desc.xml", "ceeb.get.desc.xml", "ceeb.get.json.ftl", "getSlateId.get.desc.xml", "getSlateId.get.js", "materials.get.json.ftl", "materials.get.desc.xml", "getSlateId.get.json.ftl", "ceeb.get.js", "materials.get.js", "edit.get.html.ftl", "edit.get.js", "save.post.js", "save.post.json.ftl", "scans.get.desc.xml", "scans.get.js", "uploadfile.post.desc.xml", "uploadfile.post.json.ftl", "edit.get.desc.xml", "uploadfile.post.js", "scans.get.html.ftl", "save.post.desc.xml", "AFA_Main.post.desc.xml", "AFA_MainFileOnly.post.desc.xml", "AFA_MainFileOnly.post.js", "AFA_Main.post.js", "AFA_MainFileOnly.post.json.ftl", "AFA_Main.post.json.ftl", "paperFileUtil.get.desc.xml", "paperFileUtil.get.js", "paperFileUtil.get.html.ftl", "rsoprojectdetails.get.html.ftl", "rsoprojectdetails.get.js", "rsoprojectdetails.get.desc.xml", "roslateapplist.get.html.ftl", "roslateapplist.get.desc.xml", "roslateapplist.get.json.ftl", "roslateexists.get.html.ftl", "roslateexists.get.desc.xml", "roslateapplist.get.js", "roslateexists.get.js", "uofaDepartmentList.get.desc.xml", "uofaDepartmentList.get.js", "uofaDepartmentList.get.html.ftl", "uofaDepartmentName.get.desc.xml", "uofaDepartmentName.get.html.ftl", "uofaFacultyList.get.html.ftl", "uofaFacultyList.get.desc.xml", "uofaDepartmentName.get.js", "uofapersonid.get.desc.xml", "uofapersonidrest.get.html.ftl", "uofapersonidrest.get.desc.xml", "uofapersonid.get.html.ftl", "uofapersonid.get.js", "uofapersonidrest.get.js", "uappolCategoryHeirarchy.get.desc.xml", "uappolCategoryHeirarchy.get.json.ftl", "uappol-metadata-query.get.desc.xml", "uappol-metadata-query.get.js", "uappol-metadata-query.get.json.ftl", "uappolCategoryHeirarchy.get.js", "siteFileViewer.get.desc.xml", "siteFileViewerConfig.js", "siteFileViewer.get.html.ftl", "siteFileViewer.get.js", "publicSiteFileViewer.get.html.ftl", "publicSiteFileViewer.get.desc.xml", "publicSiteFileViewer.get.js", "cronJob.post.desc.xml", "cronJob.post.js", "cronJob.post.json.ftl", "studentupload.get.html.ftl", "generatereport.get.json.ftl", "generatereport.get.desc.xml", "approvethesis.post.js", "generatereport.get.js", "search-match-attach.get.js", "search-match-list.get.html.ftl", "search-match-result.get.html.ftl", "search-match-result.get.js", "search-match-list.get.js.old", "chs-agreements.get.js", "chs-agreements.get.html.ftl", "chs-upload.get.html.ftl", "chs-upload.get.js", "uamytasks.config.get.js", "chsStudentView.get.js", "chsStudentView.get.html.ftl", "foModel.xml", "uofaDocTypes.xml", "uofaDocTypes.json", "foModel.json", "tim-sops", "FandO", "cbsr", "nanofab", "support-documentation", "Alfresco.zip - 1bf054bded99e2ae414154593d0892066b2e0c7add603f9321e157c77ae52075", "https://www.virustotal.com/graph/embed/g05f1796a358b458d95751d31d1d529aa378f8ffadf0b4305b7fa0bd1c64fe228?theme=dark", "https://www.virustotal.com/gui/collection/63819e07111e9665ba8602777d782527c54f3fad71ef36f977405a004484787c/iocs", "https://viz.greynoise.io/analysis/0cd9177e-8328-4355-a2c0-d05704a64c72", "components.zip - 2b91fcf852a5f1f57be71a269d82497b37c9f544ebd8f32aaa240e4cde0ffeea", "https://www.virustotal.com/graph/embed/g2948a5c332eb4614973872a8243215f6aa1fba79749a48ea92806e9b934db91f?theme=dark", "https://viz.greynoise.io/ip/analysis/2610b635-c05a-4f28-a112-7278de8fdf9b" ], "public": 1, "adversary": "TA413 proposed (06.08.24), Callisto, APT38, APT 28/29 - too much time too many problems", "targeted_countries": [ "Canada", "United States of America" ], "malware_families": [], "attack_ids": [], "industries": [ "Education", "Government", "Healthcare", "Technology", "Telecommunications" ], "TLP": "white", "cloned_from": null, "export_count": 57, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "web", "validator_count": 0, "comment_count": 4, "follower_count": 0, "vote": 0, "author": { "username": "Disable_Duck", "id": "244325", "avatar_url": "/otxapi/users/avatar_image/media/avatars/user_244325/resized/80/avatar_3b9c358f36.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "domain": 7132, "hostname": 3118, "URL": 4909, "email": 20, "FileHash-SHA256": 2144, "FileHash-MD5": 29, "FileHash-SHA1": 29 }, "indicator_count": 17381, "is_author": false, "is_subscribing": null, "subscriber_count": 131, "modified_text": "233 days ago ", "is_modified": true, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 }, { "id": "65708ef0cdb40fa0e7d239ca", "name": "either emotet or a part of it", "description": "", "modified": "2023-12-06T15:10:40.867000", "created": "2023-12-06T15:10:40.867000", "tags": [], "references": [], "public": 1, "adversary": "", "targeted_countries": [], "malware_families": [], "attack_ids": [], "industries": [], "TLP": "green", "cloned_from": null, "export_count": 2, "upvotes_count": 0, "downvotes_count": 0, "votes_count": 0, "locked": false, "pulse_source": "api", "validator_count": 0, "comment_count": 0, "follower_count": 0, "vote": 0, "author": { "username": "StreamMiningEx", "id": "262917", "avatar_url": "https://otx.alienvault.com/assets/images/default-avatar.png", "is_subscribed": false, "is_following": false }, "indicator_type_counts": { "FileHash-SHA256": 342, "hostname": 456, "domain": 349, "URL": 1730, "FileHash-MD5": 1, "FileHash-SHA1": 1 }, "indicator_count": 2879, "is_author": false, "is_subscribing": null, "subscriber_count": 109, "modified_text": "907 days ago ", "is_modified": false, "groups": [], "in_group": false, "threat_hunter_scannable": true, "threat_hunter_has_agents": 1, "related_indicator_type": "domain", "related_indicator_is_active": 1 } ], "error": null, "vt": { "error": "VirusTotal rate limit reached. Try again shortly.", "indicator": "s.properties", "type": "Domain" }, "abuseipdb": null, "urlhaus": { "indicator": "s.properties", "found": false, "verdict": "clean", "urls": [], "error": null }, "from_cache": true, "_cached_at": 1780280065.5127733 }