Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
95.msi

Overview

General Information

Sample name:95.msi
Analysis ID:1629426
MD5:b33b2c6c7073518f674f74dd19bc536f
SHA1:2ca97bf54a468f4cb5c83b679a16daf0c7f9530f
SHA256:342117d5786f6c02c86671fc05a1d7b86f8c20c7543c9ea2ea1cf7f3b56f82b0
Tags:msiuser-1ZRR4H
Infos:

Detection

RedLine
Score:100
Range:0 - 100
Confidence:100%

Signatures

Antivirus detection for URL or domain
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Suricata IDS alerts for network traffic
Yara detected RedLine Stealer
Connects to many ports of the same IP (likely port scanning)
Found direct / indirect Syscall (likely to bypass EDR)
Found hidden mapped module (file has been removed from disk)
Joe Sandbox ML detected suspicious sample
Maps a DLL or memory area into another process
PE file has a writeable .text section
Switches to a custom stack to bypass stack traces
Tries to harvest and steal Bitcoin Wallet information
Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
Tries to harvest and steal browser information (history, passwords, etc)
Uses known network protocols on non-standard ports
Writes to foreign memory regions
Checks for available system drives (often done to infect USB drives)
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to open a port and listen for incoming connection (possibly a backdoor)
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Deletes files inside the Windows folder
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Drops files with a non-matching file extension (content does not match file extension)
Entry point lies outside standard sections
Found dropped PE file which has not been started or loaded
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
JA3 SSL client fingerprint seen in connection with other malware
Launches processes in debugging mode, may be used to hinder debugging
May sleep (evasive loops) to hinder dynamic analysis
PE file contains an invalid checksum
PE file contains executable resources (Code or Archives)
PE file contains more sections than normal
PE file contains sections with non-standard names
Queries the installation date of Windows
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Searches for user specific document files
Suricata IDS alerts with low severity for network traffic
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer
Yara signature match

Classification

Process Tree

  • System is w10x64
  • msiexec.exe (PID: 6276 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\95.msi" MD5: E5DA170027542E25EDE42FC54C929077)
  • msiexec.exe (PID: 6296 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)
    • SplashWin.exe (PID: 5660 cmdline: "C:\Users\user\AppData\Local\Florilegium\SplashWin.exe" MD5: 4D20B83562EEC3660E45027AD56FB444)
      • SplashWin.exe (PID: 5700 cmdline: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe MD5: 4D20B83562EEC3660E45027AD56FB444)
        • cmd.exe (PID: 2008 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 5480 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • Syncsign_v1.exe (PID: 4248 cmdline: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe MD5: 967F4470627F823F4D7981E511C9824F)
            • msiexec.exe (PID: 2756 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\UJTcSAwaleqsjRv9HspDxp.msi" MD5: E5DA170027542E25EDE42FC54C929077)
            • msedge.exe (PID: 3412 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default" MD5: 69222B8101B0601CC6663F8381E7E00F)
              • msedge.exe (PID: 3740 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2092,i,6567631385547770601,15567002081603104977,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msiexec.exe (PID: 3796 cmdline: C:\Windows\syswow64\MsiExec.exe -Embedding F8E1D76AA19B02239F060918BBE40BDC C MD5: 9D09DC1EDA745A5F87553048E57620CF)
      • ISBEW64.exe (PID: 2492 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2A270F6-71BD-4CF4-BCD4-62D608E7C6DE} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 2016 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1387D03A-F134-4442-AA6E-ADB2CD5C2ED0} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 5548 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F52B7AF0-9702-4246-A1ED-1A9047376A3D} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 2848 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C162230-114A-4D2A-AEC6-15BB323AE6BC} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 3176 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A686CD30-0C56-4C54-86B5-DBEC67B4DBCD} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 2912 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D7823393-5AA6-4AB5-A0AE-4EEA1F8EB985} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 1208 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40795E86-F3F1-4D62-A29C-F60FADC828BF} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 5296 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50347EEE-E43A-4759-93EA-F28098E49F12} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 5640 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0B21F84-7F7C-4341-B415-DC7FBF2E3720} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • ISBEW64.exe (PID: 6096 cmdline: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF103E10-17E9-41D3-ACA3-F40B15C7CB56} MD5: 40F3A092744E46F3531A40B917CCA81E)
      • SplashWin.exe (PID: 824 cmdline: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exe MD5: 4D20B83562EEC3660E45027AD56FB444)
        • cmd.exe (PID: 4556 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
          • conhost.exe (PID: 5916 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
          • backgroundTaskHost.exe (PID: 7556 cmdline: "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider MD5: DA7063B17DBB8BBB3015351016868006)
  • SplashWin.exe (PID: 4268 cmdline: "C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe" MD5: 4D20B83562EEC3660E45027AD56FB444)
    • cmd.exe (PID: 1148 cmdline: C:\Windows\SysWOW64\cmd.exe MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)
      • conhost.exe (PID: 6808 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)
      • Syncsign_v1.exe (PID: 6440 cmdline: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe MD5: 967F4470627F823F4D7981E511C9824F)
  • msedge.exe (PID: 1860 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 6632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2736 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:3 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7624 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6472 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • msedge.exe (PID: 7632 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8 MD5: 69222B8101B0601CC6663F8381E7E00F)
    • identity_helper.exe (PID: 7984 cmdline: "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8 MD5: 76C58E5BABFE4ACF0308AA646FC0F416)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

⊘No configs have been found

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
C:\Users\user\AppData\Local\Temp\xwielkiowcxJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    C:\Users\user\AppData\Local\Temp\xwielkiowcxJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      C:\Users\user\AppData\Local\Temp\xwielkiowcxMALWARE_Win_Arechclient2Detects Arechclient2 RATditekSHen
      • 0xbe9c7:$s14: keybd_event
      • 0xc5bb3:$v1_1: grabber@
      • 0xbf51f:$v1_2: <BrowserProfile>k__
      • 0xbff9e:$v1_3: <SystemHardwares>k__
      • 0xc005d:$v1_5: <ScannedWallets>k__
      • 0xc00ed:$v1_6: <DicrFiles>k__
      • 0xc00c9:$v1_7: <MessageClientFiles>k__
      • 0xc0493:$v1_8: <ScanBrowsers>k__BackingField
      • 0xc04e5:$v1_8: <ScanWallets>k__BackingField
      • 0xc0502:$v1_8: <ScanScreen>k__BackingField
      • 0xc053c:$v1_8: <ScanVPN>k__BackingField
      • 0xb17ea:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost
      • 0xb10f6:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

      Memory Dumps

      SourceRuleDescriptionAuthorStrings
      00000023.00000002.2544610595.0000000006050000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
        00000023.00000002.2544610595.0000000006050000.00000004.00001000.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security

          Unpacked PEs

          SourceRuleDescriptionAuthorStrings
          35.2.cmd.exe.60500c8.7.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            35.2.cmd.exe.60500c8.7.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
              35.2.cmd.exe.60500c8.7.unpackMALWARE_Win_Arechclient2Detects Arechclient2 RATditekSHen
              • 0xbcbc7:$s14: keybd_event
              • 0xc3db3:$v1_1: grabber@
              • 0xbd71f:$v1_2: <BrowserProfile>k__
              • 0xbe19e:$v1_3: <SystemHardwares>k__
              • 0xbe25d:$v1_5: <ScannedWallets>k__
              • 0xbe2ed:$v1_6: <DicrFiles>k__
              • 0xbe2c9:$v1_7: <MessageClientFiles>k__
              • 0xbe693:$v1_8: <ScanBrowsers>k__BackingField
              • 0xbe6e5:$v1_8: <ScanWallets>k__BackingField
              • 0xbe702:$v1_8: <ScanScreen>k__BackingField
              • 0xbe73c:$v1_8: <ScanVPN>k__BackingField
              • 0xaf9ea:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost
              • 0xaf2f6:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig
              35.2.cmd.exe.60500c8.7.raw.unpackJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                35.2.cmd.exe.60500c8.7.raw.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security
                  Click to see the 1 entries

                  Sigma Signatures

                  ⊘No Sigma rule has matched

                  Suricata Signatures

                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2025-03-04T18:08:56.501424+010020283713Unknown Traffic192.168.2.449762104.21.40.182443TCP
                  2025-03-04T18:08:58.561127+010020283713Unknown Traffic192.168.2.449763104.21.40.182443TCP
                  2025-03-04T18:08:59.590569+010020283713Unknown Traffic192.168.2.449766172.67.164.91443TCP
                  2025-03-04T18:08:59.602162+010020283713Unknown Traffic192.168.2.449765104.21.40.182443TCP
                  2025-03-04T18:09:35.795128+010020283713Unknown Traffic192.168.2.450009104.21.40.182443TCP
                  2025-03-04T18:09:37.400850+010020283713Unknown Traffic192.168.2.450019104.21.40.182443TCP
                  2025-03-04T18:09:38.293106+010020283713Unknown Traffic192.168.2.450028104.21.40.182443TCP
                  2025-03-04T18:09:39.253405+010020283713Unknown Traffic192.168.2.450034104.21.40.182443TCP
                  2025-03-04T18:09:40.579397+010020283713Unknown Traffic192.168.2.450044104.21.40.182443TCP
                  2025-03-04T18:09:42.012602+010020283713Unknown Traffic192.168.2.450052104.21.40.182443TCP
                  2025-03-04T18:09:43.122118+010020283713Unknown Traffic192.168.2.450063104.21.40.182443TCP
                  TimestampSIDSeverityClasstypeSource IPSource PortDestination IPDestination PortProtocol
                  2025-03-04T18:09:39.578239+010020522481A Network Trojan was detected192.168.2.45003592.255.85.239000TCP

                  Joe Sandbox Signatures

                  Click to jump to signature section

                  Show All Signature Results

                  AV Detection

                  barindex
                  Antivirus detection for URL or domain
                  Source: https://piaktrip.online/eAvira URL Cloud: Label: malware
                  Source: https://piaktrip.online/dAvira URL Cloud: Label: malware
                  Source: https://undermymindops.com/GELEPLLV.msiAvira URL Cloud: Label: malware
                  Source: https://piaktrip.online:443/close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VAvira URL Cloud: Label: malware
                  Source: https://undermymindops.com/GELEPLLV.msi-LMAvira URL Cloud: Label: malware
                  Multi AV Scanner detection for dropped file
                  Source: C:\Users\user\AppData\Local\Temp\xwielkiowcxReversingLabs: Detection: 73%
                  Joe Sandbox ML detected suspicious sample
                  Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49762 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49763 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.164.91:443 -> 192.168.2.4:49766 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49765 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50009 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50019 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50028 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50034 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50044 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50052 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50063 version: TLS 1.2
                  Source: Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: winload_prod.pdb0O source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb,, source: SplashWin.exe, 00000002.00000002.1696637591.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000002.00000000.1680293396.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000003.00000002.1754974383.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000003.00000000.1695668433.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2129284757.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000012.00000000.2070283939.00000000006F3000.00000002.00000001.01000000.00000008.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831` source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdbww3 source: SplashWin.exe, 00000002.00000002.1703236204.000000006CED5000.00000002.00000001.01000000.00000004.sdmp, SplashWin.exe, 00000003.00000002.1759175255.000000006C9C5000.00000002.00000001.01000000.00000009.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143887734.000000006F885000.00000002.00000001.01000000.00000009.sdmp
                  Source: Binary string: ntkrnlmp.pdb source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: SplashWin.exe, 00000002.00000002.1702480957.000000000A52A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1702636911.000000000A880000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758481320.000000000AB10000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758593751.000000000AECC000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758387014.000000000A7B5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2044539649.0000000005360000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043077712.0000000004A73000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136438297.000000000A84A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2137680603.000000000AF57000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136872506.000000000ABA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333618784.0000000005292000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ntdll.pdbUGP source: Syncsign_v1.exe, 0000000C.00000002.2614200148.0000000004680000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616843682.000000000588A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618117574.0000000006283000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614978928.0000000004C81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613664255.0000000004289000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619214817.0000000006883000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616238315.000000000548C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619801124.0000000006A88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617652996.0000000005E85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614779950.0000000004A8F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2612947658.0000000003C8D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613423974.000000000408C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615463459.000000000508C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2620132953.0000000006C85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614501285.0000000004884000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618875209.000000000668D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616555219.0000000005681000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617367794.0000000005C88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613932258.0000000004489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615682026.000000000528F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617102811.0000000005A84000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613193988.0000000003E82000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615242240.0000000004E8C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610628868.00000000022D2000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618415153.0000000006489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611410665.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617890909.0000000006083000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: SplashWin.exe, 00000002.00000002.1702480957.000000000A52A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1702636911.000000000A880000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758481320.000000000AB10000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758593751.000000000AECC000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758387014.000000000A7B5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2044539649.0000000005360000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043077712.0000000004A73000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136438297.000000000A84A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2137680603.000000000AF57000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136872506.000000000ABA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333618784.0000000005292000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: BC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AC\INetHistory source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17 source: Syncsign_v1.exe, 0000000C.00000003.2588756975.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611800889.0000000002E77000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2589101760.0000000002EA5000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SplashWin.exe, 00000002.00000002.1697019581.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1703371392.000000006E591000.00000020.00000001.01000000.00000005.sdmp, SplashWin.exe, 00000003.00000002.1759080373.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2145040792.000000006F8F1000.00000020.00000001.01000000.0000000A.sdmp
                  Source: Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 0000001A.00000000.2251643361.00007FF74E9A7000.00000002.00000001.01000000.00000011.sdmp
                  Source: Binary string: winload_prod.pdb source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: d_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Syncsign_v1.exe, 0000000C.00000003.2511701729.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: ntkrnlmp.pdb\X source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Syncsign_v1.exe, 0000000C.00000003.2321808724.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2510663351.0000000002E9F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2444647514.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2364405863.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272318607.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276312317.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2379292878.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2401556626.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442173727.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316497382.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2361574610.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2459846546.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2427838775.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2416464551.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429991569.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2362534640.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2443068349.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2400468049.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272141058.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2511119235.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2376835411.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2338777727.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430807310.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272768188.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2396961372.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2376279251.0000000002EA0000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2428412489.0000000002E9E0
                  Source: Binary string: G\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\profi source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\profi source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: ntdll.pdb source: Syncsign_v1.exe, 0000000C.00000002.2614200148.0000000004680000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616843682.000000000588A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618117574.0000000006283000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614978928.0000000004C81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613664255.0000000004289000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619214817.0000000006883000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616238315.000000000548C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619801124.0000000006A88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617652996.0000000005E85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614779950.0000000004A8F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2612947658.0000000003C8D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613423974.000000000408C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615463459.000000000508C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2620132953.0000000006C85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614501285.0000000004884000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618875209.000000000668D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616555219.0000000005681000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617367794.0000000005C88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613932258.0000000004489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615682026.000000000528F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617102811.0000000005A84000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613193988.0000000003E82000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615242240.0000000004E8C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610628868.00000000022D2000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618415153.0000000006489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611410665.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617890909.0000000006083000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: p.pdb source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdb source: SplashWin.exe, 00000002.00000002.1703236204.000000006CED5000.00000002.00000001.01000000.00000004.sdmp, SplashWin.exe, 00000003.00000002.1759175255.000000006C9C5000.00000002.00000001.01000000.00000009.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143887734.000000006F885000.00000002.00000001.01000000.00000009.sdmp
                  Source: Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb source: SplashWin.exe, 00000002.00000002.1696637591.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000002.00000000.1680293396.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000003.00000002.1754974383.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000003.00000000.1695668433.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2129284757.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000012.00000000.2070283939.00000000006F3000.00000002.00000001.01000000.00000008.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2575675070.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2574559184.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571448557.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571705048.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: Chromep.pdb source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SplashWin.exe, SplashWin.exe, 00000003.00000002.1759006023.000000006C8B1000.00000020.00000001.01000000.0000000B.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143252265.000000006CBF1000.00000020.00000001.01000000.0000000B.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.inih source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: C:\Windows\System32\msiexec.exeFile opened: z:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: x:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: v:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: t:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: r:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: p:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: n:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: l:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: j:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: h:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: f:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: b:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: y:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: w:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: u:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: s:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: q:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: o:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: m:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: k:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: i:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: g:Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile opened: e:Jump to behavior
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeFile opened: c:
                  Source: C:\Windows\System32\msiexec.exeFile opened: a:Jump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDF20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,2_2_6CDF20D0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8C20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,3_2_6C8C20D0

                  Networking

                  barindex
                  Suricata IDS alerts for network traffic
                  Source: Network trafficSuricata IDS: 2052248 - Severity 1 - ET MALWARE Arechclient2 Backdoor/SecTopRAT Related Activity M2 (GET) : 192.168.2.4:50035 -> 92.255.85.23:9000
                  Connects to many ports of the same IP (likely port scanning)
                  Source: global trafficTCP traffic: 92.255.85.23 ports 9000,1,4,5,7,8,15847
                  Uses known network protocols on non-standard ports
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 9000
                  Source: unknownNetwork traffic detected: HTTP traffic on port 9000 -> 50035
                  Source: global trafficTCP traffic: 192.168.2.4:50016 -> 92.255.85.23:15847
                  Source: global trafficHTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
                  Source: Joe Sandbox ViewIP Address: 2.22.242.11 2.22.242.11
                  Source: Joe Sandbox ViewIP Address: 131.253.33.203 131.253.33.203
                  Source: Joe Sandbox ViewIP Address: 18.173.132.23 18.173.132.23
                  Source: Joe Sandbox ViewIP Address: 162.159.61.3 162.159.61.3
                  Source: Joe Sandbox ViewJA3 fingerprint: a0e9f5d64349fb13191bc781f81f42e1
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49766 -> 172.67.164.91:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49763 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49762 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:49765 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50009 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50019 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50028 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50034 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50044 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50052 -> 104.21.40.182:443
                  Source: Network trafficSuricata IDS: 2028371 - Severity 3 - ET JA3 Hash - Possible Malware - Fake Firefox Font Update : 192.168.2.4:50063 -> 104.21.40.182:443
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239412444202_1CRUJ6LFT0QNV3399&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239412444203_1T1X5QIXRVF67T4JC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239355035239_1NE5QON2H0G5IVA3Y&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239355035240_1LIDBG5VEHXCVNZ8Y&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15Content-Length: 147Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 53Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: GET /GELEPLLV.msi HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: undermymindops.com
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 208Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.d3ac3ec818a0cdf01df5.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: OPTIONS /api/report?cat=bingbusiness HTTP/1.1Host: bzib.nelreports.netConnection: keep-aliveOrigin: https://business.bing.comAccess-Control-Request-Method: POSTAccess-Control-Request-Headers: content-typeUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.b4dceb3fb90c199d68cd.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.5d0f28115e15fcff20c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.ccf37a049089f68490a9.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.3fa26ba080d24cc97170.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1741108158726&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1f9f0d3177324eb2999bb9822d255436&activityId=1f9f0d3177324eb2999bb9822d255436&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /b?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0F2C6A66B41D685530457FC3B59769D2&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /b2?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0F2C6A66B41D685530457FC3B59769D2&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1359343884326ede4fd61751741108159; XID=1359343884326ede4fd61751741108159
                  Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1741108158726&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1f9f0d3177324eb2999bb9822d255436&activityId=1f9f0d3177324eb2999bb9822d255436&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=683AEB7A6C354925BB1958303F56FFBC&MUID=0F2C6A66B41D685530457FC3B59769D2 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; SM=T
                  Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1741108158724&time-delta-to-apply-millis=use-collector-delta&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 3856sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 4.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8f7f8abd-ba52-4022-bd3c-a6b77eb8e7f8; ai_session=26wEhmzbLPOhxQfbNqlcDl|1741108158722|1741108158722; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z
                  Source: global trafficHTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":12,"imageId":"BB1msB1P","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8f7f8abd-ba52-4022-bd3c-a6b77eb8e7f8; ai_session=26wEhmzbLPOhxQfbNqlcDl|1741108158722|1741108158722; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z
                  Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1741108160698&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 11434sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
                  Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1741108160703&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5011sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; _C_ETH=1; msnup=%7B%22cnex%22%3A%22no%22%7D
                  Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1741108161528&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 5369sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
                  Source: global trafficHTTP traffic detected: POST /OneCollector/1.0?cors=true&content-type=application/x-json-stream&client-id=NO_AUTH&client-version=1DS-Web-JS-3.2.8&apikey=0ded60c75e44443aa3484c42c1c43fe8-9fc57d3f-fdac-4bcf-b927-75eafe60192e-7279&upload-time=1741108161698&w=0&anoncknm=app_anon&NoResponseBody=true HTTP/1.1Host: browser.events.data.msn.comConnection: keep-aliveContent-Length: 9571sec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-platform: "Windows"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Content-Type: text/plain;charset=UTF-8Accept: */*Origin: https://ntp.msn.comSec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; msnup=%7B%22cnex%22%3A%22no%22%7D
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 113630Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 745Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 212Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 380Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 50110Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 77943Host: piaktrip.online
                  Source: global trafficHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15doctype: ZhFXIkc9V4Dxc3Y2QZlSmLnb0nBgtqNADLYS9OEHA8qaRPYUalIff9ql9/4aCyvRrEFdGEYiDEgNiKI7kayrtu5In8r+sQContent-Length: 35Host: piaktrip.online
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 2.23.227.208
                  Source: unknownTCP traffic detected without corresponding DNS query: 184.30.131.245
                  Source: unknownTCP traffic detected without corresponding DNS query: 184.30.131.245
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 18.173.132.23
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 23.57.90.149
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.219
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 131.253.33.203
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: unknownTCP traffic detected without corresponding DNS query: 40.74.98.194
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239402415510_1LQQ8WSBAXW97X0WT&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239412444202_1CRUJ6LFT0QNV3399&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239412444203_1T1X5QIXRVF67T4JC&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239402456886_16PSERWAUMTCB5AWR&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239355035239_1NE5QON2H0G5IVA3Y&pid=21.2&c=16&roil=0&roit=0&roir=1&roib=1&w=1920&h=1080&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /th?id=OADD2.10239355035240_1LIDBG5VEHXCVNZ8Y&pid=21.2&c=3&w=1080&h=1920&dynsize=1&qlt=90 HTTP/1.1Accept: */*Accept-Encoding: gzip, deflate, brUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/70.0.3538.102 Safari/537.36 Edge/18.19045Host: tse1.mm.bing.netConnection: Keep-Alive
                  Source: global trafficHTTP traffic detected: GET /GELEPLLV.msi HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/109.0.0.0 Safari/537.36Host: undermymindops.com
                  Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531 HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0sec-ch-ua-platform: "Windows"sec-ch-ua-platform-version: "10.0.0"Upgrade-Insecure-Requests: 1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: noneSec-Fetch-Mode: navigateSec-Fetch-User: ?1Sec-Fetch-Dest: documentAccept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/web-worker.d3ac3ec818a0cdf01df5.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: workerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /crx/blobs/ASuc5ohcoRYyASTWkAI21BvR0f-Aos7pzgW3GtD8ImYoX-O9Pl77join3GT-5wpD1vT_nG6xpJ0eds7JOZacv0OYNfBAee3mKSnMDx3-YDnz3J7UxfHM_wfhsyHz9Z8rajAAxlKa5T9frrLlN0KHGfJRu7Y7NseNtZ_M/GHBMNNJOOEKPMOECNNNILNNBDLOLHKHI_1_89_1_0.crx HTTP/1.1Host: clients2.googleusercontent.comConnection: keep-aliveSec-Fetch-Site: noneSec-Fetch-Mode: no-corsSec-Fetch-Dest: emptyUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/SSR-extension.b4dceb3fb90c199d68cd.js HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 1.35sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-bitness: "64"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 100sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/vendors.5d0f28115e15fcff20c5.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/microsoft.4fa8815283fe3d88a934.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/common.ccf37a049089f68490a9.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /bundles/v1/edgeChromium/latest/experience.3fa26ba080d24cc97170.js HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"Origin: https://ntp.msn.comsec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: */*Sec-Fetch-Site: same-siteSec-Fetch-Mode: corsSec-Fetch-Dest: scriptReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /statics/icons/favicon_newtabpage.png HTTP/1.1Host: assets.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1741108158726&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1f9f0d3177324eb2999bb9822d255436&activityId=1f9f0d3177324eb2999bb9822d255436&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: same-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_ETH=1; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1
                  Source: global trafficHTTP traffic detected: GET /b?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0F2C6A66B41D685530457FC3B59769D2&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8
                  Source: global trafficHTTP traffic detected: GET /b2?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2Btab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp%26mkt%3Den-us&c8=New+tab&c9=&cs_fpid=0F2C6A66B41D685530457FC3B59769D2&cs_fpit=o&cs_fpdm=*null&cs_fpdt=*null HTTP/1.1Host: sb.scorecardresearch.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: UID=1359343884326ede4fd61751741108159; XID=1359343884326ede4fd61751741108159
                  Source: global trafficHTTP traffic detected: GET /c.gif?rnd=1741108158726&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&tp=https%3A%2F%2Fntp.msn.com%2Fedge%2Fntp%3Flocale%3Den-GB%26title%3DNew%2520tab%26dsp%3D1%26sp%3DBing%26isFREModalBackground%3D1%26startpage%3D1%26PC%3DU531%26ocid%3Dmsedgdhp&cvs=Browser&di=340&st.dpt=&st.sdpt=antp&subcvs=homepage&lng=en-us&rid=1f9f0d3177324eb2999bb9822d255436&activityId=1f9f0d3177324eb2999bb9822d255436&d.imd=false&scr=1280x1024&anoncknm=app_anon&issso=&aadState=0&ctsa=mr&CtsSyncId=683AEB7A6C354925BB1958303F56FFBC&MUID=0F2C6A66B41D685530457FC3B59769D2 HTTP/1.1Host: c.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-platform: "Windows"Accept: image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8Sec-Fetch-Site: cross-siteSec-Fetch-Mode: no-corsSec-Fetch-Dest: imageReferer: https://ntp.msn.com/Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; SM=T
                  Source: global trafficHTTP traffic detected: GET /edge/ntp?locale=en-GB&title=New+tab&enableForceCache=true HTTP/1.1Host: ntp.msn.comConnection: keep-alivesec-ch-ua: "Microsoft Edge";v="117", "Not;A=Brand";v="8", "Chromium";v="117"sec-ch-viewport-height: 876sec-ch-ua-arch: "x86"sec-ch-viewport-width: 1232sec-ch-ua-platform-version: "10.0.0"downlink: 4.45sec-ch-ua-bitness: "64"sec-ch-ua-full-version-list: "Microsoft Edge";v="117.0.2045.47", "Not;A=Brand";v="8.0.0.0", "Chromium";v="117.0.5938.132"sec-ch-ua-model: ""sec-ch-prefers-color-scheme: lightsec-ch-ua-platform: "Windows"device-memory: 8rtt: 200sec-ch-ua-mobile: ?0User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-ch-ua-full-version: "117.0.2045.47"sec-ch-dpr: 1ect: 4gAccept: */*sec-edge-ntp: {"back_block":0,"bg_cur":{},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"","show_greet":true,"vt_opened":false}Sec-Fetch-Site: same-originSec-Fetch-Mode: corsSec-Fetch-Dest: emptyReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8f7f8abd-ba52-4022-bd3c-a6b77eb8e7f8; ai_session=26wEhmzbLPOhxQfbNqlcDl|1741108158722|1741108158722; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z
                  Source: global trafficHTTP traffic detected: GET /edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=2880&networkTimeoutSeconds=5&bgTaskNetworkTimeoutSeconds=8&ssrBasePageNavAgeMinutes=360&enableEmptySectionRoute=true&enableNavPreload=true&enableFallbackVerticalsFeed=true&noCacheLayoutTemplates=true&cacheSSRBasePageResponse=true&enableStaticAdsRouting=true&enableWidgetsRegion=true HTTP/1.1Host: ntp.msn.comConnection: keep-aliveCache-Control: max-age=0Accept: */*Service-Worker: scriptUser-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/117.0.0.0 Safari/537.36 Edg/117.0.2045.47sec-edge-ntp: {"back_block":0,"bg_cur":{"configIndex":12,"imageId":"BB1msB1P","provider":"CMSImage","userSelected":false},"bg_img_typ":"bing","exp":["msQuickLinksDefaultOneRow","msShoppingWebAssistOnNtp","msShoppingHistogramsOnNtp","msEnableWinHPNewTabBackButtonFocusAndClose","msCustomMaxQuickLinks","msMaxQuickLinksAt20","msAllowThemeInstallationFromChromeStore","msEdgeSplitWindowLinkMode"],"feed":0,"feed_dis":"onscroll","layout":1,"quick_links_opt":1,"sel_feed_piv":"myFeed","show_greet":true,"vt_opened":false,"wpo_nx":{"v":"2","wgt":{"src":"default"}}}Sec-Fetch-Site: same-originSec-Fetch-Mode: same-originSec-Fetch-Dest: serviceworkerReferer: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&startpage=1&PC=U531Accept-Encoding: gzip, deflate, brAccept-Language: en-GB,en;q=0.9,en-US;q=0.8Cookie: _C_Auth=; pglt-edgeChromium-dhp=547; sptmarket=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z; USRLOC=; MUID=0F2C6A66B41D685530457FC3B59769D2; MUIDB=0F2C6A66B41D685530457FC3B59769D2; _EDGE_S=F=1&SID=255EB65A25B561101FE9A3FF249960A7; _EDGE_V=1; MicrosoftApplicationsTelemetryDeviceId=8f7f8abd-ba52-4022-bd3c-a6b77eb8e7f8; ai_session=26wEhmzbLPOhxQfbNqlcDl|1741108158722|1741108158722; sptmarket_restored=en-GB||us|en-us|en-us|en||cf=8|RefA=1F9F0D3177324EB2999BB9822D255436.RefC=2025-03-04T17:09:14Z
                  Source: global trafficHTTP traffic detected: GET /wbinjget?q=8587D7BC4236146899B093C1B42EFE08 HTTP/1.1Host: 92.255.85.23:9000Connection: Keep-Alive
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: N'`www.facebook.com_ equals www.facebook.com (Facebook)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: NTwww.youtube.com0_ equals www.youtube.com (Youtube)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2445510676.0000000008241000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: Nf`www.youtube.com equals www.youtube.com (Youtube)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-Q8yU0HNGU7e2zRuSGy9lO9KxLLTWp+z1WwwbOZJQh3w=' 'strict-dynamic' equals www.facebook.com (Facebook)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: ditu.live.com https://dev.virtualearth.net/REST/v1/Routes/ https://dev.ditu.live.com/REST/v1/Routes/ https://dev.virtualearth.net/REST/v1/Locations/ https://dev.ditu.live.com/REST/v1/Locations/ browser.events.data.microsoft.com ib.msn.com https://proxy.uet.s.microsoft.com/tpv-dv/;default-src 'none';font-src 'self' data: assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;frame-src https://api.msn.com/auth/cookie/silentpassport https://api.msn.cn/auth/cookie/silentpassport https://www.msn.com https://www.msn.cn https://www.microsoftstart.com login.live.com login.microsoftonline.com www.bing.com/covid www.bing.com/rewardsapp/flyout www.bing.com/shop www.bing.com/shop/halloween www.bing.com/videos/search www.facebook.com www.odwebp.svc.ms www.youtube.com msn.pluto.tv www.bing.com/wpt/prefetchcib https://res.cdn.office.net/ business.bing.com sip: mailto: edge-auth.microsoft.com;img-src https://* blob: chrome-search://ntpicon/ chrome-search://local-ntp/ chrome-search://theme/ data:;media-src 'self' blob: *.mavideo.microsoft.com assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn https://sapphire.azureedge.net th.bing.com/th wus-streaming-video-msn-com.akamaized.net prod-streaming-video-msn-com.akamaized.net prod-streaming-video.msn.cn video.yidianzixun.com liveshopping.azureedge.net;report-to csp-endpoint;require-trusted-types-for 'script';style-src 'self' 'unsafe-inline' c.s-microsoft.com/mscc/ assets.msn.com assets2.msn.com assets.msn.cn assets2.msn.cn;trusted-types serviceWorkerUrlPolicy baw-trustedtypes-policy svgPassThroughPolicy xmlPassThroughPolicy webpackTrustedTypesPolicy webWorkerUrlPolicy inlineHeadCssPassthroughPolicy bundleUrlPolicy fallbackBundleUrlPolicy scriptSrcUrlPolicy commonAsScriptPolicy dompurify fast-html base-html-policy ot-trusted-type-policy default 'allow-duplicates' IasUrlPolicy DvUrlPolicy;worker-src 'self' blob: 'report-sample';script-src 'nonce-Q8yU0HNGU7e2zRuSGy9lO9KxLLTWp+z1WwwbOZJQh3w=' 'strict-dynamic' equals www.youtube.com (Youtube)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2445510676.0000000008241000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.facebook.com equals www.facebook.com (Facebook)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2445510676.0000000008241000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.facebook.com_ equals www.facebook.com (Facebook)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2445510676.0000000008241000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.youtube.com equals www.youtube.com (Youtube)
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: www.youtube.com0_ equals www.youtube.com (Youtube)
                  Source: global trafficDNS traffic detected: DNS query: piaktrip.online
                  Source: global trafficDNS traffic detected: DNS query: undermymindops.com
                  Source: global trafficDNS traffic detected: DNS query: ntp.msn.com
                  Source: global trafficDNS traffic detected: DNS query: bzib.nelreports.net
                  Source: global trafficDNS traffic detected: DNS query: clients2.googleusercontent.com
                  Source: global trafficDNS traffic detected: DNS query: sb.scorecardresearch.com
                  Source: global trafficDNS traffic detected: DNS query: c.msn.com
                  Source: global trafficDNS traffic detected: DNS query: assets.msn.com
                  Source: global trafficDNS traffic detected: DNS query: api.msn.com
                  Source: global trafficDNS traffic detected: DNS query: chrome.cloudflare-dns.com
                  Source: unknownHTTP traffic detected: POST /close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaDq89YOn9%2BrlNobdAW7x9gZTI58ay0lSXUb4m%2BEPhKTg%3D%3D HTTP/1.1Connection: Keep-AliveAccept: */*User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.3.1 Safari/605.1.15Content-Length: 147Host: piaktrip.online
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCA-1.crt0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDCodeSigningCA-1.crt0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertAssuredIDRootCA.crt0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootCA.crt0B
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414379430.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2398443226.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG3.crt0B
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://cacerts.digicert.com/DigiCertSHA2AssuredIDTimestampingCA.crt0
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl04
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.rootca1.amazontrust.com/rootca1.crl0
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningCAR36.crl0y
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoPublicCodeSigningRootR46.crl0
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl.sectigo.com/SectigoRSATimeStampingCA.crl0t
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDCA-1.crl08
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0:
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertAssuredIDRootCA.crl0P
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl07
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootCA.crl0=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414379430.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2398443226.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG3.crl0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/assured-cs-g1.crl00
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl3.digicert.com/sha2-assured-ts.crl02
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDCA-1.crl0w
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertAssuredIDRootCA.crl0:
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootCA.crl00
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/assured-cs-g1.crl0L
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://crl4.digicert.com/sha2-assured-ts.crl0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.rootca1.amazontrust.com/rootca1.cer0?
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningCAR36.crt0#
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoPublicCodeSigningRootR46.p7c0#
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://crt.sectigo.com/SectigoRSATimeStampingCA.crt0#
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.comodoca.com0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414379430.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2398443226.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0A
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0C
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0L
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://ocsp.digicert.com0O
                  Source: Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.rootca1.amazontrust.com0:
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://ocsp.sectigo.com0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429959076.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2445820758.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://oneocsp.micro
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429959076.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2445820758.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://oneocsp.microoft
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s1.symcb.com/pca3-g5.crl0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://s2.symcb.com0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crl0a
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcb.com/sv.crt0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://sv.symcd.com0&
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401E0000.00000002.00000001.01000000.00000010.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.???.xx/?search=%s
                  Source: Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/CPS0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.digicert.com/ssl-cps-repository.htm0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://www.flexerasoftware.com0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009F82000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A214000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004DD8000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.00000000026D8000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A29F000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: http://www.info-zip.org/
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401E0000.00000002.00000001.01000000.00000010.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.com
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.com/?Download=Find.Same.Images.OK
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.com/?Freeware/Find.Same.Images.OK/History
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.com/?seite=faq-Find.Same.Images.OK&faq=0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401E0000.00000002.00000001.01000000.00000010.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.softwareok.de
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.de/?Download=Find.Same.Images.OK
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.de/?Freeware/Find.Same.Images.OK/History
                  Source: Syncsign_v1.exe, 0000000C.00000000.1979747316.00000001401F4000.00000002.00000001.01000000.00000010.sdmpString found in binary or memory: http://www.softwareok.de/?seite=faq-Find.Same.Images.OK&faq=0
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.surfok.de/
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/cps0(
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.symauth.com/rpa00
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: http://www.vmware.com/0/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://x1.c.lencr.org/0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521706698.000000000820F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: http://x1.i.lencr.org/0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ac.ecosia.org/autocomplete?q=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://alekberg.net/privacy
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.000000000823D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com%22
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/MarketMismatchCoachMark.a03d30a2272eef7b7188.j
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/card-actions-wc.339ecd177eceacc21efc.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/clarity.36f98ce6150787681ef0.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/clarity.36f98ce6150787681ef0.js.47X
                  Source: Syncsign_v1.exe, 0000000C.00000003.2413716148.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-cscore.7146072dacb9c6d847f4.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-others.2137cc82b6e5933fac1e.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-sports-lib.3353d70875d18b84eeb8.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2413716148.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-sports-lib.3353d70875d18b84eeb8.js27aa.
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common-sports-lib.3353d70875d18b84eeb8.jsd9
                  Source: Syncsign_v1.exe, 0000000C.00000003.2444169556.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429117126.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.5443a5fa1fda69b63d4a.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2364088341.0000000008247000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/common.ccf37a049089f68490a9.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2400283290.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/experiences_top-sites-edgenext-wc_dist_TopSite
                  Source: Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/feedback.6a9b58a02a317bcb2465.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/float-button-group-wc.a178620524f626faaa26.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430807310.0000000002E9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_weather-common-utils_dist_data_FeedWeathe
                  Source: Syncsign_v1.exe, 0000000C.00000003.2400283290.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/libs_weather-shared-wc_dist_weather-card_index
                  Source: Syncsign_v1.exe, 0000000C.00000003.2442523277.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info-service.1ab254b14f307ba92272.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2442523277.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-info-service.1ab254b14f307ba92272.jsX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2459610313.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/money-quote-vertical-watchlist.0d1ea40902d23b1
                  Source: Syncsign_v1.exe, 0000000C.00000003.2459610313.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nas-highlight-v1.719885c50eb63eceb2e3.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2459610313.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nativeadstemplates.0610aec23b25fd495dd1.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-coach-mark.60db4ae4d0a1dbd4f578.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-coach-mark.60db4ae4d0a1dbd4f578.jsX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2398203500.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429117126.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-placement-manager.852a662b8fe0e45847
                  Source: Syncsign_v1.exe, 0000000C.00000003.2459610313.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/nurturing-placement-manager.fc7b7cad27260d2f6a
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/ocvFeedback.c7b366c72ae6ca3a3d87.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/toast-wc.06286d1f2b3e116f33f9.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-card-data-connector.788e805031bd113b61
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.41519397eee9214553b6.js
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/bundles/v1/edgeChromium/latest/weather-one-liner.41519397eee9214553b6.jsX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.000000000823D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/config/v1/&os=windows&locale=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2402168290.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/service/news/feed/pages/weblayout?User=m-0F2C6A66B41D685530457FC3B59769D2&act
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/brand/new-msn-logo-color-black.svg
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401556626.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430807310.0000000002E9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/common/icons/copilot_color.svg
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401556626.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430807310.0000000002E9E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/common/icons/copilot_color.svgX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/FeedSettings.svg
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/staticsb/statics/latest/icons-wc/icons/FeedSettings.svgkB
                  Source: Syncsign_v1.exe, 0000000C.00000003.2413716148.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/taskbar_v10/Condition_Card/MostlySunnyD
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://azureedge.net
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://browser.events.data.msn.com/OneCollector/1.0?cors=true&content-type=application/x-json-strea
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2400419371.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusiness
                  Source: Syncsign_v1.exe, 0000000C.00000003.2400419371.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusinessP
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://bzib.nelreports.net/api/report?cat=bingbusinessler
                  Source: Syncsign_v1.exe, 0000000C.00000003.2402168290.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://c.msn.com/c.gif?rnd=1741108158726&udc=true&pg.n=default&pg.t=dhp&pg.c=547&pg.p=anaheim&rf=&t
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chrome.cloudflare-dns.com/dns-queryed
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://chromium.dns.nextdns.io
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://cleanbrowsing.org/privacy
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/cps0%
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://d.symcb.com/rpa0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2400283290.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report
                  Source: Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/report?cat=msn
                  Source: Syncsign_v1.exe, 0000000C.00000003.2400283290.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://deff.nelreports.net/api/reportcat=msn
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Locations/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.ditu.live.com/REST/v1/Routes/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Locations/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dev.virtualearth.net/REST/v1/Routes/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.cloudflare.com/1.1.1.1/privacy/public-dns-resolver/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacy
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://developers.google.com/speed/public-dns/privacyquery
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns.quad9.net/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns.sb/privacy/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dns.sb/privacy/Char
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://dnsnl.alekberg.net/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/adult-filter
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/family-filter
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cleanbrowsing.org/doh/security-filter
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.cox.net/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.familyshield.opendns.com/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414509724.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://doh.xfinity.com/dns-query
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/ac/?q=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/chrome_newtab
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2398203500.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/domains_config_gz/2.8.76/asset?assetgroup=EntityExtrac
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379219234.0000000002F16000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_M365_light.png/1.7.32/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2398203500.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2398203500.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_edrop_maximal_light.png/1.1.12/assett
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379219234.0000000002F16000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_games_maximal_light.png/1.7.1/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2364088341.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_manifest_gz/4.7.107/asset?assetgroup=Sho
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_outlook_light.png/1.9.10/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_search_maximal_light.png/1.3.6/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_shopping_maximal_light.png/1.4.0/assetX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://edgeassetservice.azureedge.net/assets/edge_hub_apps_toolbox_maximal_light.png/1.5.13/asset
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.000000000823D000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ent-api.msn.com/%22
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11MSkH.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA13Q6AL.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1tU84U.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1tU84U.img=APP_ANON&source=market-consolid
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1u24yb.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAc9vHK.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAdTRDX.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAdTRDX.imgX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2415908056.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430324424.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msBaE.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msOZ4.img
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BB1msOZ4.imgN
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.live.com/Char
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://login.microsoftonline.com/X
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379066263.0000000008247000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://msn.com
                  Source: Syncsign_v1.exe, 0000000C.00000003.2416234982.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://msn.com0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://nextdns.io/privacy
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://nextdns.io/privacyr
                  Source: Syncsign_v1.exe, 0000000C.00000003.2447138826.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com
                  Source: Syncsign_v1.exe, 0000000C.00000003.2446900428.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com-
                  Source: Syncsign_v1.exe, 0000000C.00000003.2398203500.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2398443226.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2446515509.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2401322071.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2447138826.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430736637.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/accept-encodinggzip
                  Source: Syncsign_v1.exe, 0000000C.00000003.2379219234.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/e6
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp/service-worker.js?bundles=latest&riverAgeMinutes=2880&navAgeMinutes=288
                  Source: Syncsign_v1.exe, 0000000C.00000003.2414583194.0000000002F0F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429117126.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New
                  Source: Syncsign_v1.exe, 0000000C.00000003.2401505235.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.com/edge/ntp?locale=en-GB&title=New%20tab&dsp=1&sp=Bing&isFREModalBackground=1&start
                  Source: Syncsign_v1.exe, 0000000C.00000003.2446900428.0000000008237000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comAccess-Control-Expose-Headers:
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428776460.0000000002F11000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comreport-to
                  Source: Syncsign_v1.exe, 0000000C.00000003.2447138826.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comreport-to:
                  Source: Syncsign_v1.exe, 0000000C.00000003.2430736637.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comsec-fetch-sitesame-sitesec-fetch-modecorssec-fetch-destemptyrefererhttps://ntp.ms
                  Source: Syncsign_v1.exe, 0000000C.00000003.2429883458.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://ntp.msn.comx-as-suppresssetcookie:1cache-control:private
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://odvr.nic.cz/doh
                  Source: Syncsign_v1.exe, 0000000C.00000003.2399299768.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://permanently-removed.invalid/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2587534172.00000000080DE000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2586589191.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2561677642.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2600927842.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2587863714.00000000080E5000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2552468786.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2165575075.0000000000640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2600927842.00000000080E6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG
                  Source: Syncsign_v1.exe, 0000000C.00000003.2575790733.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2587534172.00000000080C7000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2219581484.00000000005C7000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2543235465.00000000080C7000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0VrgaD
                  Source: Syncsign_v1.exe, 0000000C.00000003.2219785561.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2174101413.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2165575075.0000000000640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/d
                  Source: Syncsign_v1.exe, 0000000C.00000003.2543603130.00000000080E5000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online/e
                  Source: Syncsign_v1.exe, 0000000C.00000003.2587534172.00000000080DE000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2543603130.00000000080E5000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2586589191.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2561677642.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2600927842.00000000080E6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2587863714.00000000080E5000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2552468786.00000000080E6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online:443
                  Source: Syncsign_v1.exe, 0000000C.00000003.2586442189.0000000000645000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2532990186.000000000810F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2609636545.0000000000640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online:443/close_your_eyes.html?eydrvmmnym=MUVtlZibsoBlbXIzdL17b666d0qCtUyG7PFzsf0V
                  Source: Syncsign_v1.exe, 0000000C.00000003.2561677642.00000000080E6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online:443=
                  Source: Syncsign_v1.exe, 0000000C.00000003.2600927842.00000000080E6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://piaktrip.online:443GA
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://public.dns.iij.jp/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://public.dns.iij.jp/r
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428708763.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2443571857.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sapphire.azureedge.net
                  Source: Syncsign_v1.exe, 0000000C.00000003.2416333630.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/b2?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.
                  Source: Syncsign_v1.exe, 0000000C.00000003.2416333630.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sb.scorecardresearch.com/b?rn=1741108158726&c1=2&c2=3000001&cs_ucfr=1&c7=https%3A%2F%2Fntp.m
                  Source: SplashWin.exe, 00000002.00000003.1692875763.0000000000C91000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sectigo.com/CPS0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2395896130.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://sn.com
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/kb/customize-firefox-controls-buttons-and-toolbars?utm_source=firefox-br
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.mozilla.org/products/firefoxgro.allizom.troppus.zvXrErQ5GYDF
                  Source: Syncsign_v1.exe, 0000000C.00000003.2274568175.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2274053590.000000000824A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016
                  Source: Syncsign_v1.exe, 0000000C.00000003.2274568175.0000000008226000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/7D48285B-20E8-4B9B-91AD-216E34163BAD?wt.mc_id=EnterPK2016Examples
                  Source: Syncsign_v1.exe, 0000000C.00000003.2274568175.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2274053590.000000000824A000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17
                  Source: Syncsign_v1.exe, 0000000C.00000003.2274568175.0000000008226000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://support.office.com/article/94ba2e0b-638e-4a92-8857-2cb5ac1d8e17Install
                  Source: Syncsign_v1.exe, 0000000C.00000003.2447138826.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://tp.msn.
                  Source: Syncsign_v1.exe, 0000000C.00000003.2219785561.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2174101413.0000000000640000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2219195476.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2155353110.0000000002ECF000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2165575075.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2155189188.0000000002EAF000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2176069414.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571885800.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2155189188.0000000002ECF000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com/GELEPLLV.msi
                  Source: Syncsign_v1.exe, 0000000C.00000003.2194679437.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2209545939.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2180739118.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2176069414.0000000002ED6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com/GELEPLLV.msi-LM
                  Source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2194679437.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2514213033.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2209545939.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611946757.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2180739118.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2520034004.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2515907559.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2176069414.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571885800.0000000002ED6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com/GELEPLLV.msi5L
                  Source: Syncsign_v1.exe, 0000000C.00000003.2194679437.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2209545939.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2180739118.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2176069414.0000000002ED6000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com/GELEPLLV.msiayrtu5In8r
                  Source: Syncsign_v1.exe, 0000000C.00000003.2219785561.000000000060A000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2174101413.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2219195476.00000000005F8000.00000004.00000020.00020000.00000000.sdmpString found in binary or memory: https://undermymindops.com:443/GELEPLLV.msiF
                  Source: Syncsign_v1.exe, 0000000C.00000003.2361915510.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.cisco.com/c/en/us/about/legal/privacy-full.html
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2181889335.000000000844F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008B3E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610848721.0000000002721000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2178851811.000000000824A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2135146722.000000000A2F5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpString found in binary or memory: https://www.digicert.com/CPS0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.ecosia.org/newtab/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2273015839.0000000002F1B000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico
                  Source: Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/chromewebstore/v1.1/items/verify
                  Source: Syncsign_v1.exe, 0000000C.00000003.2428174588.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442523277.0000000008244000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2414255038.000000000822E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2460065075.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.googleapis.com/chromewebstore/v1.1/items/verify025-03-04T17:09:14Z;
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088A4000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/about/gro.allizom.www.VsJpOAWrHqB2
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/contribute/gro.allizom.www.n0g9CLHwD9nR
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/en-US/privacy/firefox/Firefox
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/firefox/?utm_medium=firefox-desktop&utm_source=bookmarks-toolbar&utm_campaig
                  Source: Syncsign_v1.exe, 0000000C.00000003.2526981131.00000000088AB000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.mozilla.org/privacy/firefox/gro.allizom.www.
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.nic.cz/odvr/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377241551.000000000822E000.00000004.00000001.00020000.00000000.sdmpString found in binary or memory: https://www.nic.cz/odvr/har
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49863
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49878 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50063
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49859
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49906 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49858
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49854
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49853
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49996 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49820 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49858 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49872 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49823 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50009 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50034 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49873 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49892 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50028 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49904 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49836
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50009
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49822 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49870 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49910 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49853 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49825 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49829
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49811 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49827
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49907 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49825
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49824
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49823
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49822
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49821
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49997 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49820
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50019
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49813 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49859 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49836 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49871 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49807 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50052 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49810 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49813
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49811
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49810
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50028
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49892
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49919 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49879 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49827 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49911 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49807
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49905 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49801
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49863 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50063 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49821 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50019 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50034
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49854 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49908 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49801 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49824 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49919
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49917
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49879
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49878
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49911
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49910
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49997
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49996
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49873
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49872
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49871
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49870
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49917 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50044
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49829 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49908
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 50052
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49907
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49906
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49905
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50044 -> 443
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49904
                  Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49903
                  Source: unknownNetwork traffic detected: HTTP traffic on port 49903 -> 443
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49762 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49763 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 172.67.164.91:443 -> 192.168.2.4:49766 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:49765 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50009 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50019 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50028 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50034 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50044 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50052 version: TLS 1.2
                  Source: unknownHTTPS traffic detected: 104.21.40.182:443 -> 192.168.2.4:50063 version: TLS 1.2

                  System Summary

                  barindex
                  Malicious sample detected (through community Yara rule)
                  Source: 35.2.cmd.exe.60500c8.7.unpack, type: UNPACKEDPEMatched rule: Detects Arechclient2 RAT Author: ditekSHen
                  Source: 35.2.cmd.exe.60500c8.7.raw.unpack, type: UNPACKEDPEMatched rule: Detects Arechclient2 RAT Author: ditekSHen
                  Source: C:\Users\user\AppData\Local\Temp\xwielkiowcx, type: DROPPEDMatched rule: Detects Arechclient2 RAT Author: ditekSHen
                  PE file has a writeable .text section
                  Source: ISRT.dll.22.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c3b54.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\inprogressinstallinfo.ipiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\SourceHash{B5485FA4-5A88-4A48-BDC7-E71099C47F55}Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\MSI3C8C.tmpJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c3b56.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\Installer\5c3b56.msiJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile deleted: C:\Windows\Installer\5c3b56.msiJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE14F22_2_6CDE14F2
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE66D42_2_6CDE66D4
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE66E42_2_6CDE66E4
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE1E072_2_6CDE1E07
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE518C2_2_6CDE518C
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE51882_2_6CDE5188
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE53CC2_2_6CDE53CC
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE53602_2_6CDE5360
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B1E073_2_6C8B1E07
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B64943_2_6C8B6494
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B14F23_2_6C8B14F2
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B642C3_2_6C8B642C
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B64583_2_6C8B6458
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B65EC3_2_6C8B65EC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B66D43_2_6C8B66D4
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B66E43_2_6C8B66E4
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B66183_2_6C8B6618
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B66343_2_6C8B6634
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B51883_2_6C8B5188
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61BC3_2_6C8B61BC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61B43_2_6C8B61B4
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61CC3_2_6C8B61CC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61C03_2_6C8B61C0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61DC3_2_6C8B61DC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61D03_2_6C8B61D0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B61343_2_6C8B6134
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B62843_2_6C8B6284
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B625C3_2_6C8B625C
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B62683_2_6C8B6268
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B62643_2_6C8B6264
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B62783_2_6C8B6278
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B62743_2_6C8B6274
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B53CC3_2_6C8B53CC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B53DC3_2_6C8B53DC
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B53F83_2_6C8B53F8
                  Source: Joe Sandbox ViewDropped File: C:\Users\user\AppData\Local\Florilegium\SplashWin.exe C5E650B331FA5292872FDAEDE3A75C8167A0F1280CE0CD3D58B880D23854BDB1
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: String function: 6CE1E6CF appears 38 times
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: String function: 6CE1E69B appears 123 times
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: String function: 6C8EE69B appears 128 times
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: String function: 6C8EE6CF appears 55 times
                  Source: Syncsign_v1.exe.4.drStatic PE information: Resource name: ZIP type: Zip archive data (empty)
                  Source: MSI1B74.tmp.21.drStatic PE information: Resource name: PUBLICKEY type: b.out overlay separate pure segmented executable V2.3 186 286 286 386 Large Text Large Data Huge Objects Enabled
                  Source: pwvtwt.4.drStatic PE information: Number of sections : 12 > 10
                  Source: ctgfskqqpp.19.drStatic PE information: Number of sections : 12 > 10
                  Source: 35.2.cmd.exe.60500c8.7.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
                  Source: 35.2.cmd.exe.60500c8.7.raw.unpack, type: UNPACKEDPEMatched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
                  Source: C:\Users\user\AppData\Local\Temp\xwielkiowcx, type: DROPPEDMatched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
                  Source: ISRT.dll.22.drStatic PE information: Section: .reloc IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  Source: ISRT.dll.22.drStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
                  Source: Syncsign_v1.exe, 0000000C.00000003.2575675070.0000000002EA1000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.sln\
                  Source: Syncsign_v1.exe, 0000000C.00000003.2570973470.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.slnp.ini
                  Source: Syncsign_v1.exe, 0000000C.00000003.2572551786.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .slnA
                  Source: Syncsign_v1.exe, 0000000C.00000003.2570973470.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.slnp.inig
                  Source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2194679437.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2514213033.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2209545939.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611946757.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2155317708.0000000002ED0000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.slnlX
                  Source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2219785561.0000000000640000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2194679437.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2575675070.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2155292083.0000000002E91000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2514213033.0000000002ED6000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.sln
                  Source: Syncsign_v1.exe, 0000000C.00000003.2572551786.0000000002F0F000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: *.slnd
                  Source: Syncsign_v1.exe, 0000000C.00000003.2575675070.0000000002EA1000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: .slnL
                  Source: classification engineClassification label: mal100.troj.spyw.evad.winMSI@90/359@22/19
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDF2440 _Statvfs,GetDiskFreeSpaceExW,2_2_6CDF2440
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\CML3CBB.tmpJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeMutant created: \Sessions\1\BaseNamedObjects\filemanager1
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6808:120:WilError_03
                  Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5480:120:WilError_03
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Windows\TEMP\~DF48994DFFE5D1D0F6.TMPJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCommand line argument: AnyViewer2_2_007819D0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCommand line argument: AnyViewer3_2_006F19D0
                  Source: C:\Windows\SysWOW64\cmd.exeFile read: C:\Users\desktop.iniJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiersJump to behavior
                  Source: 95.msiStatic file information: TRID: Microsoft Windows Installer (60509/1) 88.31%
                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\95.msi"
                  Source: unknownProcess created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Florilegium\SplashWin.exe "C:\Users\user\AppData\Local\Florilegium\SplashWin.exe"
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeProcess created: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe
                  Source: unknownProcess created: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe "C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe"
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\UJTcSAwaleqsjRv9HspDxp.msi"
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F8E1D76AA19B02239F060918BBE40BDC C
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2A270F6-71BD-4CF4-BCD4-62D608E7C6DE}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1387D03A-F134-4442-AA6E-ADB2CD5C2ED0}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F52B7AF0-9702-4246-A1ED-1A9047376A3D}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C162230-114A-4D2A-AEC6-15BB323AE6BC}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A686CD30-0C56-4C54-86B5-DBEC67B4DBCD}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D7823393-5AA6-4AB5-A0AE-4EEA1F8EB985}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40795E86-F3F1-4D62-A29C-F60FADC828BF}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50347EEE-E43A-4759-93EA-F28098E49F12}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0B21F84-7F7C-4341-B415-DC7FBF2E3720}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF103E10-17E9-41D3-ACA3-F40B15C7CB56}
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exe C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exe
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"
                  Source: unknownProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory=Default --flag-switches-begin --flag-switches-end --disable-nacl --do-not-de-elevate
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2092,i,6567631385547770601,15567002081603104977,262144 /prefetch:3
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2736 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:3
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6472 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Florilegium\SplashWin.exe "C:\Users\user\AppData\Local\Florilegium\SplashWin.exe"Jump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\syswow64\MsiExec.exe -Embedding F8E1D76AA19B02239F060918BBE40BDC CJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeProcess created: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exe C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\UJTcSAwaleqsjRv9HspDxp.msi" Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --profile-directory="Default"Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{E2A270F6-71BD-4CF4-BCD4-62D608E7C6DE}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{1387D03A-F134-4442-AA6E-ADB2CD5C2ED0}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{F52B7AF0-9702-4246-A1ED-1A9047376A3D}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{4C162230-114A-4D2A-AEC6-15BB323AE6BC}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A686CD30-0C56-4C54-86B5-DBEC67B4DBCD}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{D7823393-5AA6-4AB5-A0AE-4EEA1F8EB985}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{40795E86-F3F1-4D62-A29C-F60FADC828BF}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{50347EEE-E43A-4759-93EA-F28098E49F12}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{A0B21F84-7F7C-4341-B415-DC7FBF2E3720}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exe {EFB7539B-24F3-46B6-AF6E-3B021B51EFEF}:{BF103E10-17E9-41D3-ACA3-F40B15C7CB56}Jump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeProcess created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exe C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2212 --field-trial-handle=2092,i,6567631385547770601,15567002081603104977,262144 /prefetch:3
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=2736 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:3
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-GB --service-sandbox-type=asset_store_service --mojo-platform-channel-handle=6472 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=entity_extraction_service.mojom.Extractor --lang=en-GB --service-sandbox-type=entity_extraction --onnx-enabled-for-ee --mojo-platform-channel-handle=6596 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe "C:\Program Files (x86)\Microsoft\Edge\Application\117.0.2045.47\identity_helper.exe" --type=utility --utility-sub-type=winrt_app_id.mojom.WinrtAppIdService --lang=en-GB --service-sandbox-type=none --mojo-platform-channel-handle=7288 --field-trial-handle=2412,i,7594012832327003948,1063545990671371435,262144 /prefetch:8
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeProcess created: unknown unknown
                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: srclient.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: spp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: powrprof.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vssapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vsstrace.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: umpdc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: vcruntime140_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ucrtbase_clr0400.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: rstrtmgr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: duilib_u.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: msvcp140.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: pla.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: pdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: tdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: wevtapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: shdocvw.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: duilib_u.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: msvcp140.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: pla.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: pdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: tdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: wevtapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: shdocvw.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: shdocvw.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: mswsock.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: iphlpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: winnsi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: dhcpcsvc6.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: dhcpcsvc.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: webio.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: dnsapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: rasadhlp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: fwpuclnt.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: schannel.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: mskeyprotect.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ntasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ncrypt.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ncryptsslp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: msasn1.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: rsaenh.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: cryptbase.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: gpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: dpapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: edputil.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: urlmon.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: srvcli.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: windows.staterepositoryps.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: policymanager.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: msvcp110_win.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: appresolver.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: bcp47langs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: slc.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: userenv.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: sppc.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: onecorecommonproxystub.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: onecoreuapcommonproxystub.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: windowscodecs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: ondemandconnroutehelper.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: duilib_u.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: vcruntime140.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: msvcp140.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: dbghelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: pla.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: pdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: tdh.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: cabinet.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: wevtapi.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: shdocvw.dllJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: winhttp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dllJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: srpapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: tsappcmp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textinputframework.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coreuicomponents.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: ntmarta.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: coremessaging.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wintypes.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: propsys.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: textshaping.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netapi32.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: wkscli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: netutils.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mscoree.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: sspicli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: msihnd.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: dwmapi.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: pcacli.dllJump to behavior
                  Source: C:\Windows\System32\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: aclayers.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: mpr.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sfc_os.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wininet.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: iertutil.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: version.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: windows.storage.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: wldp.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: profapi.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: riched32.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: riched20.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: usp10.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: msls31.dllJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: shdocvw.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: version.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeSection loaded: cryptsp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: apphelp.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dllJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: wldp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: wldp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: wldp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: windows.storage.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: wldp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: kernel.appcore.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: uxtheme.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeSection loaded: sxs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: apphelp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: duilib_u.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: vcruntime140.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: msvcp140.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: vcruntime140.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: dbghelp.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: pla.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: pdh.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: tdh.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: cabinet.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: wevtapi.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: shdocvw.dll
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: winhttp.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: winbrand.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: wldp.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: propsys.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: profapi.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: linkinfo.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: ntshrui.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: sspicli.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: srvcli.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: cscapi.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: bitsproxy.dll
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: netutils.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: apphelp.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: kernel.appcore.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: twinapi.appcore.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: wintypes.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: mrmcorer.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: onecoreuapcommonproxystub.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: biwinrt.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windows.staterepositorycore.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: cryptsp.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: wincorlib.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windows.security.authentication.web.core.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: usermgrproxy.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: iertutil.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: vaultcli.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: threadpoolwinrt.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windows.ui.xaml.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: coremessaging.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: bcp47langs.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: dcomp.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windows.storage.applicationdata.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windows.storage.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: wldp.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: propsys.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: onecorecommonproxystub.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: usermgrcli.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: uxtheme.dll
                  Source: C:\Windows\System32\backgroundTaskHost.exeSection loaded: windowscodecs.dll
                  Source: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00020420-0000-0000-C000-000000000046}\InprocServer32Jump to behavior
                  Source: etfd.4.drLNK file: ..\..\Roaming\sqSystem\SplashWin.exe
                  Source: C:\Windows\SysWOW64\msiexec.exeFile written: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\IsConfig.iniJump to behavior
                  Source: C:\Windows\SysWOW64\msiexec.exeFile opened: C:\Windows\SysWOW64\RICHED32.DLLJump to behavior
                  Source: Window RecorderWindow detected: More than 3 window changes detected
                  Source: 95.msiStatic file information: File size 4800512 > 1048576
                  Source: Binary string: C:\CodeBases\isdev\Redist\Language Independent\i386\ISSetup.pdb source: Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\ source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: winload_prod.pdb0O source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb,, source: SplashWin.exe, 00000002.00000002.1696637591.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000002.00000000.1680293396.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000003.00000002.1754974383.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000003.00000000.1695668433.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2129284757.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000012.00000000.2070283939.00000000006F3000.00000002.00000001.01000000.00000008.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831` source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\Local State source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdbww3 source: SplashWin.exe, 00000002.00000002.1703236204.000000006CED5000.00000002.00000001.01000000.00000004.sdmp, SplashWin.exe, 00000003.00000002.1759175255.000000006C9C5000.00000002.00000001.01000000.00000009.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143887734.000000006F885000.00000002.00000001.01000000.00000009.sdmp
                  Source: Binary string: ntkrnlmp.pdb source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdbUGP source: SplashWin.exe, 00000002.00000002.1702480957.000000000A52A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1702636911.000000000A880000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758481320.000000000AB10000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758593751.000000000AECC000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758387014.000000000A7B5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2044539649.0000000005360000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043077712.0000000004A73000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136438297.000000000A84A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2137680603.000000000AF57000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136872506.000000000ABA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333618784.0000000005292000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: ntdll.pdbUGP source: Syncsign_v1.exe, 0000000C.00000002.2614200148.0000000004680000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616843682.000000000588A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618117574.0000000006283000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614978928.0000000004C81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613664255.0000000004289000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619214817.0000000006883000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616238315.000000000548C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619801124.0000000006A88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617652996.0000000005E85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614779950.0000000004A8F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2612947658.0000000003C8D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613423974.000000000408C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615463459.000000000508C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2620132953.0000000006C85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614501285.0000000004884000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618875209.000000000668D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616555219.0000000005681000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617367794.0000000005C88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613932258.0000000004489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615682026.000000000528F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617102811.0000000005A84000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613193988.0000000003E82000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615242240.0000000004E8C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610628868.00000000022D2000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618415153.0000000006489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611410665.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617890909.0000000006083000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: wntdll.pdb source: SplashWin.exe, 00000002.00000002.1702480957.000000000A52A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1702636911.000000000A880000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758481320.000000000AB10000.00000004.00000800.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758593751.000000000AECC000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758387014.000000000A7B5000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2044539649.0000000005360000.00000004.00001000.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043077712.0000000004A73000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136438297.000000000A84A000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2137680603.000000000AF57000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2136872506.000000000ABA0000.00000004.00000800.00020000.00000000.sdmp, cmd.exe, 00000013.00000002.2333618784.0000000005292000.00000004.00000020.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: BC:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\AC\INetHistory source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17 source: Syncsign_v1.exe, 0000000C.00000003.2588756975.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611800889.0000000002E77000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2589101760.0000000002EA5000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\vcruntime140.i386.pdb source: SplashWin.exe, 00000002.00000002.1697019581.0000000000C77000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000002.00000002.1703371392.000000006E591000.00000020.00000001.01000000.00000005.sdmp, SplashWin.exe, 00000003.00000002.1759080373.000000006C931000.00000020.00000001.01000000.0000000A.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.0000000008A52000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2145040792.000000006F8F1000.00000020.00000001.01000000.0000000A.sdmp
                  Source: Binary string: C:\CodeBases\isdev\Src\Runtime\InstallScript\ISBEW64\x64\Release\ISBEW64.pdb source: ISBEW64.exe, 0000001A.00000000.2251643361.00007FF74E9A7000.00000002.00000001.01000000.00000011.sdmp
                  Source: Binary string: winload_prod.pdb source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: d_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Syncsign_v1.exe, 0000000C.00000003.2511701729.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\Local State source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831 source: Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: ntkrnlmp.pdb\X source: Syncsign_v1.exe, 0000000C.00000003.2523523160.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526741959.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525900932.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521183599.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2 source: Syncsign_v1.exe, 0000000C.00000003.2321808724.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2510663351.0000000002E9F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2444647514.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2364405863.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272318607.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276312317.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2379292878.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2401556626.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2442173727.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316497382.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2361574610.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2271093717.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2459846546.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2427838775.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2416464551.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2429991569.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2362534640.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2443068349.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2400468049.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272141058.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2511119235.0000000002EA3000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2376835411.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2338777727.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2430807310.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2272768188.0000000002EA2000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2396961372.0000000002E9E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2376279251.0000000002EA0000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2428412489.0000000002E9E0
                  Source: Binary string: G\??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\profi source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\profi source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2521131978.0000000002E81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2526556420.0000000002E7E000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: ntdll.pdb source: Syncsign_v1.exe, 0000000C.00000002.2614200148.0000000004680000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616843682.000000000588A000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618117574.0000000006283000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614978928.0000000004C81000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613664255.0000000004289000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619214817.0000000006883000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616238315.000000000548C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2619801124.0000000006A88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617652996.0000000005E85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614779950.0000000004A8F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2612947658.0000000003C8D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613423974.000000000408C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615463459.000000000508C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2620132953.0000000006C85000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2614501285.0000000004884000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618875209.000000000668D000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2616555219.0000000005681000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617367794.0000000005C88000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613932258.0000000004489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615682026.000000000528F000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617102811.0000000005A84000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2613193988.0000000003E82000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2615242240.0000000004E8C000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2610628868.00000000022D2000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2618415153.0000000006489000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2611410665.0000000002C60000.00000004.00001000.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2617890909.0000000006083000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: p.pdb source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: E:\workdir\ProgramDatabase\DuiLib_u.pdb source: SplashWin.exe, 00000002.00000002.1703236204.000000006CED5000.00000002.00000001.01000000.00000004.sdmp, SplashWin.exe, 00000003.00000002.1759175255.000000006C9C5000.00000002.00000001.01000000.00000009.sdmp, Syncsign_v1.exe, 0000000C.00000003.2189994117.000000000855B000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143887734.000000006F885000.00000002.00000001.01000000.00000009.sdmp
                  Source: Binary string: E:\workdir\vc\rbin\RCClient\SplashWin.pdb source: SplashWin.exe, 00000002.00000002.1696637591.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000002.00000000.1680293396.0000000000783000.00000002.00000001.01000000.00000003.sdmp, SplashWin.exe, 00000003.00000002.1754974383.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000003.00000000.1695668433.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2129284757.00000000006F3000.00000002.00000001.01000000.00000008.sdmp, SplashWin.exe, 00000012.00000000.2070283939.00000000006F3000.00000002.00000001.01000000.00000008.sdmp
                  Source: Binary string: \??\C:\Users\user\AppData\Local\Temp\Symbols\ntkrnlmp.pdb\68A17FAF3012B7846079AEECDBE0A5831\profiles.ini source: Syncsign_v1.exe, 0000000C.00000003.2575675070.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2574559184.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571448557.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2571705048.0000000002EA1000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: Chromep.pdb source: Syncsign_v1.exe, 0000000C.00000003.2308013298.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2276401109.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2275330898.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2273653897.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2316556969.0000000002ED6000.00000004.00000001.00020000.00000000.sdmp
                  Source: Binary string: D:\agent\_work\20\s\\binaries\x86ret\bin\i386\\msvcp140.i386.pdb source: SplashWin.exe, SplashWin.exe, 00000003.00000002.1759006023.000000006C8B1000.00000020.00000001.01000000.0000000B.sdmp, Syncsign_v1.exe, 0000000C.00000003.2203231613.000000000876A000.00000004.00000001.00020000.00000000.sdmp, SplashWin.exe, 00000012.00000002.2143252265.000000006CBF1000.00000020.00000001.01000000.0000000B.sdmp
                  Source: Binary string: C:\Users\user\AppData\Local\Temp\Symbols\winload_prod.pdb\01AB9056EA9380F71644C4339E3FA1AC2\profiles.inih source: Syncsign_v1.exe, 0000000C.00000003.2522687804.0000000002EA4000.00000004.00000001.00020000.00000000.sdmp
                  Source: initial sampleStatic PE information: section where entry point is pointing to: .rsrc
                  Source: DuiLib_u.dll.2.drStatic PE information: real checksum: 0xda891 should be: 0xe665e
                  Source: pwvtwt.4.drStatic PE information: real checksum: 0x28e922 should be: 0x29bc32
                  Source: DuiLib_u.dll.22.drStatic PE information: real checksum: 0xda891 should be: 0xe665e
                  Source: xwielkiowcx.35.drStatic PE information: real checksum: 0x0 should be: 0xcdcb2
                  Source: _isres_0x0409.dll.22.drStatic PE information: real checksum: 0x0 should be: 0x1c5ec2
                  Source: DuiLib_u.dll.1.drStatic PE information: real checksum: 0xda891 should be: 0xe665e
                  Source: MSI1B74.tmp.21.drStatic PE information: real checksum: 0x0 should be: 0x291f39
                  Source: ctgfskqqpp.19.drStatic PE information: real checksum: 0x28e922 should be: 0x29bc32
                  Source: msvcp140.dll.1.drStatic PE information: section name: .didat
                  Source: msvcp140.dll.2.drStatic PE information: section name: .didat
                  Source: Syncsign_v1.exe.4.drStatic PE information: section name: Shared
                  Source: pwvtwt.4.drStatic PE information: section name: .xdata
                  Source: pwvtwt.4.drStatic PE information: section name: hrnoo
                  Source: ctgfskqqpp.19.drStatic PE information: section name: .xdata
                  Source: ctgfskqqpp.19.drStatic PE information: section name: hrnoo
                  Source: MSI1B74.tmp.21.drStatic PE information: section name: .orpc
                  Source: msvcp140.dll.22.drStatic PE information: section name: .didat
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_00782A26 push ecx; ret 2_2_00782A39
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CE1E675 push ecx; ret 2_2_6CE1E688
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDE1119 pushad ; retn 0000h2_2_6CDE12B0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_006F2A26 push ecx; ret 3_2_006F2A39
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8EE675 push ecx; ret 3_2_6C8EE688
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8B1119 pushad ; retn 0000h3_2_6C8B12B0
                  Source: ISRT.dll.22.drStatic PE information: section name: .text entropy: 7.9838191086194135
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISRT.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeFile created: C:\Users\user\AppData\Roaming\sqSystem\DuiLib_u.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI1B74.tmpJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\DuiLib_u.dllJump to dropped file
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeFile created: C:\Users\user\AppData\Roaming\sqSystem\msvcp140.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeJump to dropped file
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeFile created: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\xwielkiowcxJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\pwvtwtJump to dropped file
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeFile created: C:\Users\user\AppData\Roaming\sqSystem\vcruntime140.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\ctgfskqqppJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Florilegium\vcruntime140.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\msvcp140.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISBEW64.exeJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Florilegium\msvcp140.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\_isres_0x0409.dllJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\vcruntime140.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Florilegium\DuiLib_u.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeFile created: C:\Users\user\AppData\Local\Temp\MSI14BC.tmpJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\pwvtwtJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\ctgfskqqppJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeFile created: C:\Users\user\AppData\Local\Temp\xwielkiowcxJump to dropped file
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeRegistry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run MicrosoftEdgeAutoLaunch_C366A24065C39A1BE76E148DC2D0A868

                  Hooking and other Techniques for Hiding and Protection

                  barindex
                  Found hidden mapped module (file has been removed from disk)
                  Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\PWVTWT
                  Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\CTGFSKQQPP
                  Source: C:\Windows\SysWOW64\cmd.exeModule Loaded: C:\USERS\user\APPDATA\LOCAL\TEMP\XWIELKIOWCX
                  Uses known network protocols on non-standard ports
                  Source: unknownNetwork traffic detected: HTTP traffic on port 50035 -> 9000
                  Source: unknownNetwork traffic detected: HTTP traffic on port 9000 -> 50035
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOOPENFILEERRORBOXJump to behavior
                  Source: C:\Windows\System32\msiexec.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Windows\System32\conhost.exeProcess information set: NOGPFAULTERRORBOXJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess information set: NOOPENFILEERRORBOXJump to behavior

                  Malware Analysis System Evasion

                  barindex
                  Switches to a custom stack to bypass stack traces
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeAPI/Special instruction interceptor: Address: 6CAD7C44
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeAPI/Special instruction interceptor: Address: 6CAD7C44
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeAPI/Special instruction interceptor: Address: 6CAD7945
                  Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6CAD3B54
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeAPI/Special instruction interceptor: Address: 6C3A7C44
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeAPI/Special instruction interceptor: Address: 6C3A7945
                  Source: C:\Windows\SysWOW64\cmd.exeAPI/Special instruction interceptor: Address: 6C3A3B54
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeAPI/Special instruction interceptor: Address: 6C3A7C44
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeAPI/Special instruction interceptor: Address: 6C3A7945
                  Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\ISRT.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI1B74.tmpJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\xwielkiowcxJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\pwvtwtJump to dropped file
                  Source: C:\Windows\SysWOW64\cmd.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\ctgfskqqppJump to dropped file
                  Source: C:\Windows\SysWOW64\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\{47954601-611E-45CB-B5DF-BCBF1C48B102}\_isres_0x0409.dllJump to dropped file
                  Source: C:\Windows\System32\msiexec.exeDropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\MSI14BC.tmpJump to dropped file
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeAPI coverage: 0.9 %
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe TID: 1816Thread sleep time: -120000s >= -30000sJump to behavior
                  Source: C:\Windows\System32\conhost.exeLast function: Thread delayed
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeFile Volume queried: C:\ FullSizeInformationJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CDF20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,2_2_6CDF20D0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8C20D0 _Open_dir,FindFirstFileExW,__Read_dir,FindClose,3_2_6C8C20D0
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CE1F71A VirtualQuery,GetSystemInfo,2_2_6CE1F71A
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: noreply@vmware.com0
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1!0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2525403027.00000000005B8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: [_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&0{50
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: http://www.vmware.com/0/
                  Source: Syncsign_v1.exe, 0000000C.00000003.2155498557.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2609636545.000000000058C000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2165575075.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2525403027.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2154847811.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2174101413.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2219195476.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2552638214.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000002.2609636545.00000000005F8000.00000004.00000020.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2562048547.00000000005F8000.00000004.00000020.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.1
                  Source: cmd.exe, 00000013.00000002.2333952001.0000000005640000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: VMware, Inc.0
                  Source: Syncsign_v1.exe, 0000000C.00000003.2377307064.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2459667226.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2413857776.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2441940535.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2362034823.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2427711307.0000000008203000.00000004.00000001.00020000.00000000.sdmp, Syncsign_v1.exe, 0000000C.00000003.2396377431.0000000008203000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll
                  Source: C:\Windows\System32\msiexec.exeProcess information queried: ProcessInformationJump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_0078264A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0078264A
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_007814C0 GetProcessHeap,__Init_thread_footer,__Init_thread_footer,2_2_007814C0
                  Source: C:\Windows\System32\msiexec.exeProcess created: C:\Users\user\AppData\Local\Florilegium\SplashWin.exe "C:\Users\user\AppData\Local\Florilegium\SplashWin.exe"Jump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_0078264A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_0078264A
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_00782529 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_00782529
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_007827E0 SetUnhandledExceptionFilter,2_2_007827E0
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CE1EEB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,2_2_6CE1EEB8
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_6CE1F27B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,2_2_6CE1F27B
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_006F264A IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_006F264A
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_006F2529 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_006F2529
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_006F27E0 SetUnhandledExceptionFilter,3_2_006F27E0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8EEEB8 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,3_2_6C8EEEB8
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_6C8EF27B IsProcessorFeaturePresent,memset,memset,IsDebuggerPresent,SetUnhandledExceptionFilter,UnhandledExceptionFilter,3_2_6C8EF27B

                  HIPS / PFW / Operating System Protection Evasion

                  barindex
                  Found direct / indirect Syscall (likely to bypass EDR)
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF6301A3F9BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryValueKey: Direct from: 0x14011D93EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63003129DJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6301F79BFJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63019A2EEJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6301A3F13Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateThreadEx: Direct from: 0x7FF63002440CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Indirect: 0x14012000F
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6300CBDA2Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63011FAAEJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6300B9C4BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF630031D62Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FFE221C26A1Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63016D302Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF6301940A1Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300DDB54Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63003607CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63019E8FDJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63002F8D8Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateFile: Direct from: 0x7FF630247ADEJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateFile: Direct from: 0x7FF6300C402CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateMutant: Direct from: 0x7FF6302508CCJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtDeviceIoControlFile: Direct from: 0x7FF6301515ACJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x14011D808Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateThreadEx: Direct from: 0x7FF630024B5CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63003198BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6301937C0Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF6301A3CF4Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300C35FBJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF630040E03Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63011CA3DJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF630199E4CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationThread: Direct from: 0x7FF6302558F7Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF63011ECBD
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF630192231Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF6301F9AB1Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF630247724Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300C412EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF6300BD576Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeNtQuerySystemInformation: Direct from: 0x6C953538Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63003641FJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF630199CA8Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63002EB5BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF6301936C1Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtTerminateProcess: Direct from: 0x7FF6300C948CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateThreadEx: Direct from: 0x7FF63002456DJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x14011D864
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FFE221E4B5EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtMapViewOfSection: Direct from: 0x7FF63024B3D2Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF63024CA46
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeNtProtectVirtualMemory: Direct from: 0x76EF7B2EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF630119543Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF6301948E4Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtEnumerateValueKey: Direct from: 0x7FF6301819CCJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF630168FEBJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryValueKey: Direct from: 0x7FF6300E9BF7Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF63011CC8D
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtDelayExecution: Direct from: 0x7FF6301CCE3FJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300C636DJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300242B2Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63019840FJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtMapViewOfSection: Direct from: 0x7FF6300AF9D2Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6301AC048Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeNtProtectVirtualMemory: Direct from: 0x6CA42DEFJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6301939AEJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadFile: Direct from: 0x7FF6300C418BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtDelayExecution: Direct from: 0x7FF6301C1D81Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF630199BA7Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtDelayExecution: Direct from: 0x7FF6301C0835Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6301A101BJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryValueKey: Direct from: 0x7FF6300E9824Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300393A5Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryValueKey: Direct from: 0x7FF6300E8CD6Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF63024CA5A
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6300B981EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtMapViewOfSection: Direct from: 0x7FF63011FA6CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateThreadEx: Direct from: 0x7FF6301F645AJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300D15DAJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadFile: Direct from: 0x14011D832Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtOpenKeyEx: Direct from: 0x7FF6300E87E4Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF63024CA68
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtClose: Direct from: 0x7FF6300CB5EF
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryValueKey: Direct from: 0x7FF6300E8E85Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtSetInformationProcess: Direct from: 0x7FF6300CAC3EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF6300CB312Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6301B8893Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63019C948Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateFile: Direct from: 0x14011D7A4Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtCreateThreadEx: Direct from: 0x7FF63015E3C7Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtMapViewOfSection: Direct from: 0x7FF6300AFA9EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300DE56CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6300E55B6Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63024B7F3Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtDelayExecution: Direct from: 0x7FF6301BC65EJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF63002F142Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtReadVirtualMemory: Direct from: 0x7FF630193EC0Jump to behavior
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeNtQuerySystemInformation: Direct from: 0x6CE63538Jump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtMapViewOfSection: Direct from: 0x7FF63007B5BFJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x140120A3CJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtAllocateVirtualMemory: Direct from: 0x7FF6301AA43FJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeNtQueryInformationProcess: Direct from: 0x7FF63014743FJump to behavior
                  Maps a DLL or memory area into another process
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe protection: read writeJump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read writeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe protection: read writeJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeSection loaded: NULL target: C:\Windows\SysWOW64\cmd.exe protection: read write
                  Source: C:\Windows\SysWOW64\cmd.exeSection loaded: NULL target: C:\Windows\System32\backgroundTaskHost.exe protection: read write
                  Source: C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exeSection loaded: NULL target: unknown protection: readonly
                  Writes to foreign memory regions
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe base: 14011BC08Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe base: 212010Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe base: 14011BC08Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe base: 2AE010Jump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: 6B141000
                  Source: C:\Windows\SysWOW64\cmd.exeMemory written: C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe base: A76008
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeProcess created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\AppData\Local\Temp\UJTcSAwaleqsjRv9HspDxp.msi" Jump to behavior
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exeJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exe C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\{9B76187E-770E-4DA5-BBE1-15F96754ECC5}\SplashWin.exeProcess created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
                  Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\backgroundTaskHost.exe "C:\Windows\system32\BackgroundTaskHost.exe" -ServerName:BackgroundTaskHost.WebAccountProvider
                  Source: Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ?OPTYPE_PROGMAN_FIELDSWWW
                  Source: SplashWin.exe, 00000002.00000002.1702022982.0000000009FD8000.00000004.00000020.00020000.00000000.sdmp, SplashWin.exe, 00000003.00000002.1758063615.000000000A26A000.00000004.00000020.00020000.00000000.sdmp, cmd.exe, 00000004.00000002.2043318539.0000000004E21000.00000004.00000800.00020000.00000000.sdmpBinary or memory string: )[%d] Shell_TrayWndTrayNotifyWnd
                  Source: Syncsign_v1.exe, 0000000C.00000003.2220179304.0000000008E62000.00000004.00000001.00020000.00000000.sdmpBinary or memory string: ISLOG_VERSION_INFO..\..\..\Shared\LogServices2\LogDB.cppOPTYPE_PROGMANISLOGDB_USER_PROPERTIES
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_00782835 cpuid 2_2_00782835
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,2_2_6CE07770
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: __crtGetLocaleInfoEx,GetLocaleInfoEx,?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ,GetLocaleInfoEx,GetLocaleInfoW,2_2_6CDEC160
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: _Getdateorder,___lc_locale_name_func,__crtGetLocaleInfoEx,3_2_6C8D7770
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: __crtGetLocaleInfoEx,GetLocaleInfoEx,?isfx@?$basic_istream@_WU?$char_traits@_W@std@@@std@@QAEXXZ,GetLocaleInfoEx,GetLocaleInfoW,3_2_6C8BC160
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion InstallDateJump to behavior
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\System32\msiexec.exeQueries volume information: C:\ VolumeInformationJump to behavior
                  Source: C:\Windows\SysWOW64\cmd.exeQueries volume information: C:\ VolumeInformation
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_00782B75 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter,2_2_00782B75
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuidJump to behavior

                  Stealing of Sensitive Information

                  barindex
                  Yara detected RedLine Stealer
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000023.00000002.2544610595.0000000006050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\xwielkiowcx, type: DROPPED
                  Tries to harvest and steal Bitcoin Wallet information
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey opened: HKEY_CURRENT_USER\Software\Bitcoin\Bitcoin-QtJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey opened: HKEY_CURRENT_USER\Software\monero-project\monero-coreJump to behavior
                  Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc)
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2\SessionsJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeKey opened: HKEY_CURRENT_USER\Software\Martin Prikryl\WinSCP 2 OverrideJump to behavior
                  Tries to harvest and steal browser information (history, passwords, etc)
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\ProfilesJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\fqs92o4p.default-releaseJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeFile opened: C:\Users\user\AppData\Local\Mozilla\Firefox\Profiles\z6bny8rn.defaultJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeFile opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\DefaultJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
                  Source: C:\Users\user\AppData\Local\Temp\Syncsign_v1.exeDirectory queried: C:\Users\user\DocumentsJump to behavior
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000023.00000002.2544610595.0000000006050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\xwielkiowcx, type: DROPPED

                  Remote Access Functionality

                  barindex
                  Yara detected RedLine Stealer
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 35.2.cmd.exe.60500c8.7.raw.unpack, type: UNPACKEDPE
                  Source: Yara matchFile source: 00000023.00000002.2544610595.0000000006050000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
                  Source: Yara matchFile source: C:\Users\user\AppData\Local\Temp\xwielkiowcx, type: DROPPED
                  Source: C:\Users\user\AppData\Local\Florilegium\SplashWin.exeCode function: 2_2_007813A0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,2_2_007813A0
                  Source: C:\Users\user\AppData\Roaming\sqSystem\SplashWin.exeCode function: 3_2_006F13A0 __ehhandler$??1_Scoped_lock@?$SafeRWList@UListEntry@details@Concurrency@@VNoCount@CollectionTypes@23@V_ReaderWriterLock@23@@details@Concurrency@@QAE@XZ,3_2_006F13A0

                  Mitre Att&ck Matrix

                  ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
                  Gather Victim Identity InformationAcquire Infrastructure1
                  Replication Through Removable Media                  		2
                  Command and Scripting Interpreter                  		11
                  DLL Side-Loading                  		1
                  Abuse Elevation Control Mechanism                  		1
                  Disable or Modify Tools                  		1
                  OS Credential Dumping                  		1
                  System Time Discovery                  		Remote Services1
                  Archive Collected Data                  		1
                  Ingress Tool Transfer                  		Exfiltration Over Other Network MediumAbuse Accessibility Features
                  CredentialsDomainsDefault AccountsScheduled Task/Job1
                  Registry Run Keys / Startup Folder                  		11
                  DLL Side-Loading                  		1
                  Deobfuscate/Decode Files or Information                  		1
                  Credentials in Registry                  		11
                  Peripheral Device Discovery                  		Remote Desktop Protocol11
                  Data from Local System                  		11
                  Encrypted Channel                  		Exfiltration Over BluetoothNetwork Denial of Service
                  Email AddressesDNS ServerDomain AccountsAtLogon Script (Windows)212
                  Process Injection                  		1
                  Abuse Elevation Control Mechanism                  		Security Account Manager13
                  File and Directory Discovery                  		SMB/Windows Admin SharesData from Network Shared Drive11
                  Non-Standard Port                  		Automated ExfiltrationData Encrypted for Impact
                  Employee NamesVirtual Private ServerLocal AccountsCronLogin Hook1
                  Registry Run Keys / Startup Folder                  		3
                  Obfuscated Files or Information                  		NTDS146
                  System Information Discovery                  		Distributed Component Object ModelInput Capture3
                  Non-Application Layer Protocol                  		Traffic DuplicationData Destruction
                  Gather Victim Network InformationServerCloud AccountsLaunchdNetwork Logon ScriptNetwork Logon Script2
                  Software Packing                  		LSA Secrets221
                  Security Software Discovery                  		SSHKeylogging14
                  Application Layer Protocol                  		Scheduled TransferData Encrypted for Impact
                  Domain PropertiesBotnetReplication Through Removable MediaScheduled TaskRC ScriptsRC Scripts11
                  DLL Side-Loading                  		Cached Domain Credentials1
                  Virtualization/Sandbox Evasion                  		VNCGUI Input CaptureMultiband CommunicationData Transfer Size LimitsService Stop
                  DNSWeb ServicesExternal Remote ServicesSystemd TimersStartup ItemsStartup Items1
                  File Deletion                  		DCSync2
                  Process Discovery                  		Windows Remote ManagementWeb Portal CaptureCommonly Used PortExfiltration Over C2 ChannelInhibit System Recovery
                  Network Trust DependenciesServerlessDrive-by CompromiseContainer Orchestration JobScheduled Task/JobScheduled Task/Job21
                  Masquerading                  		Proc FilesystemSystem Owner/User DiscoveryCloud ServicesCredential API HookingApplication Layer ProtocolExfiltration Over Alternative ProtocolDefacement
                  Network TopologyMalvertisingExploit Public-Facing ApplicationCommand and Scripting InterpreterAtAt1
                  Virtualization/Sandbox Evasion                  		/etc/passwd and /etc/shadowNetwork SniffingDirect Cloud VM ConnectionsData StagedWeb ProtocolsExfiltration Over Symmetric Encrypted Non-C2 ProtocolInternal Defacement
                  IP AddressesCompromise InfrastructureSupply Chain CompromisePowerShellCronCron212
                  Process Injection                  		Network SniffingNetwork Service DiscoveryShared WebrootLocal Data StagingFile Transfer ProtocolsExfiltration Over Asymmetric Encrypted Non-C2 ProtocolExternal Defacement

                  Behavior Graph

                  Hide Legend

                  Legend:

                  • Process
                  • Signature
                  • Created File
                  • DNS/IP Info
                  • Is Dropped
                  • Is Windows Process
                  • Number of created Registry Values
                  • Number of created Files
                  • Visual Basic
                  • Delphi
                  • Java
                  • .Net C# or VB.NET
                  • C, C++ or other language
                  • Is malicious
                  • Internet
                  behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1629426 Sample: 95.msi Startdate: 04/03/2025 Architecture: WINDOWS Score: 100 114 undermymindops.com 2->114 116 shed.dual-low.s-part-0032.t-0009.t-msedge.net 2->116 118 8 other IPs or domains 2->118 134 Suricata IDS alerts for network traffic 2->134 136 Malicious sample detected (through community Yara rule) 2->136 138 Antivirus detection for URL or domain 2->138 140 6 other signatures 2->140 12 msiexec.exe 80 40 2->12         started        15 SplashWin.exe 1 2->15         started        18 msedge.exe 2->18         started        21 msiexec.exe 3 2->21         started        signatures3 process4 dnsIp5 106 C:\Users\user\AppData\Local\...\SplashWin.exe, PE32 12->106 dropped 108 C:\Users\user\AppData\...\vcruntime140.dll, PE32 12->108 dropped 110 C:\Users\user\AppData\Local\...\msvcp140.dll, PE32 12->110 dropped 112 C:\Users\user\AppData\Local\...\DuiLib_u.dll, PE32 12->112 dropped 23 SplashWin.exe 7 12->23         started        27 msiexec.exe 56 12->27         started        172 Maps a DLL or memory area into another process 15->172 29 cmd.exe 2 15->29         started        120 192.168.2.4, 138, 15847, 443 unknown unknown 18->120 122 239.255.255.250 unknown Reserved 18->122 31 msedge.exe 18->31         started        34 msedge.exe 18->34         started        36 msedge.exe 18->36         started        38 identity_helper.exe 18->38         started        file6 signatures7 process8 dnsIp9 78 C:\Users\user\AppData\...\vcruntime140.dll, PE32 23->78 dropped 80 C:\Users\user\AppData\...\msvcp140.dll, PE32 23->80 dropped 82 C:\Users\user\AppData\...\SplashWin.exe, PE32 23->82 dropped 84 C:\Users\user\AppData\...\DuiLib_u.dll, PE32 23->84 dropped 142 Switches to a custom stack to bypass stack traces 23->142 144 Found direct / indirect Syscall (likely to bypass EDR) 23->144 40 SplashWin.exe 1 23->40         started        86 C:\Users\user\AppData\...\vcruntime140.dll, PE32 27->86 dropped 88 C:\Users\user\AppData\Local\...\msvcp140.dll, PE32 27->88 dropped 90 C:\Users\user\AppData\Local\...\SplashWin.exe, PE32 27->90 dropped 94 4 other malicious files 27->94 dropped 43 SplashWin.exe 27->43         started        45 ISBEW64.exe 27->45         started        47 ISBEW64.exe 27->47         started        53 8 other processes 27->53 92 C:\Users\user\AppData\Local\Temp\ctgfskqqpp, PE32+ 29->92 dropped 146 Writes to foreign memory regions 29->146 148 Maps a DLL or memory area into another process 29->148 49 Syncsign_v1.exe 29->49         started        51 conhost.exe 29->51         started        128 2.23.227.208, 443, 49836 QA-ISPQA European Union 31->128 130 18.173.132.23, 443, 49879 MIT-GATEWAYSUS United States 31->130 132 28 other IPs or domains 31->132 file10 signatures11 process12 signatures13 150 Maps a DLL or memory area into another process 40->150 152 Switches to a custom stack to bypass stack traces 40->152 154 Found direct / indirect Syscall (likely to bypass EDR) 40->154 55 cmd.exe 5 40->55         started        59 cmd.exe 43->59         started        process14 file15 96 C:\Users\user\AppData\...\Syncsign_v1.exe, PE32+ 55->96 dropped 98 C:\Users\user\AppData\Local\Temp\pwvtwt, PE32+ 55->98 dropped 156 Writes to foreign memory regions 55->156 158 Found hidden mapped module (file has been removed from disk) 55->158 160 Maps a DLL or memory area into another process 55->160 162 Switches to a custom stack to bypass stack traces 55->162 61 Syncsign_v1.exe 2 55->61         started        65 conhost.exe 55->65         started        100 C:\Users\user\AppData\Local\...\xwielkiowcx, PE32 59->100 dropped 67 conhost.exe 59->67         started        69 backgroundTaskHost.exe 59->69         started        signatures16 process17 dnsIp18 124 piaktrip.online 104.21.40.182, 443, 49762, 49763 CLOUDFLARENETUS United States 61->124 126 undermymindops.com 172.67.164.91, 443, 49766 CLOUDFLARENETUS United States 61->126 164 Tries to harvest and steal Putty / WinSCP information (sessions, passwords, etc) 61->164 166 Tries to harvest and steal browser information (history, passwords, etc) 61->166 168 Tries to harvest and steal Bitcoin Wallet information 61->168 170 Found direct / indirect Syscall (likely to bypass EDR) 61->170 71 msiexec.exe 7 61->71         started        74 msedge.exe 61->74         started        signatures19 process20 file21 102 C:\Users\user\AppData\Local\...\MSI1B74.tmp, PE32 71->102 dropped 104 C:\Users\user\AppData\Local\...\MSI14BC.tmp, PE32 71->104 dropped 76 msedge.exe 74->76         started        process22

                  Screenshots

                  Thumbnails

                  This section contains all screenshots as thumbnails, including those not shown in the slideshow.